fix: Update Rust crypto dependencies for security vulnerabilities#82
Merged
GordonBeeming merged 2 commits intomainfrom Mar 23, 2026
Merged
fix: Update Rust crypto dependencies for security vulnerabilities#82GordonBeeming merged 2 commits intomainfrom
GordonBeeming merged 2 commits intomainfrom
Conversation
Upgrade aws-lc-sys 0.34.0 -> 0.39.0 (via aws-lc-rs 1.15.1 -> 1.16.2) and rustls-webpki 0.103.8 -> 0.103.10 to fix 6 security advisories: - GHSA-vw5v-4f2q-w9xf: PKCS7_verify certificate chain validation bypass - GHSA-65p9-r9h6-22vj: Timing side-channel in AES-CCM tag verification - GHSA-hfpc-8r3f-gw53: PKCS7_verify signature validation bypass - GHSA-394x-vwmw-crm3: X.509 name constraints bypass via wildcard/unicode CN - GHSA-9f94-5g5w-gf6r: CRL distribution point scope check logic error - GHSA-pwjx-qhcg-rvj4: CRLs not considered authoritative by distribution point Bump version to 2026.03.24. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: GitButler <gitbutler@gitbutler.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses Dependabot-reported Rust crypto vulnerabilities in the proxy component by updating locked dependency versions, and bumps the project version across scripts, build metadata, and WinGet manifests.
Changes:
- Update
proxyRust lockfile to neweraws-lc-*andrustls-webpkiversions to remediate security advisories. - Bump the project version to
2026.03.24across release/version-bearing files. - Update WinGet manifest
PackageVersionvalues to match the new release version.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
proxy/Cargo.lock |
Updates locked Rust crypto-related dependency versions to address security advisories. |
packaging/winget/GordonBeeming.CopilotHere.yaml |
Bumps WinGet manifest version to the new release version. |
packaging/winget/GordonBeeming.CopilotHere.locale.en-US.yaml |
Keeps WinGet locale manifest version in sync with the release version. |
packaging/winget/GordonBeeming.CopilotHere.installer.yaml |
Keeps WinGet installer manifest version in sync with the release version. |
copilot_here.sh |
Updates shell wrapper version constants to the new release version. |
copilot_here.ps1 |
Updates PowerShell wrapper version constants to the new release version. |
app/Infrastructure/BuildInfo.cs |
Updates build date/version constant to match the new release version. |
VERSION |
Central version bump for the repository. |
.github/copilot-instructions.md |
Updates documented “Current version” value. |
Remove hardcoded "Current version" line that gets stale. Update Directory.Build.props description to reflect it reads from VERSION file. Add reference to scripts/bump-version.sh and VERSION file in checklist. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: GitButler <gitbutler@gitbutler.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
aws-lc-sys0.34.0 to 0.39.0 (viaaws-lc-rs1.15.1 to 1.16.2)rustls-webpki0.103.8 to 0.103.10Fixes 6 Dependabot security advisories (5 high, 1 medium):
Test plan
cargo buildcompiles successfullySolo with Claude Code and GitButler assistance