Repository navigation
Conversation
cargo-deny's advisories check fails on RUSTSEC-2026-0386 (unsound safe AsyncFd constructors) for tokio 1.53.1. 1.53.3 is the patched release on the same minor line. Lockfile-only update; the matching tokio line in THIRD-PARTY-LICENSES.txt is updated so the license check stays in sync with Cargo.lock. Signed-off-by: Sean Tang <171081544+seant-aws@users.noreply.github.com>
|
Claude review · advisory Reviewed Open: 0 blocking · 0 should-fix · 0 nit. ✅ Nothing blocking. Fix or reply to each thread; the next revision's review re-checks open threads and resolves those it agrees are handled. Resolving a thread yourself also closes it. Later revisions review only what changed. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: no tracking issue;
cargo-denyfails on every PR since 2026-10-23 (example run: https://github.com/OpenJobDescription/openjd-model-for-python/actions/runs/41897097991).What was the problem/requirement? (What/Why)
The advisories check fails on RUSTSEC-2026-0386 (safe
AsyncFdconstructors are unsound) for tokio 1.53.1, whichopenjd-sessionsand the bindings pull in.What was the solution? (How)
A patched release exists, so this updates the lockfile only:
cargo update -p tokio --precise 1.53.3(the fixed release on the same minor line), with nodeny.tomlignore. The tokio version line inTHIRD-PARTY-LICENSES.txtis bumped to match, since that check is tied toCargo.lock.What is the impact of this change?
tokio 1.53.1 -> 1.53.3 in the shipped extension; no Cargo.toml or code changes.
How was this change tested?
cargo deny check advisoriesfails before and passes after; licenses/bans/sources,cargo fmt --check, build, clippy-D warnings,cargo test, andhatch run test(6330 passed) all pass. The THIRD-PARTY-LICENSES check still fails here on the unrelated pydantic drift fixed in the separate licenses PR; the two PRs touch different lines of that file and merge in either order.Was this change documented?
N/A.
Is this a breaking change?
No.
Does this change impact security?
No.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.