Repository navigation
fix(deps): update h2 and defer SQLite until SQLx release - #5392
Merged
Merged
Conversation
Update h2 from 0.4.15 to the first patched release, 0.4.16, in the standalone e2e/rust lockfile. This addresses GHSA-q83h-524g-xf6h, which permits unbounded buffering of empty HTTP/2 DATA frames. Cargo also resolves the existing broad Windows API requirements of errno, rustix, and tempfile to the already locked windows-sys 0.52.0. No other package versions change, and no source changes are required. Signed-off-by: Adrien Langou <alangou@nvidia.com>
Backport SQLx's upstream libsqlite3-sys upper-bound change into the published sqlx-sqlite 0.9.0 driver. Require a patched SQLite binding and select libsqlite3-sys 0.39.1 (SQLite 3.54.1) in all ten affected lockfiles. Keep the upstream Rust sources and SQLx API unchanged. Include the full upstream licenses, verified archive provenance, and removal instructions for the temporary path patches. Preserve upstream rustdoc line breaks and exclude third-party sources from NVIDIA header rewriting. No security-policy exception is added. Cargo also resolves tempfile's broad getrandom requirement to the existing 0.3.4 entry in E2E and the V8 example; no other package versions change in this commit. Signed-off-by: Adrien Langou <alangou@nvidia.com>
|
Label |
Contributor
Author
|
/ok to test 471027a |
Remove the vendored SQLx SQLite driver and its workspace patches. Keep the released dependency graph while waiting for SQLx to accept patched libsqlite3-sys >=0.39.0. Record a temporary RUSTSEC-2026-0459 exception with the upstream fix and an explicit removal condition. Preserve the h2 remediation. Signed-off-by: Adrien Langou <alangou@nvidia.com>
alangou
changed the title
Contributor
Author
|
/ok to test bf05bc6 |
SDAChess
approved these changes
Nov 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update the E2E harness from h2 0.4.15 to 0.4.16 to fix RUSTSEC-2026-0258
(unbounded buffering of empty HTTP/2 DATA frames). Temporarily acknowledge the
SQLite advisory RUSTSEC-2026-0459 while waiting for a compatible SQLx release.
Related Issue
No linked issue, per the maintainer's instruction for this dependency update.
Changes
e2e/rust/Cargo.lock. Cargo also resolves three existing broadwindows-sys dependency references to the already locked 0.52.0 entry.
deny.toml. Remove it when a published SQLx release permits upgrading topatched
libsqlite3-sys >=0.39.0.SQLx 0.9.0 is the latest published release; its SQLite driver requires
libsqlite3-sys <0.38.0. The upstream constraint changeis merged but unreleased. SQLite remains at its existing affected versions
(0.30.1/0.37.0); this exception does not fix that vulnerability.
Release Notes
Testing
mise run rust:deny, including nine crypto-policy cases, passeswith the explicitly accepted SQLite exception and the existing RSA exception.
-D warnings.1e8843aeb. The final contents differ from that tested revision only indeny.toml, so the runtime validation remains applicable.test:e2eCI passes on the current PR head.The existing RSA advisory exception and yanked-package warnings remain. The RSA
exception's no-patched-release rationale needs a separate review: RSA 0.10.0 is
now released, but current consumers still require older versions.
Checklist