fix(deps): move sqlx to the upstream commit that permits the patched SQLite (RUSTSEC-2026-0459) by hyperpolymath · Pull Request #199 · hyperpolymath/echidnabot

hyperpolymath · 2026-11-10T17:47:02Z

Summary

Dependency audit (cargo audit) fails on main since 2026-11-10 (run 449 at bbbc433), and so on each open pull request, for example #197. The cause is a new advisory: RUSTSEC-2026-0459 (CVE-2026-119375) in libsqlite3-sys 0.30.1, the crate that carries the SQLite source. The patched crate is 0.39.0 or later.

This pull request repairs the dependency. It does not add an ignore entry: it removes the one that the file had.

Why a commit of sqlx, and not a release

No crates.io release of sqlx permits the patched crate:

sqlx	`libsqlite3-sys` that it permits	Result
0.8.6 (the version on `main`)	0.30	`cargo update -p libsqlite3-sys` moves 0 packages
0.9.0 (the latest release)	`>=0.30.1, <0.38.0`	the best version is 0.37.0, which the advisory lists as affected
`main` since commit `10462fa` (2026-11-08, sqlx pull request 4502)	`>=0.30.1, <0.40.0`	0.39.1, patched

Upstream has the repair, and it is not in a release. This change takes sqlx from that commit, pinned by its full hash. This crate has 2 git dependencies of the same form already (gitbot-shared-context, echidna-core).

The trade. The crate then depends on 1 commit of sqlx that is not a release: sqlx 0.9.0 plus the commits on its main branch up to 10462fa. The other option is an ignore entry in .cargo/audit.toml until sqlx makes a release. The exposure is low in each case: the advisory needs a party who can write the database file and its -wal file, and this crate opens only its own database. The owner asked for the repair and not for the ignore entry.

The exit. At the first sqlx release after 0.9.0, the line in Cargo.toml goes back to version = "...". A comment on the line says this.

Relation to #198

#198 moves the 3 crates that have warnings (event-listener, chacha20, spin) and says that it does not repair RUSTSEC-2026-0459. This pull request repairs RUSTSEC-2026-0459 and does not move those 3 crates. The 2 changes do not overlap in content, but each one changes Cargo.lock. The one that merges second needs main merged in and its cargo update commands run again.

Changes

Cargo.toml: sqlx from the upstream commit 10462fa4414c6c7f1ed1d39bb31678e3b726878c. The feature runtime-tokio-rustls does not exist in 0.9. In 0.8.6 it was runtime-tokio plus tls-rustls-ring, and tls-rustls-ring was tls-rustls-ring-webpki. The line now names runtime-tokio and tls-rustls-ring-webpki, so the feature set is the same.
Cargo.lock: cargo update -p sqlx, then cargo update -p libsqlite3-sys. libsqlite3-sys is 0.39.1. The crates that sqlx 0.8 needed and sqlx 0.9 does not need go out, rsa among them.
.cargo/audit.toml: the ignore entry for RUSTSEC-2023-0071 (rsa) is removed. Its reason was that rsa is in Cargo.lock only through the MySQL backend of sqlx 0.8. rsa is not in Cargo.lock any more. The list is empty.
No source file changes. The crate compiles against sqlx 0.9 as it is.

Testing

Run locally with Rust 1.99.0 (the toolchain of rust-toolchain.toml), at 1a6908e:

cargo audit (cargo-audit from crates.io, the tool of the CI check):
- on main: error: 1 vulnerability found! (RUSTSEC-2026-0459). This is the result of CI.
- on this branch: 0 vulnerabilities, exit 0. The 3 allowed warnings are the same as before (event-listener, chacha20, spin).
cargo test --locked: exit 0, 0 failed. Unit tests 214; integration_tests 32; lifecycle 23; live_echidna 5; property_tests 12; protocol_contract 12; seam_test 15; smoke 13; doc tests 2 passed and 1 ignored.
cargo clippy --locked --all-targets -- -D warnings: exit 0 (run on a scratch copy with the same Cargo.lock and the same sqlx line).
cargo fmt --check: exit 0.
cargo metadata --locked: exit 0.

Not verified:

The PostgreSQL path at run time. The tests use SQLite (sqlite::memory:). The PostgreSQL code compiles.
The live_echidna tests return at once when their environment variables are not set, so their 5 passes do not show a live run.
The container build (Containerfile).
The behaviour changes of sqlx 0.9 that the compiler does not show. The sqlx changelog lists them for 0.9.0; 2 that can matter here: tracing log spelling, and the output of the query!() macros for some PostgreSQL queries.

After the merge

fix(tests): mark 4 non-secret constants for the secret scan, and take the nil UUID from the type #197 gets main merged in, and its Dependency audit check can pass.
The fleet copy (bots/echidnabot/ in gitbot-fleet) takes this change with the next pin move, because Cargo.toml and Cargo.lock are in its include list.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK

…SQLite (RUSTSEC-2026-0459) `Dependency audit` (`cargo audit`) fails on `main` since 2026-11-10, and so on each open pull request: RUSTSEC-2026-0459 (CVE-2026-119375) in `libsqlite3-sys` 0.30.1, the crate that carries the SQLite source. The patched crate is 0.39.0 or later. No crates.io release of sqlx permits that version: - sqlx 0.8.6 (the version here) holds `libsqlite3-sys` at 0.30. - sqlx 0.9.0 (the latest release) requires `>=0.30.1, <0.38.0`. Upstream repaired its side on 2026-11-08: commit 10462fa (sqlx pull request 4502) widens the range to `<0.40.0`. It is on the `main` branch of sqlx and not in a release. This change takes sqlx from that commit, pinned by its full hash, as the 2 other git dependencies of this crate are. Changes: - `Cargo.toml`: sqlx from the upstream commit. The feature `runtime-tokio-rustls` does not exist in 0.9; `runtime-tokio` and `tls-rustls-ring-webpki` are what it was in 0.8.6. A comment gives the reason and the exit: go back to a crates.io version at the first sqlx release after 0.9.0. - `Cargo.lock`: `cargo update -p sqlx` and `cargo update -p libsqlite3-sys`. `libsqlite3-sys` is 0.39.1. - `.cargo/audit.toml`: the ignore entry for RUSTSEC-2023-0071 (`rsa`) is removed. `rsa` came in through the MySQL backend of sqlx 0.8 and is not in `Cargo.lock` any more. The list is empty. No source file changes: the crate compiles against sqlx 0.9 as it is. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK

coderabbitai · 2026-11-10T17:47:13Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 40634a44-6619-43c5-be77-ecc62bd28408

Commits

Reviewing files that changed from the base of the PR and between 3722843 and d87207b.

Files ignored due to path filters: 1

Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

.cargo/audit.toml
Cargo.toml

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

chatgpt-codex-connector · 2026-11-10T17:54:33Z

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-10T17:54:29.016238Z We couldn’t complete this review. Comment `@codex review` to try again.	`1a6908e`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-11-10T17:54:36Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

…not true any more (#200) ## Summary `.claude/CLAUDE.md` is the instructions file that each agent session reads first. 2 of its statements are not true any more. The owner asked for the correction of these 2 places (2026-11-10). ## Changes **1. The build caveat.** - Before: `Cargo.toml` has a path dependency on `gitbot-shared-context` at `../../shared-context`; a bare clone fails at dependency resolution; code work needs a `gitbot-fleet` checkout. - The fact now: `gitbot-shared-context` is a git dependency pinned by `rev` (`Cargo.toml`, line 29), as `echidna-core` is. A bare clone builds, and its tests run. - The note also named issue 18 for this debt. Issue 18 of this repository is about an `rsa` advisory, and it is closed. - The line about the same entry under "Sensitive files" now names the `rev` pins of the git dependencies. **2. The co-author trailer.** - Before: the trailer named one model version. - A session with a different model then writes a false line, or does not follow the file. - Now: `Co-Authored-By: Claude <noreply@anthropic.com>`. The recent squash commits on `main` use this line already. No other statement of the file is changed. ## Not in this change - `CONTRIBUTING.adoc` (the section "Workspace caveat") and `RSR_COMPLIANCE.adoc` (2 lines) say the same thing about the path dependency. They are not changed here: the owner asked for the instructions file only. - The test counts in the same file ("full suite is 184") are older than the current suite. They are not changed. ## Testing - The claim "a bare clone builds, and its tests run" was checked in a bare clone of this repository on 2026-11-10 with Rust 1.99.0 (the toolchain of `rust-toolchain.toml`): `cargo test --test smoke --test protocol_contract` on the dependency set of `main`, and the full `cargo test --locked` on the branch of #199. Each run passed. - The change is to 1 Markdown file. No code changes. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>

…qlite

hyperpolymath · 2026-11-10T18:51:20Z

scan / gitleaks fails on afc8bd1. The failure is not from this pull request.

The same check fails on main at a045184 (run 42877094785) with the same result. The tree pass finds 3 lines in .gitleaks-estate.toml, which is the baseline file that the scanner puts into the tree. The history pass, the Rust rule and the shell rule pass, here and on main.
Cause: .gitleaks.toml on main is a stale full copy of the estate baseline. The scanner uses it as the config, and it does not exempt the baseline file.
The repair is ci(gates): remove the stale copy of the gitleaks baseline #202, which removes the copy. It cannot be ported into this pull request: on a pull request the scanner reads its config from the base, so a config change in the head has no effect on the check.
The check goes green here after ci(gates): remove the stale copy of the gitleaks baseline #202 merges and the check runs against the new base. I did not re-run it, because a run against the same base gives the same result.

Generated by Claude Code

…t test value (#660) ## Summary 4 checks are red on `main` and on each pull request (for example #658 and #659): `scan / gitleaks`, `scan / rust-secrets`, and the 2 UUID conformance checks. This pull request repairs their 2 causes. | Cause | Lines | Where the source is | |---|---|---| | The Rust rule of the secret scan | 2 names of environment variables in `bots/echidnabot/src/api/auth.rs`, 2 test values in `bots/echidnabot/tests/smoke.rs` | echidnabot | | The same rule | 1 test value in `tests/echidnabot/api_gate_regressions.rs` | this repository | | The strict UUID rule | 3 nil UUID literals in the echidnabot tests | echidnabot | The echidnabot lines are repaired at their source: hyperpolymath/echidnabot#197 (merged, `998d306`). No line here is a secret. The values are names of environment variables and test credentials. ## Changes - **`bots/echidnabot/`**: `scripts/sync-vendored-bot.sh echidnabot --sync --rev a045184...` moves the pin from `1443adf` to `a045184`, the head of upstream `main`. 4 files change in the copy: - `src/api/auth.rs`, `tests/protocol_contract.rs`, `tests/smoke.rs`: the changes of echidnabot#197 (the pragma on 4 lines; the nil UUID comes from `uuid::Uuid::nil()` and is not a literal). - `Cargo.lock`: the changes of echidnabot#198 (`event-listener` 5.4.2, `chacha20` 0.10.2, `spin` 0.9.9). - **`tests/echidnabot/api_gate_regressions.rs`**: the pragma `// scanner-allow: rust-secrets` on the 1 test value that this repository owns, with a comment of 2 lines. The 2 dated notes in `docs/migrations/secret-scanner-cicd-suite/` name the old pin. They are records of 2026-11-09 and do not change. ## Not in this change The sqlx repair for RUSTSEC-2026-0459 (hyperpolymath/echidnabot#199) is not merged upstream at this time. A later pin move carries it. ## Testing - `bash scripts/sync-vendored-bot.sh echidnabot --check`: `bots/echidnabot matches ...@a045184... (90 entries)`, exit 0. - A local copy of the 2 rules (the Rust rule of the scanner at `proven-cicd` `03e858b`, and the strict UUID rule), run on the whole tree: 0 hits in 270 Rust files. Before this change the same copy gave 5 lines and 3 literals. - Not run locally: gitleaks, and the Rust tests of the copy. CI runs them. The 3 changed Rust files passed the echidnabot CI at `998d306`. ## What to expect in CI `scan / gitleaks`, `scan / rust-secrets` and the 2 UUID conformance checks pass. If 1 of them does not, the result is added here. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>

sonarqubecloud · 2026-11-10T18:57:48Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…26-0459) (#661) ## Summary The copy of echidnabot in `bots/echidnabot/` has `libsqlite3-sys` 0.30.1. That crate version carries the SQLite source that RUSTSEC-2026-0459 (CVE-2026-119375) names. The patched crate is 0.39.0 or later. hyperpolymath/echidnabot#199 repaired the dependency upstream (merged, `e498948`). This pull request moves the pin, so that the copy that the fleet builds has the patched crate. No check of this repository is red because of the old crate: CI here does not audit the dependencies of the copy. The reason for this change is the build, not a check. ## Changes `scripts/sync-vendored-bot.sh echidnabot --sync --rev e498948...` moves the pin from `a045184` to `e498948`, the head of upstream `main`. 3 files change in the copy, plus the lock: - `Cargo.toml`: sqlx comes from the upstream commit `10462fa4414c6c7f1ed1d39bb31678e3b726878c`, pinned by its full hash. No crates.io release of sqlx permits the patched crate (0.8.6 holds 0.30; 0.9.0 stops below 0.38). A comment on the line gives the reason and the exit: go back to a crates.io version at the first sqlx release after 0.9.0. - `Cargo.lock`: `libsqlite3-sys` 0.39.1. The crates that sqlx 0.8 needed and sqlx 0.9 does not need go out, `rsa` among them. - `.cargo/audit.toml`: the ignore entry for RUSTSEC-2023-0071 (`rsa`) goes out, because `rsa` is not in `Cargo.lock` any more. The list is empty. - `FLEET-SYNC.json`: the new `rev`. No Rust source file changes. `bots/gsbot` already takes sqlx from a commit of the same repository, so the form is not new here. ## Testing - `bash scripts/sync-vendored-bot.sh echidnabot --check`: `bots/echidnabot matches ...@e498948... (90 entries)`, exit 0. - A local copy of the Rust rule of the secret scan and of the strict UUID rule, on the whole tree: 0 hits in 270 Rust files. - Upstream, at the same `Cargo.toml` and `Cargo.lock`: `cargo audit` reports 0 vulnerabilities, and `Dependency audit` passes on echidnabot `main` at `e498948` (run 42880412002). The echidnabot test suite passed there with sqlx 0.9. - Not run locally: the fleet build and tests of the copy (`echidnabot vendored build and tests`). This is their first run with sqlx 0.9 in this repository. The fleet tests in `tests/echidnabot/` do not name sqlx. ## Not verified - The PostgreSQL path at run time. The upstream tests use SQLite. The PostgreSQL code compiles. - The behaviour changes of sqlx 0.9 that the compiler does not show (the sqlx changelog for 0.9.0 lists them). - The container build. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>

