Repository navigation
fix(deps): upgrade fmt to 9.1.0 for security fixes - #141
Merged
Merged
Conversation
Pin the official release archive and verified SHA-256 to include the upstream memory-buffer move and floating-point buffer-overflow fixes. Preserve logging behavior with explicit numeric enum conversions and streamed UTC timestamps required by fmt 9. Keep the runtime-format and scoped-enum compatibility fixes already present. Validated the native and Rust client build, all seven native CTest suites, and the public patch with Gitleaks and TruffleHog. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jmclong (jmclong)
requested review from
a team,
Aditya Bansal (adityabansal),
Bhargav Gulavani (bhargav-gulavani) and
Simon Croome (croomes)
as code owners
October 26, 2026 20:31
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
Author
|
/azp run dacs-pullrequest |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Simon Croome (croomes)
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrade the native-build dependency from fmt 8.1.1 to the official fmt 9.1.0 release archive, retaining SHA-256 verification:
cceb4cb9366e18a5742128cb3524ce5f50e88b476f1e54737a47ffdf4df4c996This includes the upstream fixes for:
Apply only the logging compatibility adjustments required by fmt 9: explicit numeric enum conversions and
fmt::streamedfor UTC timestamps. Preserve existing runtime-format handling and scoped-enum conversions. No logging message templates, signatures, or control flow change. The fmt 9 migration notes document the enum deprecation and removal of automatic ostream discovery.The focused change replaces 34 lines across 10 files.
Validation
FMT_VERSION=90100.make build USE_CONTAINER=0passed in the native toolchain container, including the Rust client build.make test-native USE_CONTAINER=0: all 7 CTest suites passed in 170.39 seconds; existing environment-gated tests retain their skips.git diff --checkpassed.Security scope
This resolves the reported buffer issues, not every possible vulnerability. fmt 9.1.0 is also covered by GHSA-65g5-63wg-xjh4, a macOS-only
fmt::say()command-injection advisory with no CVE assigned, fixed in 12.0.0. That macOS path is not applicable to the supported Linux build. Retain 9.1.0 here to keep this upgrade and compatibility migration narrowly scoped.