Repository navigation
fix(deps): update h2, rustls and tokio past open RustSec advisories - #170
Conversation
cargo audit on the root Cargo.lock reported four advisories, all fixed by semver-compatible patch releases: - h2 0.4.15 -> 0.4.20: RUSTSEC-2026-0258 (unbounded empty DATA frames) - rustls 0.23.40 -> 0.23.46 (rustls-webpki 0.103.13 -> 0.103.16): RUSTSEC-2026-0285 (TLS 1.3 handshake messages across encryption levels), RUSTSEC-2026-0348 (brotli certificate decompression allocates up to 1 GiB before authentication), RUSTSEC-2026-0346 (Debug impls expose TLS secrets) - tokio 1.52.3 -> 1.54.1: clears RUSTSEC-2026-0386 (AsyncFd::new is unsound). panll does not call AsyncFd, but the update is semver-compatible. Lockfile only. After the update cargo audit reports no vulnerabilities; one warning remains: instant is unmaintained (RUSTSEC-2024-0384), pulled in by notify 7, and removing it needs a major notify upgrade. tools/pcc/Cargo.lock was already clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJtjqoZaSQo7uBwvwVMA9G
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
|
Seven workflows hit
No fix exists in this repo yet. The startup error text is on each run page (for example https://github.com/hyperpolymath/panll/actions/runs/41936669786), but the API doesn't return it. I'm not re-running anything: a startup failure fails the same way every time. Locally, Generated by Claude Code |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
## Why These are two owner decisions: - **Retire the ReScript scanner in `tools/pcc`.** #107 removed the `.res` sources it read, so every frontend-wiring check it ran was reporting a false "missing" with "Repairability: safe". - **Turn off the Gitea mirror for now.** `vars.GITEA_HOST` is unset, so the Gitea job failed on every push to main. ## What **`tools/pcc`** - `src/rescript_scanner.rs` is deleted (308 lines). - `scanner.rs`: the seven checks that read `.res` files now return a "retired" result, with the reason and a pointer to #148. Those checks are registry, model include/slice, msg type/variant, view route and contractiles. The test-bundle check doesn't read frontend sources and is unchanged. - `propagator.rs`: a failed check against a `.res` file is reported as `Check retired: … removed in #107; an AffineScript scanner is tracked in #148` and marked **Manual**. So `panel repair` no longer plans ReScript edits; it now says "No safe repairs available". **`.github/workflows/mirror.yml`** - The workflow no longer passes `GITEA_SSH_KEY`. The shared mirror workflow skips any forge whose key isn't passed (see its header), so only Gitea stops. The other forges are unchanged. **Docs:** the PCC row in `PROOF-NEEDS.adoc`, and the CHANGELOG. ## Checks - `cargo build --locked --release` in `tools/pcc`, the same build Build Validation runs: passes. - `panel verify` runs against the tree and shows the retired reason on each ReScript check. `panel repair --panel Aerie` reports "No safe repairs available". - `rustfmt --check` on `scanner.rs`: clean. The rest of pcc was already unformatted on main, so I left it alone to keep this diff small. - pcc has existing clippy warnings that predate this PR: 13 on main, 6 here. CI doesn't run clippy on pcc. ## CI note Most workflows currently fail at startup because of the repo's new Actions policy (owner-only, GitHub-created, or Marketplace-verified). That blocks third-party actions and the `metadatastician/standards` reusables. It affects every PR; see #170. This PR doesn't change it. --- _Generated by [Claude Code](https://claude.ai/code/session_01SJtjqoZaSQo7uBwvwVMA9G)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
Why
GitHub has been reporting a moderate Dependabot alert on main (#15).
cargo auditon the rootCargo.lockfound four advisories. All four are fixed by semver-compatible patch releases.h2rustlsDebugimpls expose TLS secretsrustls-webpkitokioAsyncFd::newis unsound (warning only; panll never callsAsyncFd)What
Only
Cargo.lockchanges, viacargo update -p h2 -p rustls -p tokio.Cargo.tomlis untouched.Checks
cargo audit: no vulnerabilities. One allowed warning remains:instantis unmaintained (RUSTSEC-2024-0384). It comes in throughnotify7, and removing it needs a majornotifyupgrade, so it is out of scope here.tools/pcc/Cargo.lock: already clean.cargo fmt --all -- --check: clean.cargo clippy --locked --all-targets -- -D warnings: clean.cargo clippy --locked --features gossamer --all-targets -- -D warnings: clean (stublibgossamer).cargo test --locked --lib: 294 passed.Generated by Claude Code