fix: update testcontainers to v0.27.0 to remediate CVE-2025-62518#396
Merged
julio4 merged 3 commits intoflashbots:mainfrom Mar 2, 2026
Merged
fix: update testcontainers to v0.27.0 to remediate CVE-2025-62518#396julio4 merged 3 commits intoflashbots:mainfrom
julio4 merged 3 commits intoflashbots:mainfrom
Conversation
This commit updates the testcontainers dependency from v0.24.0 to v0.27.0, which replaces the vulnerable tokio-tar (CVE-2025-62518) with the patched astral-tokio-tar >= 0.5.6. CVE-2025-62518 is a HIGH severity vulnerability (CVSS 8.1) in tokio-tar that allows PAX header desynchronization and tar archive entry smuggling. Changes: - Updated testcontainers from 0.24.0 to 0.27.0 in Cargo.toml - Updated Cargo.lock with cargo update -p testcontainers - Fixed breaking API changes in bollard (used by testcontainers): - Updated imports: Config -> ContainerCreateBody, moved Options types to query_parameters module, moved models to separate module - Removed generic type parameters from Options structs - Changed boolean Option fields to plain bools in AttachContainerOptions - Updated CreateImageOptions fields to use Option<String> Verification: - cargo tree confirms tokio-tar is removed from dependency tree - cargo tree confirms astral-tokio-tar v0.5.6 is now used - cargo audit shows no tokio-tar vulnerabilities - All compilation checks pass (op-rbuilder, tester, clippy) - All 110 tests pass successfully Fixes CVE-2025-62518 (GHSA-j5gw-2vrg-8fgx)
Vui-Chee
requested review from
0x416e746f6e,
SozinM,
avalonche and
karim-agha
as code owners
Contributor
Author
|
@julio4 The nightly lint failed on an old crate |
Member
yes I noticed I'll fix it asap and merge this! |
Member
|
@Vui-Chee Could you rebase on main? I don't have write permission to update on your branch myself |
Contributor
Author
|
@julio4 ok! |
…tokio-tar * upstream/main: chore: rename bundle fields for consistency (no api change) (flashbots#402) Hotfix: pin nightly version to resolve str::as_str() regression (flashbots#401) update builder-playground usage for local devnet runs and testing (flashbots#395)
Contributor
Author
|
@julio4 Follow up? |
Vui-Chee
added a commit
to okx/xlayer-reth
that referenced
this pull request
Mar 2, 2026
Update testcontainers from v0.24.0 to v0.27.0, which replaces the vulnerable tokio-tar (CVE-2025-62518, CVSS 8.1) with the patched astral-tokio-tar >= v0.5.6. Changes: - Updated testcontainers version in crates/builder/Cargo.toml - Fixed breaking bollard API changes in external.rs: - Config -> ContainerCreateBody - Moved Options types to query_parameters module - Moved model types to models module - Removed generic type parameters from Options structs - Changed boolean Option fields to plain bools in AttachContainerOptions - Updated CreateImageOptions fields to use Option<String> - Updated Cargo.lock Ported from upstream: flashbots/op-rbuilder#396
louisliu2048
pushed a commit
to okx/xlayer-reth
that referenced
this pull request
Mar 2, 2026
* fix: update testcontainers to v0.27.0 to remediate CVE-2025-62518 Update testcontainers from v0.24.0 to v0.27.0, which replaces the vulnerable tokio-tar (CVE-2025-62518, CVSS 8.1) with the patched astral-tokio-tar >= v0.5.6. Changes: - Updated testcontainers version in crates/builder/Cargo.toml - Fixed breaking bollard API changes in external.rs: - Config -> ContainerCreateBody - Moved Options types to query_parameters module - Moved model types to models module - Removed generic type parameters from Options structs - Changed boolean Option fields to plain bools in AttachContainerOptions - Updated CreateImageOptions fields to use Option<String> - Updated Cargo.lock Ported from upstream: flashbots/op-rbuilder#396 * fmt
This was referenced Feb 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR updates the
testcontainersdependency from v0.24.0 to v0.27.0 to remediate CVE-2025-62518 (GHSA-j5gw-2vrg-8fgx), a HIGH severity vulnerability intokio-tar.Vulnerability Details
Dependency Chain
Before:
After:
Changes Made
Updated Dependencies:
testcontainers:0.24.0→0.27.0Cargo.lockviacargo update -p testcontainersFixed Breaking API Changes in
bollard(used by testcontainers):Config→ContainerCreateBodyquery_parametersmodulemodelsmoduleStartContainerOptions<String>→StartContainerOptions)AttachContainerOptionsCreateImageOptionsfields to useOption<String>Files Modified:
crates/op-rbuilder/Cargo.toml: Updated testcontainers versionCargo.lock: Updated dependency treecrates/op-rbuilder/src/tests/framework/external.rs: Fixed API compatibilityVerification
✅ Vulnerability Remediation:
cargo tree -i tokio-tar: Package no longer in dependency treecargo tree -p testcontainers: Confirms astral-tokio-tar v0.5.6 is usedcargo audit: No tokio-tar vulnerabilities found✅ Compilation Checks:
cargo build -p op-rbuilder --bin op-rbuilder: Successcargo build -p op-rbuilder --bin tester --features testing: Successcargo clippy --all-features: No warnings✅ Test Suite:
cargo test -p op-rbuilder --features testing: All 110 tests passReferences