Repository navigation
Pin tinystoragedrivers v2.1.3 and move to Rust 1.89 - #103
Conversation
cargo-deny fails Supply chain on main with RUSTSEC-2026-0459 (CVE-2026-119375): libsqlite3-sys 0.38.2 bundles SQLite older than 3.54. It arrives through the tinystoragedrivers testkit dev-dependency (via rusqlite 0.40). tinystoragedrivers v2.1.3 (f5a33025b9) moves to rusqlite 0.41.1 / libsqlite3-sys 0.39.1, so pin that release. rusqlite 0.41 needs Rust 1.89, so rust-version moves from 1.88 to 1.89. Also move rustix to 1.1.6 and xattr 1.6.1 -> 1.7.0 (xattr 1.7.0 is the release built for rustix 1.1.6's change), for RUSTSEC-2026-0486 (rustix 1.0-1.1.5 xattr functions unsound on a zero-length buffer). Nothing in this workspace calls those functions directly. Also drop the deny.toml ignores for RUSTSEC-2026-0367, 0368 and 0369. They no longer match anything (cargo-deny warned advisory-not-detected), so they only hid what a future zip advisory would look like.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Tiny Sweeper reviewReviewed head: Verdict: Ready for maintainer review · Priority: none Diagnostics and supporting detailsFull summaryPull request purpose (title): Pin tinystoragedrivers v2.1.3 and move to Rust 1.89. This pull request fixes the red `Supply chain` check on `main` by pinning the four `tinystoragedrivers` git dependencies (types, api, busproxy, testkit) to the v2.1.3 commit `f5a33025b9feaa36fea522cce764fe8c796e5139`, raising the workspace `rust-version` from 1.88 to 1.89, and dropping three stale advisory ignores from `deny.toml`. The stated driver is RUSTSEC-2026-0459 (CVE-2026-119375): `libsqlite3-sys` 0.38.2 bundled SQLite older than 3.54 and reached the workspace only through the testkit dev-dependency via `rusqlite` 0.40; v2.1.3 moves to `rusqlite` 0.41.1 / `libsqlite3-sys` 0.39.1, whose Rust 1.89 requirement is the reason for the MSRV bump. The lockfile also picks up rustix 1.1.6 with xattr 1.7.0 for RUSTSEC-2026-0486. There are no public API changes. The critique lane noted it could not inspect the new upstream revision itself, so compatibility with the workspace's `[patch]` for tinybus is unverified, and that the code index trails this pull request. Unreviewed paths
Review snapshot
Completeness: Complete What changedWorkspace MSRV moves 1.88 → 1.89 in `Cargo.toml`. All four `tinystoragedrivers-{types,api,busproxy,testkit}` git dependencies move from rev `6226b9484c8bd01c58741718cd89ba90a13a36bb` to the v2.1.3 rev `f5a33025b9feaa36fea522cce764fe8c796e5139`, which transitively upgrades `rusqlite` to 0.41.1 / `libsqlite3-sys` to 0.39.1 and rebuilds against rustix 1.1.6 with xattr 1.7.0. `deny.toml` loses its ignore list for RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 together with the `zip`/tinybus explanatory comment, since those advisories no longer match anything in the dependency graph. The lockfile churn is confined to the tinystoragedrivers crates, rusqlite / libsqlite3-sys and rustix / xattr; tinybus stays patched to the vendored checkout. Features
TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Before mergeNone. Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
Summary
Supply chainis red onmain. cargo-deny reports RUSTSEC-2026-0459 (CVE-2026-119375):libsqlite3-sys0.38.2 bundles SQLite older than 3.54. It reaches this workspace only through the tinystoragedrivers testkit dev-dependency, viarusqlite0.40.f5a33025b9feaa36fea522cce764fe8c796e5139, tagv2.1.3), which moves torusqlite0.41.1 /libsqlite3-sys0.39.1.rust-version: 1.88 → 1.89, becauserusqlite0.41 requires Rust 1.89.xattr1.6.1 → 1.7.0 (the release built for rustix 1.1.6's change), for RUSTSEC-2026-0486 (rustix 1.0–1.1.5 xattr functions mark a zero-length buffer as filled; patched in 1.1.6). Nothing in this workspace calls those functions directly, so 1.1.6's changed zero-length behaviour doesn't affect our code.deny.tomlignores for RUSTSEC-2026-0367, 0368 and 0369, with their comment. They no longer match any crate in the graph (cargo-deny reportedadvisory-not-detected), so they would only hide a future advisory with the same ids.Lockfile: +30/-30, limited to the tinystoragedrivers crates, rusqlite / libsqlite3-sys, rustix / xattr. tinybus does not move: the workspace patches it to its vendored checkout.
Related issue
None. The failing check is
Supply chainonmain.API or behavior changes
None in the public API. The minimum supported Rust version rises from 1.88 to 1.89.
Validation
Run on our Linux CI runner, on this exact tree, checked out from
maind424749:cargo deny --locked check all: exit 0 (RUSTSEC-2026-0459 and RUSTSEC-2026-0486 no longer reported)cargo build --locked --all-targets --all-features: passcargo test --locked --all-features: 733 passed, 0 failedcargo clippy --locked --all-targets --all-features -- -D warnings: passcargo +1.89 build --locked --workspace --all-targets --all-features: pass at the new minimumcargo fmt --all -- --check: not run; no Rust source changesDocumentation
Not needed beyond
rust-version.