fix(security): resolve cargo audit advisories + bump crux to 0.19 - #124
Merged
JanZachmann merged 3 commits intoJul 7, 2026
Merged
Conversation
Summary: - Update quinn-proto 0.11.14 -> 0.11.16 (RUSTSEC-2026-0185, high: remote memory exhaustion via unbounded out-of-order stream reassembly) - Update anyhow 1.0.102 -> 1.0.103 (RUSTSEC-2026-0190: unsound Error::downcast_mut()) - Replace unmaintained rustls-pemfile (RUSTSEC-2025-0134) with the rustls-pki-types pem API in load_tls_config; from_pem_file auto-detects PKCS#1/PKCS#8/SEC1 keys, collapsing the previous key-type match - Bump workspace version 1.2.4 -> 1.2.5 Reason: - cargo audit reported one high vulnerability, one unsoundness advisory and an unmaintained direct dependency. Frontend (crux) transitive warnings (bincode, proc-macro-error) and the no-fix rsa advisory (via jsonwebtoken) are out of scope. Verification: - cargo build, cargo clippy --features mock (pedantic+nursery clean), cargo test --features mock (all pass), cargo +nightly fmt - cargo audit: rustls-pemfile no longer in dependency tree Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Summary: - crux_core 0.17 -> 0.19, crux_http 0.16 -> 0.19, crux_macros 0.8 -> 0.10, crux_time 0.15 -> 0.17 (in app + shared_types) - The crux testing helpers (Command/Effect expect_*, ResponseBuilder) moved behind feature flags in 0.19. Enable them as dev-dependencies (crux_core "testing", crux_http "http-types") so they stay out of the WASM/production build. - Adapt http_helpers tests: ResponseBuilder::with_status now takes u16, and crux_http re-exports http::StatusCode (OK/SERVICE_UNAVAILABLE). Reason: - Keep the Crux core current. Note: this does not clear the bincode / proc-macro-error unmaintained warnings; crux 0.19 still pulls both in. Verification: - cargo build, cargo clippy --features mock (clean), cargo test --features mock (368 pass), cargo +nightly fmt - wasm-pack build (production, testing feature absent) clean - TypeScript bindings regenerated; full e2e suite 133/133 pass Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
JanZachmann
changed the title
Summary: - Convert single- and known-order effect assertions to the fluent <Effect>TestExt API added in crux 0.18 (expect_only_web_socket_with, expect_only_http_with, expect_render().expect_http_with, expect_http_with). - Removes the manual expect_effect()/find_map/split() boilerplate in auth, websocket, wifi and the reconnection healthcheck test. - Keep the position-independent timer helpers (find_time_effect, collect_time_effects): the fluent API is order-based and does not fit find-among-many / multi-timer membership checks. Reason: - The 0.19 bump exposed the fluent assertion API; using it makes the effect tests shorter and read top-to-bottom in effect order. Verification: - cargo test --features mock (368 pass), cargo clippy --features mock --all-targets (clean), cargo +nightly fmt - Test-only changes (#[cfg(test)]): WASM/production build and e2e unaffected Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backend security/audit fixes
reqwest)Error::downcast_mut())rustls-pki-typespem API inload_tls_config.PrivateKeyDer::from_pem_fileauto-detects PKCS#1/PKCS#8/SEC1, collapsing the previous manual key-type match.Crux core bump
src/app+src/shared_types).Command/Effectexpect_*,ResponseBuilder) moved behind feature flags in 0.19; enabled as dev-dependencies (crux_coretesting,crux_httphttp-types) so they stay out of the WASM/production build.http_helperstests adapted:ResponseBuilder::with_statusnow takesu16;crux_httpre-exportshttp::StatusCode(OK/SERVICE_UNAVAILABLE).<Effect>TestExtassertions added in crux 0.18 (expect_only_web_socket_with,expect_only_http_with,expect_render().expect_http_with,expect_http_with) in the auth/websocket/wifi/reconnection tests — removes manualexpect_effect()/find_map/split()boilerplate (net −32 lines). Position-independent timer helpers (find_time_effect,collect_time_effects) kept, since the order-based fluent API does not fit find-among-many checks.Version
Reason
cargo auditflagged a high vulnerability, an unsoundness advisory, and an unmaintained direct dependency — all backend, all independently fixable. The crux bump keeps the Core current.No frontend (
src/ui) dependency changes — the UI is built with--frozen-lockfile.Out of scope (documented, not fixed):
rsa(RUSTSEC-2023-0071, Marvin Attack) — no upstream fix; transitive viajsonwebtoken.bincode+proc-macro-error(unmaintained) — transitive via crux. The crux 0.19 bump does not clear these; crux still pulls both in. Not fixable without upstream crux dropping them.Verification
cargo build,cargo clippy --features mock --all-targets(pedantic+nursery, clean),cargo test --features mock(368 pass),cargo +nightly fmtwasm-pack build(production; testing feature absent) cleancargo audit:rustls-pemfilegone from tree; remaining findings are the out-of-scope items above.