Repository navigation
fix(deps): bump quinn-udp to 0.5.16 for RUSTSEC-2026-0538 - #507
Conversation
The daily cargo audit on main has failed since 14 Nov, and with it every PR's "Cargo audit" and "Dependency audit" jobs: RUSTSEC-2026-0538 (GHSA-6pp4-4cxf-xf88, "Receive loop can spin after a truncated datagram") affects quinn-udp 0.5.14, pinned in Cargo.lock and fuzz/Cargo.lock. Patched in >=0.5.16, <0.6.0. `cargo update -p quinn-udp --precise 0.5.16` in both workspaces. No other crate changes version; windows-sys 0.60 and its windows_* targets drop out because 0.5.16 no longer depends on them. scripts/ci/audit-dependencies.sh with the CI-pinned cargo-audit 0.22.2: both lockfiles PASSED (exit 0). RUSTSEC-2026-0486 (rustix 1.1.4, unsound) remains a warning and does not fail the gate. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_0136P7ZoZwvZCfM387TZQ5kY
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 2
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Summary
The daily
Cargo Auditonmainhas failed since the 14 Nov 06:06 UTC scan, and with it every PR'srust-ci / Cargo audit (security)andDependency auditjobs (for example #506, a docs-only change). The cause is a new advisory, not any PR:RUSTSEC-2026-0538(GHSA-6pp4-4cxf-xf88, "Receive loop can spin after a truncated datagram") affectsquinn-udp 0.5.14, which is pinned in bothCargo.lockandfuzz/Cargo.lock. It is fixed in>=0.5.16, <0.6.0.Changes
Cargo.lock,fuzz/Cargo.lock:cargo update -p quinn-udp --precise 0.5.16. No other crate changes version.windows-sys 0.60and itswindows_*target crates drop out, becausequinn-udp 0.5.16no longer depends on them.Not changed:
RUSTSEC-2026-0486(rustix 1.1.4, unsound) is still reported, but only as a warning, so it does not fail the gate.RSR Quality Checklist
Required
unsafeblocks without// SAFETY:comments.envfiles includedTesting
bash scripts/ci/audit-dependencies.sh, withcargo-audit 0.22.2installed byscripts/ci/install-cargo-audit.sh(checksum OK):Cargo.lock: PASSED,fuzz/Cargo.lock: PASSED, exit 0. Before the change, both saidFAILED (vulnerabilities found)withRUSTSEC-2026-0538.cargo check --locked --workspace --all-targetscould not complete in my cloud container. The only errors are two build scripts that need system tools the container lacks:echidna-wire(capnpc build failed: Failed to execute capnp --version: No such file or directory) andechidna-grpc(its custom build command). Neither crate is touched by this change, and no Rust compile error was reported. Therust-cibuild jobs on this PR are the real build test.🤖 Generated with Claude Code
https://claude.ai/code/session_0136P7ZoZwvZCfM387TZQ5kY