From 37b19ab5b47bd697ca36a162c52cdd056487146c Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Mon, 14 Sep 2026 20:52:56 +0400 Subject: [PATCH 1/7] fix: bump rustls to 0.23.45 (RUSTSEC-2026-0285) and yanked chacha20 --- Cargo.lock | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index c0073927b..f4572dd68 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1331,9 +1331,9 @@ dependencies = [ [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -7011,7 +7011,7 @@ version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207" dependencies = [ - "chacha20 0.10.0", + "chacha20 0.10.2", "getrandom 0.4.1", "rand_core 0.10.1", ] @@ -7655,9 +7655,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.36" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell", @@ -7718,9 +7718,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types", From 3a53a65599dd924811582d1b81d95660ff057615 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Mon, 14 Sep 2026 21:17:25 +0400 Subject: [PATCH 2/7] fix: refresh supply-chain for rustls/chacha20 bump - Add exemption for chacha20 0.10.2 (published via trusted publishing, so no publisher identity exists for trust entries to cover) - Refresh imports.lock: rustls 0.23.45 / rustls-webpki 0.103.15 publisher records and upstream vendor audit updates --- supply-chain/audits.toml | 4 ++-- supply-chain/config.toml | 4 ++++ supply-chain/imports.lock | 26 +++++++++++++------------- 3 files changed, 19 insertions(+), 15 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 85ecee703..3cf4fb9c5 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2075,13 +2075,13 @@ end = "2026-10-15" [[trusted.zerocopy]] criteria = "safe-to-deploy" -user-id = 7178 # Joshua Liebow-Feeser (joshlf) +user-id = 7178 # Josh Liebow-Feeser (joshlf) start = "2019-02-28" end = "2026-10-15" [[trusted.zerocopy-derive]] criteria = "safe-to-deploy" -user-id = 7178 # Joshua Liebow-Feeser (joshlf) +user-id = 7178 # Josh Liebow-Feeser (joshlf) start = "2019-02-28" end = "2026-10-15" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index e58e59915..51847ac30 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -208,6 +208,10 @@ criteria = "safe-to-deploy" version = "1.1.0" criteria = "safe-to-deploy" +[[exemptions.chacha20]] +version = "0.10.2" +criteria = "safe-to-deploy" + [[exemptions.clipboard-win]] version = "5.4.1" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index c39d030f8..a0429baa2 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -397,7 +397,7 @@ version = "0.1.1" when = "2020-09-15" user-id = 2396 user-login = "jdm" -user-name = "Josh Matthews" +user-name = "Josh Bowman-Matthews" [[publisher.cpufeatures]] version = "0.2.17" @@ -1401,8 +1401,8 @@ user-login = "sunfishcode" user-name = "Dan Gohman" [[publisher.rustls]] -version = "0.23.36" -when = "2026-01-05" +version = "0.23.45" +when = "2026-09-14" user-id = 2751 user-login = "ctz" user-name = "Joe Birr-Pixton" @@ -1436,11 +1436,11 @@ user-login = "cpu" user-name = "Daniel McCarney" [[publisher.rustls-webpki]] -version = "0.103.13" -when = "2026-04-21" -user-id = 2751 -user-login = "ctz" -user-name = "Joe Birr-Pixton" +version = "0.103.15" +when = "2026-08-21" +user-id = 209038 +user-login = "cpu" +user-name = "Daniel McCarney" [[publisher.rustversion]] version = "1.0.22" @@ -2515,14 +2515,14 @@ version = "0.8.39" when = "2026-02-05" user-id = 7178 user-login = "joshlf" -user-name = "Joshua Liebow-Feeser" +user-name = "Josh Liebow-Feeser" [[publisher.zerocopy-derive]] version = "0.8.39" when = "2026-02-05" user-id = 7178 user-login = "joshlf" -user-name = "Joshua Liebow-Feeser" +user-name = "Josh Liebow-Feeser" [[publisher.zeroize]] version = "1.8.2" @@ -4446,7 +4446,7 @@ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-ch [[audits.mozilla.wildcard-audits.core-graphics-types]] who = "Bobby Holley " criteria = "safe-to-deploy" -user-id = 2396 # Josh Matthews (jdm) +user-id = 2396 # Josh Bowman-Matthews (jdm) start = "2020-07-20" end = "2023-05-04" renew = false @@ -4458,8 +4458,8 @@ who = "Henri Sivonen " criteria = "safe-to-deploy" user-id = 4484 # Henri Sivonen (hsivonen) start = "2019-02-26" -end = "2025-10-23" -notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ." +end = "2027-09-07" +notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.etagere]] From 7170ec6b6c58adaf5f90f99ee2212049eb4c9854 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Mon, 14 Sep 2026 21:30:04 +0400 Subject: [PATCH 3/7] fix: bump tokio-postgres to 0.7.18 and postgres-protocol to 0.6.12 --- Cargo.lock | 164 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 122 insertions(+), 42 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f4572dd68..616675f9d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -53,7 +53,7 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0" dependencies = [ - "crypto-common", + "crypto-common 0.1.7", "generic-array", ] @@ -943,7 +943,7 @@ version = "0.10.