Repository navigation
fix(deps): resolve RUSTSEC-2026-0457/0461/0462 (rmcp 3.5.0 → 3.9.0) - #469
hyperpolymath wants to merge 1 commit into
Conversation
The "Dependency audit" and the rust-ci audit fail on main for three advisories against rmcp 3.5.0, which echidna-mcp depends on as `version = "3"`: - RUSTSEC-2026-0457: the OAuth client's SSRF filter checks host strings, not resolved addresses; - RUSTSEC-2026-0461: unbounded tool-schema cache in the Streamable HTTP server transport; - RUSTSEC-2026-0462: unbounded response-body buffering in Streamable HTTP clients. `cargo update -p rmcp -p rmcp-macros --precise 3.9.0` on the pinned toolchain (1.99.0). rmcp 3.9.0 adds libc and sha2 0.11 to its own dependency list. The lockfile also re-points some Windows-only `windows-sys` and `getrandom` edges (anstyle-query, colored, errno, rustix, socket2 and others). The pinned cargo makes that same change on a no-op `cargo update -p rmcp --precise 3.5.0`, so it is the resolver's output on the current index, not part of this upgrade. No package versions other than rmcp and rmcp-macros change. cargo audit -f Cargo.lock: 0 vulnerabilities (was 3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WS4mfQeC3N1DWjcCQJaQqw
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
|
Closing as a duplicate of #465. That PR carries the same Generated by Claude Code |
Summary
Dependency auditand the rust-ci cargo audit are red onmain, so every PR fails them. The cause is three advisories againstrmcp3.5.0, whichcrates/echidna-mcpdepends on asversion = "3":This is the same shape as #457 and #460.
Changes
Cargo.lockonly. The command wascargo update -p rmcp -p rmcp-macros --precise 3.9.0on the pinned toolchain (1.99.0).rmcpandrmcp-macrosgo from 3.5.0 to 3.9.0.rmcp3.9.0 newly listslibcandsha2 0.11, both already in the lock.windows-sysandgetrandomedges (anstyle-query, colored, errno, rustix, socket2 and others). The pinned cargo makes the identical change on a no-opcargo update -p rmcp --precise 3.5.0, so it is the resolver's output on the current index, not part of the upgrade. No other package changes version.RSR Quality Checklist
Required
echidna-mcphas no tests of its own.cargo clippy --locked -p echidna-mcp -- -D warningsis clean.As Applicable
libcandsha2are already in the tree, andrmcpkeeps its licence at a minor release.Testing
cargo audit -f Cargo.lockonmain's lockcargo audit -f Cargo.lockon this branchcargo test --locked -p echidna-mcpcargo clippy --locked -p echidna-mcp -- -D warningsNot verified: runtime behaviour of the MCP server on 3.9.0. The crate has no tests, so this shows only that the API still compiles.
Generated by Claude Code