From 36bcd6f853f0d0fbb8968ae9a3a54f91ae731d2a Mon Sep 17 00:00:00 2001 From: Byron Date: Wed, 23 Sep 2026 17:53:04 +0200 Subject: [PATCH] fix(gix-hash): require patched `faster-hex` for hex conversions Port 8523d62442974bb2563247228dddefb6ff31e8ab to fix `RUSTSEC-2026-0306`. The safe `hex_decode_unchecked()` API in `faster-hex` 0.10.0 can read beyond short input on the AVX2 path; the 0.10.1 backport fixes it without an API migration. Require the patched version in `gix-hash` and `gix-packetline`, preserving this branch's `thiserror` dependency in the latter, and update `Cargo.lock`. Clear the remaining Cargo deny warnings by upgrading yanked `chacha20` 0.10.1 to 0.10.2, dropping the obsolete `RUSTSEC-2024-0436`, `RUSTSEC-2026-0118`, and `RUSTSEC-2026-0119` ignores, and removing the unused `OpenSSL` license allowance. Keep the applicable `async-std` ignore. Assisted-by: GPT 6.0 Co-authored-by: GPT 6.0 --- Cargo.lock | 21 ++++++++++++++++----- deny.toml | 4 ---- gix-hash/Cargo.toml | 2 +- gix-packetline/Cargo.toml | 2 +- 4 files changed, 18 insertions(+), 11 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 50bba1d9003..ce1b7d60c73 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -454,9 +454,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures", @@ -938,6 +938,15 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "930c7171c8df9fb1782bdf9b918ed9ed2d33d1d22300abb754f9085bc48bf8e8" +[[package]] +name = "defmt" +version = "0.3.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad" +dependencies = [ + "defmt 1.1.0", +] + [[package]] name = "defmt" version = "1.1.0" @@ -1217,10 +1226,12 @@ checksum = "dd2e7510819d6fbf51a5545c8f922716ecfb14df168a3242f7d33e0239efe6a1" [[package]] name = "faster-hex" -version = "0.10.0" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7223ae2d2f179b803433d9c830478527e92b8117eab39460edae7f1614d9fb73" +checksum = "04839bdf9d8c10f66806fad16b852fc72aab80873aebc3cb69d85b4fa41543ed" dependencies = [ + "autocfg", + "defmt 0.3.100", "heapless", "serde", ] @@ -3358,7 +3369,7 @@ version = "0.2.31" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccfe6121cbe750cf81efa362d85c0bde7ea298ec43092d3a193baca59cdbd634" dependencies = [ - "defmt", + "defmt 1.1.0", "jiff-static", "jiff-tzdb-platform", "log", diff --git a/deny.toml b/deny.toml index cd6740261fe..969a96dd06c 100644 --- a/deny.toml +++ b/deny.toml @@ -10,9 +10,6 @@ [advisories] ignore = [ { id = "RUSTSEC-2025-0052", reason = "`async-std` - unmaintained without replacement - needs some time to replace, but async version isn't too important right now" }, - { id = "RUSTSEC-2024-0436", reason = "unmaintained, comes in with `curl`" }, - { id = "RUSTSEC-2026-0118", reason = "`hickory-proto` comes through reqwest's optional hickory DNS feature; no safe 0.25.x upgrade is available yet" }, - { id = "RUSTSEC-2026-0119", reason = "`hickory-proto` comes through reqwest's optional hickory DNS feature; reqwest has not upgraded to hickory 0.26.1 yet" } ] @@ -33,7 +30,6 @@ allow = [ "MIT", "MIT-0", "ISC", - "OpenSSL", "Zlib", "MPL-2.0", "Unicode-3.0" diff --git a/gix-hash/Cargo.toml b/gix-hash/Cargo.toml index e45586ac459..dea6b7f2075 100644 --- a/gix-hash/Cargo.toml +++ b/gix-hash/Cargo.toml @@ -31,7 +31,7 @@ gix-features = { version = "^0.49.1", path = "../gix-features", features = ["pro gix-error = { version = "^0.3.0", path = "../gix-error" } bstr = { version = "1.12.0", optional = true, default-features = false, features = ["alloc"] } -faster-hex = { version = "0.10.0", default-features = false, features = ["std"] } +faster-hex = { version = "0.10.1", default-features = false, features = ["std"] } serde = { version = "1.0.114", optional = true, default-features = false, features = ["derive"] } sha1dc = { version = "0.1.2", optional = true, default-features = false, features = ["std"] } sha2 = { version = "0.11.0", optional = true, default-features = false } diff --git a/gix-packetline/Cargo.toml b/gix-packetline/Cargo.toml index 468de540681..10c62030223 100644 --- a/gix-packetline/Cargo.toml +++ b/gix-packetline/Cargo.toml @@ -43,7 +43,7 @@ gix-trace = { version = "^0.1.21", path = "../gix-trace" } serde = { version = "1.0.114", optional = true, default-features = false, features = ["std", "derive"] } thiserror = "2.0.18" -faster-hex = { version = "0.10.0", default-features = false, features = ["std"] } +faster-hex = { version = "0.10.1", default-features = false, features = ["std"] } bstr = { version = "1.12.0", default-features = false, features = ["std"] } # async support futures-io = { version = "0.3.32", optional = true }