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe" dependencies = [ - "digest", + "digest 0.10.7", ] [[package]] @@ -961,6 +961,15 @@ dependencies = [ "generic-array", ] +[[package]] +name = "block-buffer" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" +dependencies = [ + "hybrid-array", +] + [[package]] name = "block2" version = "0.5.1" @@ -1597,7 +1606,7 @@ version = "0.4.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" dependencies = [ - "crypto-common", + "crypto-common 0.1.7", "inout", "zeroize", ] @@ -1681,6 +1690,12 @@ dependencies = [ "x11rb", ] +[[package]] +name = "cmov" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" + [[package]] name = "codespan-reporting" version = "0.11.1" @@ -1859,6 +1874,12 @@ dependencies = [ "tracing-subscriber", ] +[[package]] +name = "const-oid" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" + [[package]] name = "const_format" version = "0.2.35" @@ -2149,7 +2170,7 @@ dependencies = [ "chacha20poly1305", "generic-array", "hex", - "hmac", + "hmac 0.12.1", "lazy_static", "merlin", "num", @@ -2167,7 +2188,7 @@ dependencies = [ "serde", "serialization", "sha-1", - "sha2", + "sha2 0.10.9", "sha3", "strum 0.26.3", "test-utils", @@ -2187,6 +2208,15 @@ dependencies = [ "typenum", ] +[[package]] +name = "crypto-common" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" +dependencies = [ + "hybrid-array", +] + [[package]] name = "csv" version = "1.4.0" @@ -2240,6 +2270,15 @@ dependencies = [ "cipher", ] +[[package]] +name = "ctutils" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +dependencies = [ + "cmov", +] + [[package]] name = "cursor-icon" version = "1.2.0" @@ -2255,7 +2294,7 @@ dependencies = [ "cfg-if", "cpufeatures 0.2.17", "curve25519-dalek-derive", - "digest", + "digest 0.10.7", "fiat-crypto", "rustc_version", "subtle", @@ -2505,11 +2544,23 @@ version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ - "block-buffer", - "crypto-common", + "block-buffer 0.10.4", + "crypto-common 0.1.7", "subtle", ] +[[package]] +name = "digest" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" +dependencies = [ + "block-buffer 0.12.1", + "const-oid", + "crypto-common 0.2.2", + "ctutils", +] + [[package]] name = "directories" version = "5.0.1" @@ -2870,7 +2921,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3306,7 +3357,7 @@ dependencies = [ "libc", "log", "rustversion", - "windows-link 0.2.1", + "windows-link 0.1.3", "windows-result 0.4.1", ] @@ -3785,7 +3836,16 @@ version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" dependencies = [ - "digest", + "digest 0.10.7", +] + +[[package]] +name = "hmac" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" +dependencies = [ + "digest 0.11.3", ] [[package]] @@ -3839,6 +3899,15 @@ version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424" +[[package]] +name = "hybrid-array" +version = "0.4.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214" +dependencies = [ + "typenum", +] + [[package]] name = "hyper" version = "1.8.1" @@ -3925,7 +3994,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.2", + "socket2 0.5.10", "system-configuration", "tokio", "tower-service", @@ -4362,7 +4431,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4996,12 +5065,12 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3" [[package]] name = "md-5" -version = "0.10.6" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf" +checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98" dependencies = [ "cfg-if", - "digest", + "digest 0.11.3", ] [[package]] @@ -5591,7 +5660,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -6655,27 +6724,27 @@ dependencies = [ [[package]] name = "postgres-protocol" -version = "0.6.10" +version = "0.6.