Repository navigation
fix(deps): close two russh SSH server advisories by moving to 0.64.1 - #658
Conversation
GHSA-4wc5-f2rc-q74m (medium): the agent protocol server allocated without bound on crafted constraint records; fixed in 0.64.1. GHSA-j7h2-66j4-ghjf (low): the server accepted a publickey signature made with a different algorithm than the request named; fixed in 0.64.0. russh stays on ring with the same features, so aws-lc stays out of the graph, and its cargo vet exemption moves to the new version.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly states the dependency update and its security purpose. It identifies the affected package and target version. |
| Description check | |
The description explains the advisories, dependency change, preserved features, affected files, and validation results. It is sufficiently complete, although it does not explicitly state whether AI to… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Description check
-
Explanation
The description explains the advisories, dependency change, preserved features, affected files, and validation results. It is sufficiently complete, although it does not explicitly state whether AI tools were used or link to tracking issues.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Dependabot reports two open russh advisories against
Cargo.lock. russh is only built with thesshfeature, where it runs the Tailscale SSH server.The fix moves the pin from 0.63.2 to 0.64.1, with the same features (
flate2,ring, no defaults), so aws-lc stays out of the graph. Only the russh entry changes inCargo.lock, and thecargo vetexemption moves to 0.64.1. No code change was needed.On MacMini:
cargo clippy --workspace --all-targets --all-features -D warningsis clean,cargo test -p geiserx_tailscale --all-featurespasses (174 tests),cargo deny check allreports advisories ok, andcargo vet --lockedpasses.Summary by CodeRabbit