Skip to content

Deps: Update transitive dependencies quinn-proto and aws-lc-sys #251

Open
tvpeter wants to merge 2 commits intobitcoindevkit:masterfrom
tvpeter:chore/sec-deps-update
Open

Deps: Update transitive dependencies quinn-proto and aws-lc-sys #251
tvpeter wants to merge 2 commits intobitcoindevkit:masterfrom
tvpeter:chore/sec-deps-update

Conversation

@tvpeter
Copy link
Collaborator

@tvpeter tvpeter commented Mar 16, 2026

Description

This PR updates transitive dependencies quinn-proto and aws-lc-sys to fix identified vulnerabilities.
Other aws-lc-sys linked vulnerabilities fixed by this update include:

  • AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
  • AWS-LC has PKCS7_verify Signature Validation Bypass

Fixes #249 and #250

All Submissions:

  • I've signed all my commits
  • I followed the contribution guidelines
  • I ran cargo fmt and cargo clippy before committing

@codecov
Copy link

codecov bot commented Mar 16, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 10.86%. Comparing base (a675935) to head (f45c616).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #251   +/-   ##
=======================================
  Coverage   10.86%   10.86%           
=======================================
  Files           8        8           
  Lines        2466     2466           
=======================================
  Hits          268      268           
  Misses       2198     2198           
Flag Coverage Δ
rust 10.86% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@tvpeter tvpeter requested a review from notmandatory March 16, 2026 12:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

RUSTSEC-2026-0037: Denial of service in Quinn endpoints

1 participant