Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deps: upgrade Tokio 1.21.0 -> 1.24.1 #1877

Merged
merged 1 commit into from Jan 10, 2023
Merged

Conversation

cpu
Copy link
Contributor

@cpu cpu commented Jan 9, 2023

Description

This branch updates the Cargo.lock file with the output produced by cargo update -p tokio, updating Tokio from 1.21.0 to 1.24.1.

Notably this resolves RUSTSEC-2023-0001, which was previously flagged in CI by cargo audit.

Note to reviewers

As a word of warning, there's a decent number of commits between these two tags and the vuln itself seems uninteresting for trust-dns. I'm probably too new to this codebase and the Tokio ecosystem to safely vet the update beyond saying that cargo make test passes locally, so this may require more analysis by a maintainer. It's also possible we could specify a more precise version to cargo update -p tokio to resolve the vuln with less of a semver jump.

Cargo audit

tip of main cargo audit output
[nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD
7232d887d1d0c0ade287e40e09250bf74a9b137a

[nix-shell:~/Code/Rust/trust-dns]$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 478 security advisories (from /home/daniel/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (231 crate dependencies)
Crate:     tokio
Version:   1.21.0
Title:     reject_remote_clients Configuration corruption
Date:      2023-01-04
ID:        RUSTSEC-2023-0001
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0001
Solution:  Upgrade to >=1.18.4, <1.19.0 OR >=1.20.3, <1.21.0 OR >=1.23.1
Dependency tree:
tokio 1.21.0
├── trust-dns-util 0.22.0
├── trust-dns-server 0.22.0
│   ├── trust-dns-integration 0.22.0
│   └── trust-dns 0.22.0
├── trust-dns-resolver 0.22.0
│   ├── trust-dns-util 0.22.0
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-recursor 0.22.0
│   │   ├── trust-dns-util 0.22.0
│   │   ├── trust-dns-server 0.22.0
│   │   └── trust-dns-integration 0.22.0
│   ├── trust-dns-integration 0.22.0
│   ├── trust-dns 0.22.0
│   └── async-std-resolver 0.22.0
├── trust-dns-recursor 0.22.0
├── trust-dns-proto 0.22.0
│   ├── trust-dns-util 0.22.0
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-resolver 0.22.0
│   ├── trust-dns-recursor 0.22.0
│   ├── trust-dns-integration 0.22.0
│   ├── trust-dns-client 0.22.0
│   │   ├── trust-dns-util 0.22.0
│   │   ├── trust-dns-server 0.22.0
│   │   ├── trust-dns-integration 0.22.0
│   │   ├── trust-dns-compatibility 0.22.0
│   │   └── trust-dns 0.22.0
│   └── trust-dns 0.22.0
├── trust-dns-integration 0.22.0
├── trust-dns-client 0.22.0
├── trust-dns 0.22.0
├── tokio-util 0.7.3
│   └── h2 0.3.14
│       ├── trust-dns-server 0.22.0
│       └── trust-dns-proto 0.22.0
├── tokio-rustls 0.23.4
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-resolver 0.22.0
│   └── trust-dns-proto 0.22.0
├── tokio-openssl 0.6.3
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-resolver 0.22.0
│   └── trust-dns-proto 0.22.0
├── tokio-native-tls 0.3.0
│   ├── trust-dns-resolver 0.22.0
│   └── trust-dns-proto 0.22.0
├── quinn 0.9.0
│   └── trust-dns-proto 0.22.0
└── h2 0.3.14

error: 1 vulnerability found!
branch cargo audit output:
[nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD
1056bb41d4b1a0a58c4d1926ab52dc60fd459a79

[nix-shell:~/Code/Rust/trust-dns]$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 478 security advisories (from /home/daniel/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (231 crate dependencies)

This commit updates the `Cargo.lock` file with the output produced by
`cargo update -p tokio`, updating Tokio from 1.21.0 to 1.24.1.

Notably this resolves RUSTSEC-2023-0001, which was previously flagged in
CI by `cargo audit`.
Copy link
Collaborator

@djc djc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great, thanks!

@djc djc merged commit 77e02ae into hickory-dns:main Jan 10, 2023
@cpu cpu deleted the cpu-RUSTSEC-2023-0001 branch January 10, 2023 13:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants