Repository navigation
fix(echidnabot): move the pin to the upstream sqlx repair (RUSTSEC-2026-0459) - #661
Conversation
…26-0459) The copy of echidnabot had `libsqlite3-sys` 0.30.1, the crate version that RUSTSEC-2026-0459 (CVE-2026-119375) names. hyperpolymath/echidnabot#199 repaired the dependency upstream (merged, e498948): sqlx comes from the upstream commit 10462fa, which permits the patched crate. No sqlx release permits it at this time. `scripts/sync-vendored-bot.sh echidnabot --sync` moves the pin from a045184 to e498948 (upstream `main`). 3 files change in the copy: - `Cargo.toml`: the sqlx line, with its reason and its exit condition. - `Cargo.lock`: `libsqlite3-sys` 0.39.1. The crates that sqlx 0.8 needed and sqlx 0.9 does not need go out, `rsa` among them. - `.cargo/audit.toml`: the ignore entry for `rsa` goes out. The list is empty. No Rust source file changes. `bots/gsbot` already takes sqlx from a commit of the same repository. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
|
Caution Review failedThe pull request is closed.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Summary
The copy of echidnabot in
bots/echidnabot/haslibsqlite3-sys0.30.1. That crate version carries the SQLite source that RUSTSEC-2026-0459 (CVE-2026-119375) names. The patched crate is 0.39.0 or later.hyperpolymath/echidnabot#199 repaired the dependency upstream (merged,
e498948). This pull request moves the pin, so that the copy that the fleet builds has the patched crate.No check of this repository is red because of the old crate: CI here does not audit the dependencies of the copy. The reason for this change is the build, not a check.
Changes
scripts/sync-vendored-bot.sh echidnabot --sync --rev e498948...moves the pin froma045184toe498948, the head of upstreammain. 3 files change in the copy, plus the lock:Cargo.toml: sqlx comes from the upstream commit10462fa4414c6c7f1ed1d39bb31678e3b726878c, pinned by its full hash. No crates.io release of sqlx permits the patched crate (0.8.6 holds 0.30; 0.9.0 stops below 0.38). A comment on the line gives the reason and the exit: go back to a crates.io version at the first sqlx release after 0.9.0.Cargo.lock:libsqlite3-sys0.39.1. The crates that sqlx 0.8 needed and sqlx 0.9 does not need go out,rsaamong them..cargo/audit.toml: the ignore entry for RUSTSEC-2023-0071 (rsa) goes out, becausersais not inCargo.lockany more. The list is empty.FLEET-SYNC.json: the newrev.No Rust source file changes.
bots/gsbotalready takes sqlx from a commit of the same repository, so the form is not new here.Testing
bash scripts/sync-vendored-bot.sh echidnabot --check:bots/echidnabot matches ...@e498948... (90 entries), exit 0.Cargo.tomlandCargo.lock:cargo auditreports 0 vulnerabilities, andDependency auditpasses on echidnabotmainate498948(run 42880412002). The echidnabot test suite passed there with sqlx 0.9.echidnabot vendored build and tests). This is their first run with sqlx 0.9 in this repository. The fleet tests intests/echidnabot/do not name sqlx.Not verified
Generated by Claude Code