Repository navigation
bump rusty_alloc-api to =2.2.6 - #51
Open
Ttimmahlax wants to merge 16 commits into
Open
Ttimmahlax wants to merge 16 commits into
Ttimmahlax wants to merge 16 commits into
Conversation
The rollout edits the manifests through the API; CI builds with --locked, so the lockfile has to move with them: rusty_alloc / rusty_alloc-api 2.2.6, the rff-* family 0.2.4 (remade_ffmpeg_rs wave 2), rusty_jpeg 0.4.3. cargo vet: this repository records house crates as exemptions pinned to an exact version; the eleven existing exemptions move to the versions now locked. No new crate is exempted. Owner decision 2026-10-17 (Tim Almond), as for rusty_h264. `cargo vet --locked`: 273 fully audited, 2 partially, 321 exempted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Four rustls advisories published this week (TLS secrets in Debug impls, buffered data after ECH rejection, pre-auth brotli decompression of up to 1 GiB, and a ServerHello downgrade to classical key exchange) are fixed in 0.23.46. A lockfile-only patch update; cargo vet covers it through imported audits (imports.lock), no exemption added. Left open: RUSTSEC-2026-0367..0369 in zip 8.6.0, which needs zip >= 9.0.0. It arrives through the house candle fork (candle-core, branch simd128-f16-gates-0.11.0), so the fix belongs in that repository; master carries the same zip 8.6.0 today. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The candle fork (branch simd128-f16-gates-0.11.0) moved its zip from 8.6.0 to 9.0 (Remade-With-Rust/candle#1), which fixes the three extraction advisories cargo-deny reported here. The lockfile takes that commit (fa366d84 -> 8fe73185) and zip 9.0.5, which adds nix 0.31.3. cargo vet: the four candle exemptions pinned to the old commit move to the new one, zip's exemption moves 8.6.0 -> 9.0.5, and nix 0.31.3 is exempted. Owner decision 2026-10-17 (Tim Almond). `cargo vet --locked`: 273 fully audited, 3 partially, 321 exempted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Five quinn-proto advisories published this week (stream-reassembly and connection-ID memory exhaustion, zero-length DATAGRAM frames past the receive limit, and two remote panics) are fixed by 0.11.18; cargo update takes the newest patch, 0.11.19. Lockfile-only. cargo vet: the existing quinn-proto exemption moves 0.11.16 -> 0.11.19, as for zip. No new crate is exempted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated dependency rollout by
remade-updater.Moves
rusty_alloc-apito=2.2.6across every repository that declares it, so the portfolio does not end up straddling two versions of one crate.This pull request is one of a set. None of them merge until all of them are green -- a half-merged rollout is the state this tooling exists to prevent.
Generated from the manifests themselves; nothing here is hand-maintained.