Skip to content

Bump tracing-subscriber from 0.3.19 to 0.3.20 in /temporalio #331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 3, 2025
Merged

Bump tracing-subscriber from 0.3.19 to 0.3.20 in /temporalio #331

merged 1 commit into from
Sep 3, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 29, 2025 •
edited
Loading

Bumps tracing-subscriber from 0.3.19 to 0.3.20.

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.20

Security Fix: ANSI Escape Sequence Injection (CVE-TBD)

Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

  • Manipulate terminal title bars
  • Clear screens or modify terminal display
  • Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

Solution

Version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

Affected Versions

All versions of tracing-subscriber prior to 0.3.20 are affected by this vulnerability.

Recommendations

Immediate Action Required: We recommend upgrading to tracing-subscriber 0.3.20 immediately, especially if your application:

  • Logs user-provided input (form data, HTTP headers, query parameters, etc.)
  • Runs in environments where terminal output is displayed to users

Migration

This is a patch release with no breaking API changes. Simply update your Cargo.toml:

[dependencies]
tracing-subscriber = "0.3.20"

Acknowledgments

We would like to thank zefr0x who responsibly reported the issue at security@tokio.rs.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at security@tokio.rs.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Aug 29, 2025
@dependabot dependabot bot requested a review from a team as a code owner August 29, 2025 20:54
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Aug 29, 2025
@cretz
Copy link
Member

cretz commented Sep 3, 2025

@dependabot rebase

@dependabot
Bump tracing-subscriber from 0.3.19 to 0.3.20 in /temporalio
7071ea7 
Bumps [tracing-subscriber](https://github.com/tokio-rs/tracing) from 0.3.19 to 0.3.20.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-subscriber-0.3.19...tracing-subscriber-0.3.20)

---
updated-dependencies:
- dependency-name: tracing-subscriber
  dependency-version: 0.3.20
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/cargo/temporalio/tracing-subscriber-0.3.20 branch from 3bb9870 to 7071ea7 Compare September 3, 2025 17:38
@cretz cretz merged commit 4fc6a58 into main Sep 3, 2025
8 checks passed
@cretz cretz deleted the dependabot/cargo/temporalio/tracing-subscriber-0.3.20 branch September 3, 2025 18:11
THardy98 pushed a commit that referenced this pull request Sep 9, 2025
@dependabot @THardy98
Bump tracing-subscriber from 0.3.19 to 0.3.20 in /temporalio (#331)
0d16b46
THardy98 added a commit that referenced this pull request Sep 10, 2025
@THardy98 @dependabot @cretz
Environment configuration (#326)
51b5f95 
* envconfig impl

* linting

* fix steep type checks

* formatting

* Refactor envconfig classes to use Data.define for immutability

- Refactor ClientConfigTLS, ClientConfigProfile, and ClientConfig to use Data.define

* Rename hash methods to use idiomatic Ruby naming

- Rename from_hash → from_h for all envconfig classes
- Rename to_hash → to_h for all envconfig classes

* Replace TLS config hash with Connection::TLSOptions object

- Rename `to_connect_tls_config` → `to_tls_options`
- Return `Connection::TLSOptions` object instead of plain Hash

* Refactor to use inline pattern instead of temporary variables

* Refactor to_client_connect_options to return tuple for one-liner usage

Changed `to_client_connect_options` to return `[positional_args, keyword_args]`
tuple instead of a hash, enabling clean one-liner client connections:

```ruby
args, kwargs = profile.to_client_connect_options
client = Temporalio::Client.connect(*args, **kwargs)
```

* Make hash methods private

* Remove File.exist? check by using type system for path vs data distinction

- TOML paths (*_path fields) become Pathname objects
- TOML data (*_data fields) remain String objects

* Use symbol keys instead of string keys in Rust FFI bridge

Changed all hash keys from strings to symbols in the Rust-to-Ruby bridge

* Bump golang.org/x/net in /temporalio/test/golangworker (#303)

* Bump tracing-subscriber from 0.3.19 to 0.3.20 in /temporalio (#331)

* Reduce the scope of the illegal call tracer and other tracing fixes (#332)

* Remove unnecessary fully qualified import names

* Remove envconfig import in temporalio.rb

* _source_to_path_and_data prefixed with underscore and private doc visibility

* TLS disabled field now optional

* Rubocop fixes

* Steep fixes

* Renamed envconfig.rb -> env_config.rb
Renamed to_tls_options -> to_client_tls_options

* Pass data string as RString, Rust bridge converts to Vec

* Rename load_client_connect_config -> load_client_connect_options

* Format envconfig.rs

* Nits

* Update core submodule

* Revert irrelevant cancellation changes

* Update Cargo.lock

* Propagate set_headers failure in client bridge

* Add experimental warning

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chad Retz <chad.retz@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cretz cretz cretz approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file rust Pull requests that update Rust code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@cretz