#196) ## Update 2026-11-10: merged with main after #195 #195 gated the receipt-boundary theory in CI (Agda 2.8.0.2, Lean and Rocq legs, receipts and a correspondence section), so main wins in every conflict (merge commit `0bf40aa`): - `proof-safety.yml` and `PROOF-STATUS.adoc`: main's versions. - `scripts/check-agda-proofs.sh`: main's 2.8.0.2 pin. This PR's 2.7.0.1 pin would make main's theory job refuse the check. - `docs/T-RECEIPT-CORRESPONDENCE.adoc`: dropped, because main's PROOF-STATUS carries the same record. This PR now changes only `docs/proof-debt.adoc`: the table of the 2 deliberate escape hatches (`proofs/coq/admitted_stub.v:11`, `proofs/lean/sorry_stub.lean:7`). Both are negative fixtures that `tests/protocol_contract.rs::checked_in_negative_proofs_are_detected` requires, so they stay intact. The `Dependency audit` failure on the old head (RUSTSEC-2026-0459) is fixed on main by #199, which this merge brings in. --- ## What (original; all but proof-debt.adoc superseded by #195) - `proof-safety.yml`: new `agda` and `rocq` jobs. **Superseded by #195.** - `check-agda-proofs.sh`: pin moved to 2.7.0.1. **Reverted to main's 2.8.0.2.** - `docs/proof-debt.adoc`: both hatches recorded as deliberate negative fixtures. **Still in this PR.** - `docs/PROOF-STATUS.adoc`: grade wording. **Superseded by #195.** 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4 --------- Co-authored-by: Claude <noreply@anthropic.com>

hyperpolymath marked this pull request as ready for review November 10, 2026 17:54

hyperpolymath assigned Copilot Nov 10, 2026

hyperpolymath enabled auto-merge (squash) November 10, 2026 17:54

Merge branch 'main' into claude/sqlx-patched-sqlite

803c66e

hyperpolymath mentioned this pull request Nov 10, 2026

docs(claude): correct 2 statements in the instructions file that are not true any more #200

Merged

Merge remote-tracking branch 'origin/main' into claude/sqlx-patched-s…

afc8bd1

…qlite

hyperpolymath mentioned this pull request Nov 10, 2026

fix(echidnabot): move the pin to the upstream repair, and mark 1 fleet test value hyperpolymath/gitbot-fleet#660

Merged

hyperpolymath mentioned this pull request Nov 10, 2026

ci(gates): remove the stale copy of the gitleaks baseline #202

Merged

Merge branch 'main' into claude/sqlx-patched-sqlite

d87207b

hyperpolymath disabled auto-merge November 10, 2026 18:57

hyperpolymath merged commit e498948 into main Nov 10, 2026
19 checks passed

hyperpolymath deleted the claude/sqlx-patched-sqlite branch November 10, 2026 18:57

hyperpolymath mentioned this pull request Nov 10, 2026

fix(echidnabot): move the pin to the upstream sqlx repair (RUSTSEC-2026-0459) hyperpolymath/gitbot-fleet#661

Merged

hyperpolymath mentioned this pull request Nov 10, 2026

ci(proofs): gate T-RECEIPT in CI and record the two deliberate hatches #196

Merged

Navigation Menu

Repository navigation

fix(deps): move sqlx to the upstream commit that permits the patched SQLite (RUSTSEC-2026-0459) - #199

fix(deps): move sqlx to the upstream commit that permits the patched SQLite (RUSTSEC-2026-0459)#199
hyperpolymath merged 4 commits into
mainfrom
claude/sqlx-patched-sqlite

hyperpolymath commented Nov 10, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 10, 2026 •

edited

Loading

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

hyperpolymath commented Nov 10, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Nov 10, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

hyperpolymath commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why a commit of sqlx, and not a release

Relation to #198

Changes

Testing

After the merge

Uh oh!

coderabbitai Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

hyperpolymath commented Nov 10, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Nov 10, 2026

Quality Gate passed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hyperpolymath commented Nov 10, 2026 •

edited

Loading

coderabbitai Bot commented Nov 10, 2026 •

edited

Loading