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3ee9dd5fe15055d2b6806f4736aa0c9637217074e224bbec46d4041b91bb9491" +checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514" dependencies = [ "base64 0.22.1", "byteorder", "bytes", "fallible-iterator 0.2.0", - "hmac", + "hmac 0.13.0", "md-5", "memchr", - "rand 0.9.4", - "sha2", + "rand 0.10.1", + "sha2 0.11.0", "stringprep", ] [[package]] name = "postgres-types" -version = "0.2.12" +version = "0.2.14" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "54b858f82211e84682fecd373f68e1ceae642d8d751a1ebd13f33de6257b3e20" +checksum = "851ca9db4932932d69f3ea811b1abe63087a0f740a47692619dd40d4899b68be" dependencies = [ "bytes", "fallible-iterator 0.2.0", @@ -7396,7 +7465,7 @@ version = "0.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f" dependencies = [ - "digest", + "digest 0.10.7", ] [[package]] @@ -7650,7 +7719,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.11.0", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7824,7 +7893,7 @@ dependencies = [ "merlin", "rand_core 0.6.4", "serde_bytes", - "sha2", + "sha2 0.10.9", "subtle", "zeroize", ] @@ -8199,7 +8268,7 @@ checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c" dependencies = [ "cfg-if", "cpufeatures 0.2.17", - "digest", + "digest 0.10.7", ] [[package]] @@ -8210,7 +8279,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" dependencies = [ "cfg-if", "cpufeatures 0.2.17", - "digest", + "digest 0.10.7", ] [[package]] @@ -8221,7 +8290,18 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", "cpufeatures 0.2.17", - "digest", + "digest 0.10.7", +] + +[[package]] +name = "sha2" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "digest 0.11.3", ] [[package]] @@ -8230,7 +8310,7 @@ version = "0.10.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60" dependencies = [ - "digest", + "digest 0.10.7", "keccak", ] @@ -8428,7 +8508,7 @@ dependencies = [ "curve25519-dalek", "rand_core 0.6.4", "rustc_version", - "sha2", + "sha2 0.10.9", "subtle", ] @@ -8840,10 +8920,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1" dependencies = [ "fastrand", - "getrandom 0.4.1", + "getrandom 0.3.4", "once_cell", "rustix 1.1.3", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -9136,9 +9216,9 @@ dependencies = [ [[package]] name = "tokio-postgres" -version = "0.7.16" +version = "0.7.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dcea47c8f71744367793f16c2db1f11cb859d28f436bdb4ca9193eb1f787ee42" +checksum = "a528f7d280f6d5b9cd149635c8705b0dd049754bc67d81d31fa25169a93809d3" dependencies = [ "async-trait", "byteorder", @@ -9153,7 +9233,7 @@ dependencies = [ "pin-project-lite", "postgres-protocol", "postgres-types", - "rand 0.9.4", + "rand 0.10.1", "socket2 0.6.2", "tokio", "tokio-util", @@ -9678,7 +9758,7 @@ version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea" dependencies = [ - "crypto-common", + "crypto-common 0.1.7", "subtle", ] @@ -10645,7 +10725,7 @@ dependencies = [ "js-sys", "log", "naga", - "parking_lot 0.12.5", + "parking_lot 0.11.2", "profiling", "raw-window-handle", "smallvec", @@ -10673,7 +10753,7 @@ dependencies = [ "log", "naga", "once_cell", - "parking_lot 0.12.5", + "parking_lot 0.11.2", "profiling", "raw-window-handle", "rustc-hash 1.1.0", @@ -10715,7 +10795,7 @@ dependencies = [ "ndk-sys 0.5.0+25.2.9519653", "objc", "once_cell", - "parking_lot 0.12.5", + "parking_lot 0.11.2", "profiling", "range-alloc", "raw-window-handle", @@ -10779,7 +10859,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] From 10cea9ec1f7ceb03880413d0662d578bcee96525 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Mon, 14 Sep 2026 21:34:32 +0400 Subject: [PATCH 4/7] fix: refresh supply-chain for tokio-postgres/postgres-protocol bump --- supply-chain/config.toml | 52 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 51847ac30..c3f896bd7 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -132,6 +132,10 @@ criteria = "safe-to-deploy" version = "0.1.6" criteria = "safe-to-deploy" +[[exemptions.block-buffer]] +version = "0.12.1" +criteria = "safe-to-deploy" + [[exemptions.block2]] version = "0.5.1" criteria = "safe-to-deploy" @@ -216,6 +220,10 @@ criteria = "safe-to-deploy" version = "5.4.1" criteria = "safe-to-deploy" +[[exemptions.cmov]] +version = "0.5.4" +criteria = "safe-to-deploy" + [[exemptions.com]] version = "0.6.0" criteria = "safe-to-deploy" @@ -236,6 +244,10 @@ criteria = "safe-to-deploy" version = "2.5.0" criteria = "safe-to-deploy" +[[exemptions.const-oid]] +version = "0.10.2" +criteria = "safe-to-deploy" + [[exemptions.const_format]] version = "0.2.35" criteria = "safe-to-deploy" @@ -276,6 +288,10 @@ criteria = "safe-to-run" version = "0.5.0" criteria = "safe-to-run" +[[exemptions.crypto-common]] +version = "0.2.2" +criteria = "safe-to-deploy" + [[exemptions.ctor]] version = "0.10.1" criteria = "safe-to-deploy" @@ -288,6 +304,10 @@ criteria = "safe-to-deploy" version = "0.0.13" criteria = "safe-to-deploy" +[[exemptions.ctutils]] +version = "0.4.2" +criteria = "safe-to-deploy" + [[exemptions.cursor-icon]] version = "1.2.0" criteria = "safe-to-deploy" @@ -364,6 +384,10 @@ criteria = "safe-to-deploy" version = "0.4.0" criteria = "safe-to-deploy" +[[exemptions.digest]] +version = "0.11.3" +criteria = "safe-to-deploy" + [[exemptions.directories]] version = "5.0.1" criteria = "safe-to-deploy" @@ -632,6 +656,14 @@ criteria = "safe-to-deploy" version = "2.6.4" criteria = "safe-to-deploy" +[[exemptions.hmac]] +version = "0.13.0" +criteria = "safe-to-deploy" + +[[exemptions.hybrid-array]] +version = "0.4.10" +criteria = "safe-to-deploy" + [[exemptions.hyper-timeout]] version = "0.5.2" criteria = "safe-to-deploy" @@ -784,6 +816,10 @@ criteria = "safe-to-deploy" version = "0.8.4" criteria = "safe-to-deploy" +[[exemptions.md-5]] +version = "0.11.0" +criteria = "safe-to-deploy" + [[exemptions.memmap2]] version = "0.9.9" criteria = "safe-to-deploy" @@ -992,6 +1028,14 @@ criteria = "safe-to-run" version = "0.4.0" criteria = "safe-to-deploy" +[[exemptions.postgres-protocol]] +version = "0.6.12" +criteria = "safe-to-deploy" + +[[exemptions.postgres-types]] +version = "0.2.14" +criteria = "safe-to-deploy" + [[exemptions.ppv-lite86]] version = "0.2.21" criteria = "safe-to-deploy" @@ -1256,6 +1300,10 @@ criteria = "safe-to-run" version = "3.5.0" criteria = "safe-to-run" +[[exemptions.sha2]] +version = "0.11.0" +criteria = "safe-to-deploy" + [[exemptions.signal-hook]] version = "0.3.18" criteria = "safe-to-deploy" @@ -1384,6 +1432,10 @@ criteria = "safe-to-deploy" version = "1.10.0" criteria = "safe-to-deploy" +[[exemptions.tokio-postgres]] +version = "0.7.18" +criteria = "safe-to-deploy" + [[exemptions.tokio-socks]] version = "0.5.2" criteria = "safe-to-deploy" From 4e9a304341ce381ec7e0d42c13b2aa14abede3a1 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Mon, 14 Sep 2026 22:11:19 +0400 Subject: [PATCH 5/7] Fix remaining Dependabot alerts: hickory-proto, rand 0.7, lru - dns-server: migrate hickory-client/server 0.24 -> hickory-proto/server 0.26.3. hickory-client no longer exists in the 0.26 family, its types moved to hickory-proto; the Authority trait was replaced by ZoneHandler (fixes RUSTSEC-2026-0119, Dependabot #62) - utils: replace the abandoned probabilistic-collections crate (last release 2020) with an in-house bloom filter implementation, removing the vulnerable rand 0.7 from the dependency tree (fixes RUSTSEC-2026-0097, Dependabot #54) - node-gui: consume a patched iced_glyphon fork with lru upgraded to 0.16.3 via [patch.crates-io] (fixes RUSTSEC-2026-0002, Dependabot #44); no upstream iced release carries the fix yet --- Cargo.lock | 316 +++++++++++------------- Cargo.toml | 10 +- dns-server/Cargo.toml | 2 +- dns-server/src/config.rs | 2 +- dns-server/src/dns_server/mod.rs | 75 +++--- dns-server/src/dns_server/tests.rs | 41 ++- dns-server/src/error.rs | 2 +- utils/Cargo.toml | 2 +- utils/src/bloom_filters/bloom_filter.rs | 196 +++++++++++++-- 9 files changed, 395 insertions(+), 251 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 616675f9d..61afb1bd7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -138,7 +138,7 @@ dependencies = [ "cc", "cesu8", "jni 0.21.1", - "jni-sys", + "jni-sys 0.3.0", "libc", "log", "ndk", @@ -205,7 +205,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -216,7 +216,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -802,15 +802,6 @@ dependencies = [ "num-traits", ] -[[package]] -name = "bincode" -version = "1.