Repository navigation
fix(deps): patch high-severity advisories in networking dependencies - #959
Merged
Merged
Conversation
Updates openssl 0.10.72 -> 0.10.80 (and openssl-sys 0.9.108 -> 0.9.117), a semver-compatible bump that resolves five high-severity RUSTSEC advisories in the rust-openssl bindings: - GHSA-8c75-8mhr-p7r9: incorrect bounds assertion in AES key wrap - GHSA-ghm9-cr32-g9qj: MdCtxRef::digest_final writes past caller buffer - GHSA-hppc-g8h3-xhp3: unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer - GHSA-pqf5-4pqq-29f5: Deriver::derive / PkeyCtxRef::derive overflow short buffers on OpenSSL 1.1.1 - GHSA-xp3w-r5p5-63rr: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs 0.10.80 additionally clears the medium GHSA-phqj-4mhp-q6mq / GHSA-xv59-967r-8726 and low GHSA-xmgf-hq76-4vx2 advisories.
Updates quinn-proto 0.11.12 -> 0.11.14, a semver-compatible bump that resolves a high-severity advisory: - GHSA-6xvm-j4wr-6v98: unauthenticated remote denial of service via panic in QUIC transport parameter parsing quinn-proto reaches the light client transitively through libp2p's QUIC transport.
Updates rustls-webpki 0.103.2 -> 0.103.13, a semver-compatible bump that resolves a high-severity advisory: - GHSA-82j2-j2ch-gfr8: denial of service via panic on a malformed CRL BIT STRING 0.103.13 also clears the medium GHSA-pwjx-qhcg-rvj4 and low GHSA-965h-392x-2mh5 / GHSA-xgp8-3hg3-c2mh advisories.
Updates yamux 0.13.4 -> 0.13.10, a semver-compatible bump that resolves two high-severity advisories: - GHSA-4w32-2493-32g7: remote panic via malformed WindowUpdate credit - GHSA-vxx9-2994-q338: remote panic via malformed Data frame with SYN set and len = 262145 yamux is the libp2p stream multiplexer used by the light client's TCP transport. yamux 0.13.10 requires rand 0.9, which pulls getrandom 0.3 into the wasm32 dependency tree for the first time. getrandom 0.3 no longer picks a wasm backend by default, so the web build needs its backend selected explicitly: enable the `wasm_js` feature on getrandom and set `--cfg getrandom_backend="wasm_js"` (via .cargo/config.toml for local builds and RUSTFLAGS in the web CI job, since the toolchain action's RUSTFLAGS overrides target rustflags from config).
Records the openssl, quinn-proto, rustls-webpki and yamux security bumps under the pending core 1.2.13 release. No version bump: these advisories are patched via Cargo.lock only and the crate version staged for the next release already covers them.
aterentic-ethernal
force-pushed
the
fix/dependabot-high-vulns
branch
from
July 7, 2026 11:08
ce5d37c to
f19f936
Compare
Leouarz
approved these changes
Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patches high-severity Dependabot advisories that reach the light client through its libp2p networking stack. Each dependency is bumped in its own commit; all changes are confined to
Cargo.lock(no source changes) and are semver-compatible patch bumps, so the API surface is unaffected. The workspace builds cleanly with--locked.Advisories patched
opensslquinn-protorustls-webpkiyamuxThe
opensslandrustls-webpkibumps additionally clear several moderate/low advisories against the same crates.How it works
openssl0.10.80 fixes a set of memory-safety issues in the rust-openssl bindings (AES key-wrap bounds,digest_final/Deriver::derivebuffer overflows, PSK/cookie trampoline over-read, and UB on non-UTF-8 OCSP URLs).quinn-proto0.11.14 fixes an unauthenticated remote DoS panic in QUIC transport-parameter parsing (reached via libp2p's QUIC transport).rustls-webpki0.103.13 fixes a DoS panic on a malformed CRL BIT STRING.yamux0.13.10 fixes two remote panic DoS paths (malformed WindowUpdate credit, malformed Data frame with SYN +len = 262145); this bump also pullsrand0.9 into yamux's own subtree.Caveats — not fixed here
libp2p-gossipsub(GHSA-gc42-3jg7-rxr2, GHSA-xqmp-fxgv-xvq5, high): only patchable by bumping thelibp2pfacade 0.55 → 0.56, a major upgrade with a large transitive delta. gossipsub is an unused optional dependency here (not an enabledlibp2pfeature, not referenced in source), so there is no real runtime exposure. Deferred to keep this a low-risk, lockfile-only security PR.hickory-proto(GHSA-3v94-mw7p-v465, high): no fix is currently available — the advisory covers<= 0.25.2with no patched release, andlibp2p-dnspins hickory to^0.25, so no reachable version escapes the vulnerable range.