Skip to content

build(deps): bump hmac and crypto deps to clean up advisory on block-buffer - #1971

Open
rhammonds-teleport wants to merge 1 commit into
Devolutions:masterfrom
rhammonds-teleport:upgrade-blockbuffer-dep
Open

build(deps): bump hmac and crypto deps to clean up advisory on block-buffer#1971
rhammonds-teleport wants to merge 1 commit into
Devolutions:masterfrom
rhammonds-teleport:upgrade-blockbuffer-dep

Conversation

@rhammonds-teleport

@rhammonds-teleport rhammonds-teleport commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

The PR bumps a handful of dependencies to upgrade past a vulnerable release of the transitive dependency block-buffer.

@github-actions github-actions Bot added kind/protocol Affects RDP or related protocol behavior risk/medium Behavioral change that does not substantially alter a core public API scope/core Touches the core architectural tier scope/ffi Affects native or .NET bindings size/L Size: up to 899 counted lines and 20 files; exceeds M in either measure triage/overlap Possible overlap with another pull request; advisory only labels Sep 16, 2026
@github-actions

github-actions Bot commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This pull request may overlap with #2080.

Both PRs bump sspi and picky in ironrdp-connector and adapt the now-fallible TsRequest::buffer_len in the connector and acceptor credssp code. This PR targets sspi 0.22 while #2080 targets sspi 0.23 with a stated dalek-pin motivation, so exact versions differ, but the shared scope is substantial and merits human comparison.

This notice is advisory only. Automated review continues as usual, and how these pull requests relate is for maintainers and authors to decide.

Note

LLM-assisted content (no human feedback).

@github-actions github-actions Bot added breaking-change Includes a breaking change, and requires special scrutiny at the boundaries risk/high Substantial core public API impact, or fail-closed triage; needs maintainer-level scrutiny needs-author-action The pull request author is the current next actor and removed risk/medium Behavioral change that does not substantially alter a core public API labels Oct 9, 2026

This branch was successfully deployed

1 active deployment
llm-providers — b0fa3540 Deployed Oct 9, 2026 by rhammonds-teleport via Classify pull request #2347
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

breaking-change Includes a breaking change, and requires special scrutiny at the boundaries kind/protocol Affects RDP or related protocol behavior needs-author-action The pull request author is the current next actor risk/high Substantial core public API impact, or fail-closed triage; needs maintainer-level scrutiny scope/core Touches the core architectural tier scope/ffi Affects native or .NET bindings size/L Size: up to 899 counted lines and 20 files; exceeds M in either measure triage/overlap Possible overlap with another pull request; advisory only

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rhammonds-teleport