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad" -dependencies = [ - "serde", -] - [[package]] name = "bip39" version = "2.2.2" @@ -2072,6 +2063,12 @@ dependencies = [ "itertools 0.10.5", ] +[[package]] +name = "critical-section" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" + [[package]] name = "crossbeam" version = "0.8.4" @@ -2687,7 +2684,7 @@ dependencies = [ "ctor", "directories", "futures", - "hickory-client", + "hickory-proto", "hickory-server", "itertools 0.14.0", "logging", @@ -2849,24 +2846,6 @@ version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099" -[[package]] -name = "endian-type" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d" - -[[package]] -name = "enum-as-inner" -version = "0.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc" -dependencies = [ - "heck 0.5.0", - "proc-macro2", - "quote", - "syn 2.0.114", -] - [[package]] name = "enum-iterator" version = "2.3.0" @@ -3381,17 +3360,6 @@ dependencies = [ "windows-link 0.2.1", ] -[[package]] -name = "getrandom" -version = "0.1.16" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce" -dependencies = [ - "cfg-if", - "libc", - "wasi 0.9.0+wasi-snapshot-preview1", -] - [[package]] name = "getrandom" version = "0.2.17" @@ -3644,6 +3612,11 @@ name = "hashbrown" version = "0.16.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" +dependencies = [ + "allocator-api2", + "equivalent", + "foldhash 0.2.0", +] [[package]] name = "hashbrown" @@ -3755,62 +3728,66 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df" [[package]] -name = "hickory-client" -version = "0.24.4" +name = "hickory-net" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "156579a5cd8d1fc6f0df87cc21b6ee870db978a163a1ba484acd98a4eff5a6de" +checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d" dependencies = [ + "async-trait", "cfg-if", "data-encoding", "futures-channel", + "futures-io", "futures-util", "hickory-proto", - "once_cell", - "radix_trie", - "rand 0.8.6", - "thiserror 1.0.69", + "idna", + "ipnet", + "jni 0.22.4", + "rand 0.10.1", + "thiserror 2.0.18", + "tinyvec", "tokio", "tracing", + "url", ] [[package]] name = "hickory-proto" -version = "0.24.4" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248" +checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d" dependencies = [ - "async-trait", - "cfg-if", "data-encoding", - "enum-as-inner", - "futures-channel", - "futures-io", - "futures-util", "idna", "ipnet", + "jni 0.22.4", "once_cell", - "rand 0.8.6", - "thiserror 1.0.69", + "rand 0.10.1", + "ring", + "serde", + "thiserror 2.0.18", "tinyvec", - "tokio", "tracing", "url", ] [[package]] name = "hickory-server" -version = "0.24.4" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "090078aff4e305853f8ccfbc89e6a1eec8a189bcb842be46255a2b660dae9416" +checksum = "950c2ad9ba2ad35d6890b725baff91305f65b87d7719a6c6071514dc70f13eeb" dependencies = [ "async-trait", "bytes", "cfg-if", - "enum-as-inner", + "data-encoding", "futures-util", + "hickory-net", "hickory-proto", + "ipnet", + "prefix-trie", "serde", - "thiserror 1.0.69", + "thiserror 2.0.18", "time", "tokio", "tokio-util", @@ -3994,7 +3971,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.5.10", + "socket2 0.6.2", "system-configuration", "tokio", "tower-service", @@ -4102,8 +4079,7 @@ dependencies = [ [[package]] name = "iced_glyphon" version = "0.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41c3bb56f1820ca252bc1d0994ece33d233a55657c0c263ea7cb16895adbde82" +source = "git+https://github.com/mintlayer/iced-glyphon?rev=acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1#acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1" dependencies = [ "cosmic-text", "etagere", @@ -4412,6 +4388,9 @@ name = "ipnet" version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130" +dependencies = [ + "serde", +] [[package]] name = "iri-string" @@ -4481,7 +4460,7 @@ checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec" dependencies = [ "cesu8", "combine", - "jni-sys", + "jni-sys 0.3.0", "log", "thiserror 1.0.69", "walkdir", @@ -4496,19 +4475,68 @@ dependencies = [ "cesu8", "cfg-if", "combine", - "jni-sys", + "jni-sys 0.3.0", "log", "thiserror 1.0.69", "walkdir", "windows-sys 0.45.0", ] +[[package]] +name = "jni" +version = "0.22.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498" +dependencies = [ + "cfg-if", + "combine", + "jni-macros", + "jni-sys 0.4.1", + "log", + "simd_cesu8", + "thiserror 2.0.18", + "walkdir", + "windows-link 0.2.1", +] + +[[package]] +name = "jni-macros" +version = "0.22.