Repository navigation
fix(deps): patch RUSTSEC-2026-0386, acknowledge RUSTSEC-2026-0387 - #47
Merged
Merged
Conversation
tokio 1.53.1 -> 1.53.3 fixes the AsyncFd I/O-safety unsoundness (RUSTSEC-2026-0386); knot never calls AsyncFd itself. crypto-bigint 0.5.5 (RUSTSEC-2026-0387) is pinned by openidconnect 4.0.1 -> p256/p384 0.13 -> elliptic-curve 0.13 and has no 0.5.x fix. knot only verifies ES256/ES384 ID-token signatures over public values and holds no EC private key, so it is ignored in deny.toml with the reachability analysis, like the rsa entry on the same path. Both advisories were published on 2026-10-23 and fail cargo-deny on every branch. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
christianhuening
added a commit
that referenced
this pull request
Oct 24, 2026
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
revoked_editor_is_closed_with_4403_and_its_edits_are_dropped failed about one run in five (CI: ConnectionReset at the send after the revoke). The server may close the revoked editor's socket before the editor's "keeps typing" write; that write then gets a TCP reset, which can also discard the pending 4403 close frame. The write may now fail (an edit that never arrives is dropped too), and the 4403 is read from a second peer that stays silent after the revoke, so it is checked on every run. The persistence and byline assertions are unchanged. 30/30 local runs pass, from 10/12 before. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two advisories published on 2026-10-23 fail
cargo-denyon every branch,mainincluded (#46 is blocked by it).AsyncFd.openidconnect 4.0.1 → p256/p384 0.13 → elliptic-curve 0.13.openidconnect4.0.1 is the latest release, and the fix exists only in crypto-bigint 0.7.6, whichelliptic-curve0.13 can't reach. knot authenticates to the OIDC provider with a client secret and only verifies ES256/ES384 ID-token signatures. The affected arithmetic therefore only ever sees public values, so a timing leak reveals nothing. The ignore entry follows the existingrsaone (RUSTSEC-2023-0071) on the same path, and records when to drop it.Evidence
cargo-denyjob on feat(export): export a page to Word (DOCX) and OpenDocument (ODT) #46 reportsadvisories FAILEDfor RUSTSEC-2026-0386 and RUSTSEC-2026-0387.After: locally
cargo deny checkreportsadvisories ok, bans ok, licenses ok, sources ok.cargo nextest run --workspace --all-features: 460 passed, 2 skipped.Merge Danger
Door: two-way
The change is a patch-level lockfile bump and one ignore entry.
Blast Radius: low
tokio 1.53.1 → 1.53.3 is a patch release with no API changes. The ignore entry has to be removed once
openidconnectmoves toelliptic-curve0.14.🤖 Generated with Claude Code