Fix/dependabot advisories - #12
Open
juicycleff wants to merge 9 commits into
Open
Conversation
openssl 0.10.74 -> 0.10.81 clears eight advisories, five of them high: out-of-bounds writes in MdCtxRef::digest_final, Deriver::derive and CipherCtxRef, an incorrect bounds assertion in AES key wrap, unchecked callback lengths in the PSK/cookie trampolines, an OOB read in the PEM password callback, a heap overflow when encrypting, and undefined behavior in X509Ref::ocsp_resp. The highest fix floor across them is 0.10.80. rand 0.8.5 -> 0.8.7 (unsound with a custom logger using rand::rng). rsa 0.9.8 -> 0.9.10 (panic on a prime equal to 1). All semver-compatible, so this is a lockfile-only change. Workspace builds and the full test suite passes.
Fixes type confusion on exp/nbf when those claims are not required, which could lead to an authentication bypass. Fix floor is 10.3.0. The call sites needed no changes: decode, encode, decode_header, Algorithm, DecodingKey, EncodingKey, Header, Validation and errors::ErrorKind are all unchanged across the major. Selects the aws_lc_rs crypto provider explicitly. jsonwebtoken 10 made the backend pluggable and panics at the first signing or verification call if neither rust_crypto nor aws_lc_rs is enabled -- a runtime panic in the auth path, not a compile error, so it is only caught by actually exercising the code (auth-jwt's test_validate_token did). aws-lc-rs is already in the tree via rustls, so this pulls in no new native build. Applied at all three declaration sites rather than relying on feature unification, so plugins built standalone get a provider too. Held at 10.x rather than 11: 11.0 adds unrelated breaking changes (non_exhaustive enums, Header.extras, key accessor renames) that are not needed to clear the advisory.
Clears 14 high-severity advisories, the largest single group in the npm alerts. Both are patch bumps within the existing major: frontend/docs 15.5.18 -> 15.5.21 (fix floor 15.5.21) and crates/octopus-admin/ui 16.2.6 -> 16.2.11 (fix floor 16.2.11). The admin UI builds and prerenders all routes on 16.2.11. The docs site could not be build-verified: `pnpm install` there fails in the fumadocs-mdx postinstall with ERR_PACKAGE_PATH_NOT_EXPORTED, because fumadocs-docgen 3.1.0 imports fumadocs-core/mdx-plugins/codeblock-utils, a subpath the resolved fumadocs-core 15.8.5 no longer exports. That failure reproduces on unmodified main and is unrelated to this bump, so the lockfile here was refreshed with --ignore-scripts.
The advisories are almost entirely in transitive dependencies whose parents pin them by range, so `pnpm update` reports "Already up to date" and changes nothing. pnpm.overrides is the only lever that moves them. Adds the same 30-entry override block to all three pnpm workspaces: crates/octopus-admin/ui 57 alerts -> 0 crates/octopus-admin 7 alerts -> 0 frontend/docs 87 alerts -> 15 Four packages are version-scoped rather than pinned outright, because two incompatible majors are each vulnerable and a blanket pin would force callers of the old API onto the new one: brace-expansion@1 -> 1.1.18, @>=3 -> 5.0.9 js-yaml@3 -> 3.15.1, @>=4 -> 4.3.1 picomatch@2 -> 2.3.2, @>=4 -> 4.0.4 minimatch@>=10, path-to-regexp@>=8, nanoid@>=3 <4 The admin UI builds and prerenders every route with the overrides applied, which is the meaningful check here: overrides can silently force a parent onto an API it was not written against. frontend/docs keeps 15 alerts that have no available fix. All trace to the @ai-sdk chain behind the docs AI search: @ai-sdk/provider-utils and image-size both report "no patched version", and provider-utils pins undici 5.29.0 whose advisories are only fixed in 6.x. Clearing them means an upstream release or dropping AI search, not an override.
google.golang.org/grpc 1.80.0 -> 1.82.1 (xDS RBAC and HTTP/2 vulnerabilities, high) and github.com/jackc/pgx/v5 5.9.0 -> 5.9.2 (SQL injection via placeholder confusion with dollar-quoted strings). Both are indirect dependencies of the benchmark harness, not of the gateway itself. go build ./... passes.
Fixes unbounded memory allocation when parsing W3C Baggage headers, a DoS reachable from any request the gateway propagates context for. Fix floor is opentelemetry_sdk 0.32.1. Moves the whole otel stack together, since the crates version in lockstep: opentelemetry 0.22 -> 0.32, opentelemetry_sdk 0.22 -> 0.32, opentelemetry-otlp 0.15 -> 0.32, opentelemetry-semantic-conventions 0.14 -> 0.32, tracing-opentelemetry 0.23 -> 0.33. Rewrites the two call sites the migration breaks: - The new_pipeline()/new_exporter()/install_batch() builder is gone. Replaced by SpanExporter::builder().with_tonic() feeding an explicit SdkTracerProvider. - global::shutdown_tracer_provider() is gone. The provider itself must be shut down, so init_tracing now returns it and Serve calls provider.shutdown() where the old global call was. Note that global::tracer_provider() returns a handle, so dropping that is NOT a flush -- it would silently discard buffered spans on exit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.