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3" +dependencies = [ + "proc-macro2", + "quote", + "rustc_version", + "simd_cesu8", + "syn 2.0.114", +] + [[package]] name = "jni-sys" version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" +[[package]] +name = "jni-sys" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2" +dependencies = [ + "jni-sys-macros", +] + +[[package]] +name = "jni-sys-macros" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264" +dependencies = [ + "quote", + "syn 2.0.114", +] + [[package]] name = "jni-utils" version = "0.1.1" @@ -4977,9 +5005,12 @@ dependencies = [ [[package]] name = "lru" -version = "0.12.5" +version = "0.16.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38" +checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39" +dependencies = [ + "hashbrown 0.16.1", +] [[package]] name = "lyon" @@ -5409,7 +5440,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4" dependencies = [ "bitflags 2.10.0", - "jni-sys", + "jni-sys 0.3.0", "log", "ndk-sys 0.6.0+11769913", "num_enum", @@ -5429,7 +5460,7 @@ version = "0.5.0+25.2.9519653" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8c196769dd60fd4f363e11d948139556a344e79d451aeb2fa2fd040738ef7691" dependencies = [ - "jni-sys", + "jni-sys 0.3.0", ] [[package]] @@ -5438,7 +5469,7 @@ version = "0.6.0+11769913" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873" dependencies = [ - "jni-sys", + "jni-sys 0.3.0", ] [[package]] @@ -5466,15 +5497,6 @@ dependencies = [ "utils", ] -[[package]] -name = "nibble_vec" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43" -dependencies = [ - "smallvec", -] - [[package]] name = "nix" version = "0.29.0" @@ -6113,6 +6135,10 @@ name = "once_cell" version = "1.21.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" +dependencies = [ + "critical-section", + "portable-atomic", +] [[package]] name = "once_cell_polyfill" @@ -6315,7 +6341,7 @@ dependencies = [ "rstest_reuse", "serde", "serialization", - "siphasher 1.0.2", + "siphasher", "storage", "storage-inmemory", "strum 0.26.3", @@ -6559,7 +6585,7 @@ version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" dependencies = [ - "siphasher 1.0.2", + "siphasher", ] [[package]] @@ -6568,7 +6594,7 @@ version = "0.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266" dependencies = [ - "siphasher 1.0.2", + "siphasher", ] [[package]] @@ -6704,6 +6730,12 @@ dependencies = [ "universal-hash", ] +[[package]] +name = "portable-atomic" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85" + [[package]] name = "pos-accounting" version = "1.4.0" @@ -6802,6 +6834,17 @@ dependencies = [ "termtree", ] +[[package]] +name = "prefix-trie" +version = "0.8.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7" +dependencies = [ + "either", + "ipnet", + "num-traits", +] + [[package]] name = "presser" version = "0.3.1" @@ -6832,19 +6875,6 @@ dependencies = [ "unicode-width", ] -[[package]] -name = "probabilistic-collections" -version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "10e885f79599b2c3fe1ad8ab539b4dbb0c6b801b5948696a6b0b6dee18675cea" -dependencies = [ - "bincode", - "byteorder", - "rand 0.7.3", - "rand_xorshift 0.2.0", - "siphasher 0.3.11", -] - [[package]] name = "proc-macro-crate" version = "3.4.0" @@ -6894,7 +6924,7 @@ dependencies = [ "num-traits", "rand 0.9.4", "rand_chacha 0.9.0", - "rand_xorshift 0.4.0", + "rand_xorshift", "regex-syntax", "rusty-fork", "tempfile", @@ -7030,29 +7060,6 @@ version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09" -[[package]] -name = "radix_trie" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd" -dependencies = [ - "endian-type", - "nibble_vec", -] - -[[package]] -name = "rand" -version = "0.7.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03" -dependencies = [ - "getrandom 0.1.16", - "libc", - "rand_chacha 0.2.2", - "rand_core 0.5.1", - "rand_hc", -] - [[package]] name = "rand" version = "0.8.6" @@ -7085,16 +7092,6 @@ dependencies = [ "rand_core 0.10.1", ] -[[package]] -name = "rand_chacha" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402" -dependencies = [ - "ppv-lite86", - "rand_core 0.5.1", -] - [[package]] name = "rand_chacha" version = "0.3.1" @@ -7125,15 +7122,6 @@ dependencies = [ "rand_core 0.10.1", ] -[[package]] -name = "rand_core" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19" -dependencies = [ - "getrandom 0.1.16", -] - [[package]] name = "rand_core" version = "0.6.4" @@ -7158,24 +7146,6 @@ version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" -[[package]] -name = "rand_hc" -version = "0.