Skip to content

chore: fix Rust dependency vulnerabilities#462

Open
lwshang wants to merge 4 commits intomainfrom
lwshang/fix_deps_vul
Open

chore: fix Rust dependency vulnerabilities#462
lwshang wants to merge 4 commits intomainfrom
lwshang/fix_deps_vul

Conversation

@lwshang
Copy link
Contributor

@lwshang lwshang commented Mar 22, 2026

Summary

  • Run cargo update to pull in latest compatible dependency versions, resolving several security advisories flagged by Dependabot
  • Bump winreg from 0.55 to 0.56.0 (updates windows-sys to 0.61.2, resolving RUSTSEC-2026-0037)
  • Remove now-resolved advisory ignores from .cargo/audit.toml (RUSTSEC-2026-0001, RUSTSEC-2026-0037)

Test plan

  • cargo audit passes without new unignored advisories
  • cargo build --bin icp succeeds
  • cargo test passes

🤖 Generated with Claude Code

lwshang and others added 4 commits March 22, 2026 13:35
RUSTSEC-2026-0001 and RUSTSEC-2026-0037 are no longer blocking as the
affected crate versions have been upgraded to safe ones in Cargo.lock.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Resolves RUSTSEC-2026-0037 indirectly — winreg 0.56.0 updates
windows-sys to 0.61.2, which is required by the safe quinn-proto version.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Model types moved from `bollard::secret` to `bollard::models` in 0.20.2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@lwshang lwshang marked this pull request as ready for review March 22, 2026 18:57
@lwshang lwshang requested a review from a team as a code owner March 22, 2026 18:57
@lwshang lwshang enabled auto-merge (squash) March 22, 2026 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant