Repository navigation
chore(deps): bump quinn-proto to 0.11.15 (RUSTSEC-2026-0185) - #83
Merged
Merged
Conversation
quinn-proto 0.11.14 (pulled transitively via libp2p's QUIC transport) is flagged by RUSTSEC-2026-0185. 0.11.15 is a semver-compatible patch that clears it; cargo audit passes clean after the bump. Lockfile-only, no manifest or code change, so it carries no ignore entry. Repo-wide: unblocks cargo audit on main and every open branch.
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
Author
|
@kevincodex1 ready to merge when you have a minute. Bumps quinn-proto 0.11.14 -> 0.11.15 to clear RUSTSEC-2026-0185 (pulled transitively via libp2p's QUIC transport); lockfile-only, no manifest or code change. CI is green and Worth merging ahead of the other open PRs: the advisory landed against current main, so every open branch is currently failing the audit check until this lands. |
8 of 9 tasks
kevincodex1
pushed a commit
to kevincodex1/node
that referenced
this pull request
Nov 5, 2026
…hrough (Twigpine#521) * fix(node): reject revision syntax in issue ids and drop service passthrough resolve_issue_id spliced the request-path issue id straight into a git revision (`cat-file -e refs/gitlawb/issues/<id>`) and a for-each-ref pattern, and on an exact match echoed the raw input back as the canonical id. Revision and glob syntax such as `<uuid>^{blob}`, `~0`, or `*` therefore resolved to an existing issue and was returned to callers (and stored by create_issue_comment) as if it were the id. Accept only ASCII alphanumerics and '-' and report anything else as not found. service_to_command fell through to returning the caller's service string for an unknown service. Every caller validates first, but the mapping now yields only the two fixed subcommands and errors otherwise, so an unrecognized value can never reach git's argv. Addresses CodeQL rust/command-line-injection alerts Twigpine#83 and Twigpine#80. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(node): cover service_to_command allowlist and passthrough rejection Direct unit test ensures unknown services and option-shaped inputs cannot map to git argv even if HTTP-layer validate_service is bypassed in future. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
8 of 14 tasks
euxarist
pushed a commit
to euxarist/node
that referenced
this pull request
Nov 6, 2026
…igpine#526) * fix(node): resolve issue ids from git refnames, not request input resolve_issue_id answered an exact match by echoing the request-path id back to callers, so get_issue and close_issue spliced caller input into `git cat-file blob refs/gitlawb/issues/<id>`. Twigpine#521 restricted the input to [A-Za-z0-9-], but the value handed to git was still the request string (CodeQL rust/command-line-injection Twigpine#83). Resolve exact and prefix lookups through one for-each-ref listing and return the refname git reports. An exact refname still wins over longer ids that share it as a prefix; unique-prefix, ambiguous, not-found, and revision-syntax behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(node): keep a dangling exact issue ref from winning over longer ids for-each-ref lists a ref even when its blob is missing, so the exact-id precedence added in the previous commit picked a dangling exact ref over a readable longer sibling: resolve_issue_id returned the dangling id where main reported an ambiguous prefix, get_issue then returned None, and close_issue hit its expect(). Let the exact id win only when `git cat-file -e` finds its object, run on git's own refname so no request input returns to the argv. Otherwise fall through to the unchanged prefix rules, matching main for every layout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
quinn-proto0.11.14 (transitive, via libp2p's QUIC transport) is flagged by RUSTSEC-2026-0185. 0.11.15 is a semver-compatible patch that clears it;cargo auditpasses clean after the bump. Lockfile-only, no manifest or code change, so it carries no audit-ignore entry.This is repo-wide: the advisory hit the RustSec DB recently, so main and every open branch currently fail the
cargo auditjob until this lands. Worth merging ahead of the others so their next CI run goes green.