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c" -dependencies = [ - "rand_core 0.5.1", -] - -[[package]] -name = "rand_xorshift" -version = "0.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77d416b86801d23dde1aa643023b775c3a462efc0ed96443add11546cdf1dca8" -dependencies = [ - "rand_core 0.5.1", -] - [[package]] name = "rand_xorshift" version = "0.4.0" @@ -8367,16 +8337,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2" [[package]] -name = "simdutf8" -version = "0.1.5" +name = "simd_cesu8" +version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e" +checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520" +dependencies = [ + "rustc_version", + "simdutf8", +] [[package]] -name = "siphasher" -version = "0.3.11" +name = "simdutf8" +version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d" +checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e" [[package]] name = "siphasher" @@ -8920,7 +8894,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.1", "once_cell", "rustix 1.1.3", "windows-sys 0.52.0", @@ -9829,13 +9803,13 @@ dependencies = [ "loom", "num-traits", "parity-scale-codec", - "probabilistic-collections", "qrcodegen", "randomness", "regex", "rstest", "serial_test", "serialization", + "siphasher", "slave-pool", "static_assertions", "tempfile", @@ -10346,12 +10320,6 @@ dependencies = [ "try-lock", ] -[[package]] -name = "wasi" -version = "0.9.0+wasi-snapshot-preview1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519" - [[package]] name = "wasi" version = "0.11.1+wasi-snapshot-preview1" diff --git a/Cargo.toml b/Cargo.toml index 8dd68902a..db8c5fa95 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -187,8 +187,8 @@ hashbrown = "0.17" heck = "0.5" hex = "0.4" hex-literal = "0.4" -hickory-client = "0.24" -hickory-server = "0.24" +hickory-proto = "0.26" +hickory-server = "0.26" hmac = "0.12" http = "1.3" hyper = "1.7" @@ -215,7 +215,6 @@ oneshot = "0.1" parity-scale-codec = "3.7" parking_lot = "0.12" paste = "1.0" -probabilistic-collections = "0.7" proc-macro2 = "1.0" proptest = "1.11" qrcodegen = "1.8" @@ -365,3 +364,8 @@ ledger-proto = { git = "https://github.com/ledger-community/rust-ledger.git", re # Note that the fix is needed for the Ledger app, but we have to use the same version of parity-scale-codec # across Trezor, Ledger, mintlayer-core and mintlayer-core-primitives repos. parity-scale-codec = { git = "https://github.com/paritytech/parity-scale-codec.git", rev = "5021525697edc0661591ebc71392c48d950a10b0" } +# Fork of iced_glyphon 0.6.0 with the lru dependency upgraded to 0.16.3 to pick up the fix +# for RUSTSEC-2026-0002 ("IterMut violates Stacked Borrows by invalidating internal pointer"). +# Upstream has replaced the crate with "cryoglyph" in unreleased iced 0.15, so there is no +# upstream release with the fix. Drop this patch once iced ships one. +iced_glyphon = { git = "https://github.com/mintlayer/iced-glyphon", rev = "acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1" } diff --git a/dns-server/Cargo.toml b/dns-server/Cargo.toml index 1fd38803b..83d08bcc2 100644 --- a/dns-server/Cargo.toml +++ b/dns-server/Cargo.toml @@ -28,7 +28,7 @@ itertools.workspace = true parity-scale-codec.workspace = true thiserror.workspace = true tokio = { workspace = true, default-features = false } -hickory-client.workspace = true +hickory-proto.workspace = true hickory-server.workspace = true [dev-dependencies] diff --git a/dns-server/src/config.rs b/dns-server/src/config.rs index 7d06fc60d..9617f27a3 100644 --- a/dns-server/src/config.rs +++ b/dns-server/src/config.rs @@ -19,7 +19,7 @@ use std::{ }; use clap::Parser; -use hickory_client::rr::Name; +use hickory_proto::rr::Name; use common::primitives::per_thousand::PerThousand; use utils::{app_version_with_git_info, clap_utils, root_user::ForceRunAsRootOptions}; diff --git a/dns-server/src/dns_server/mod.rs b/dns-server/src/dns_server/mod.rs index bf1e4a916..558d64d04 100644 --- a/dns-server/src/dns_server/mod.rs +++ b/dns-server/src/dns_server/mod.rs @@ -22,21 +22,16 @@ use std::{ }; use futures::never::Never; -use hickory_client::{ - proto::rr::{LowerName, RrKey}, - rr::{ - Name, RData, RecordSet, RecordType, - rdata::{NS, SOA}, - }, +use hickory_proto::rr::{ + LowerName, Name, RData, RecordSet, RecordType, RrKey, + rdata::{NS, SOA}, }; use hickory_server::{ - ServerFuture, - authority::{ - AuthLookup, Authority, Catalog, LookupError, LookupOptions, MessageRequest, UpdateResult, - ZoneType, + server::{Request, RequestInfo, Server}, + store::in_memory::InMemoryZoneHandler, + zone_handler::{ + AuthLookup, AxfrPolicy, Catalog, LookupControlFlow, LookupOptions, ZoneHandler, ZoneType, }, - server::RequestInfo, - store::in_memory::InMemoryAuthority, }; use itertools::Itertools; use tokio::{net::UdpSocket, sync::mpsc}; @@ -61,7 +56,7 @@ pub enum DnsServerCommand { pub struct DnsServer { auth: Arc, - server: ServerFuture, + server: Server, cmd_rx: mpsc::UnboundedReceiver, } @@ -91,7 +86,8 @@ impl DnsServer { chain_config: Arc, cmd_rx: mpsc::UnboundedReceiver, ) -> crate::Result { - let inner = InMemoryAuthority::empty(config.host.clone(), ZoneType::Primary, false); + let inner = + InMemoryZoneHandler::empty(config.host.clone(), ZoneType::Primary, AxfrPolicy::Deny); let auth = Arc::new(AuthorityImpl { config: AuthorityImplConfig::from_dns_server_config(&config), @@ -102,11 +98,13 @@ impl DnsServer { ipv6_addrs: Default::default(), }); + let handlers: Vec> = vec![Arc::clone(&auth) as _]; + let mut catalog = Catalog::new(); - catalog.upsert(config.host.clone().into(), Box::new(Arc::clone(&auth))); + catalog.upsert(config.host.clone().into(), handlers); - let mut server = ServerFuture::new(catalog); + let mut server = Server::new(catalog); for bind_addr in config.bind_addr.iter() { let udp_socket = UdpSocket::bind(bind_addr).await?; @@ -136,10 +134,12 @@ impl DnsServer { "Cmd handling loop", ); - server.block_until_done().await?; + if let Err(err) = server.block_until_done().await { + log::error!("Hickory DNS server terminated with an error: {err}"); + } Err(DnsServerError::Other( - "trust_dns_server terminated unexpectedly", + "hickory DNS server terminated unexpectedly", )) } } @@ -176,7 +176,7 @@ struct AuthorityImpl { chain_config: Arc, config: AuthorityImplConfig, serial: RelaxedAtomicU32, - inner: InMemoryAuthority, + inner: InMemoryZoneHandler, ipv4_addrs: Mutex>, ipv6_addrs: Mutex>, } @@ -356,19 +356,13 @@ impl AuthorityImpl { } #[async_trait::async_trait] -impl Authority for AuthorityImpl { - type Lookup = AuthLookup; - +impl ZoneHandler for AuthorityImpl { fn zone_type(&self) -> ZoneType { self.inner.zone_type() } - fn is_axfr_allowed(&self) -> bool { - self.inner.is_axfr_allowed() - } - - async fn update(&self, update: &MessageRequest) -> UpdateResult { - self.inner.update(update).await + fn axfr_policy(&self) -> AxfrPolicy { + self.inner.axfr_policy() } fn origin(&self) -> &LowerName { @@ -379,8 +373,9 @@ impl Authority for AuthorityImpl { &self, name: &LowerName, query_type: RecordType, + request_info: Option<&RequestInfo<'_>>, lookup_options: LookupOptions, - ) -> Result { + ) -> LookupControlFlow { log::trace!( "In lookup for {:?}, query_type = {:?}, lookup_options = {:?}", name, @@ -388,32 +383,32 @@ impl Authority for AuthorityImpl { lookup_options ); self.refresh().await; - self.inner.lookup(name, query_type, lookup_options).await + self.inner.lookup(name, query_type, request_info, lookup_options).await } async fn search( &self, - request_info: RequestInfo<'_>, + request: &Request, lookup_options: LookupOptions, - ) -> Result { + ) -> (LookupControlFlow, Option) { log::trace!( "In search, src = {:?}, protocol = {:?}, header = {:?}, query = {:?}, lookup_options = {:?}", - request_info.src, - request_info.protocol, - request_info.header, - request_info.query, + request.src(), + request.protocol(), + request.metadata, + request.queries, lookup_options ); self.refresh().await; - self.inner.search(request_info, lookup_options).await + self.inner.search(request, lookup_options).await } - async fn get_nsec_records( + async fn nsec_records( &self, name: &LowerName, lookup_options: LookupOptions, - ) -> Result { - self.inner.get_nsec_records(name, lookup_options).await + ) -> LookupControlFlow { + self.inner.nsec_records(name, lookup_options).await } } diff --git a/dns-server/src/dns_server/tests.rs b/dns-server/src/dns_server/tests.rs index 57b8f2474..5cf15eb4c 100644 --- a/dns-server/src/dns_server/tests.rs +++ b/dns-server/src/dns_server/tests.rs @@ -19,10 +19,10 @@ use std::{ sync::Arc, }; -use hickory_client::rr::{RData, RecordType}; +use hickory_proto::rr::{RData, RecordType}; use hickory_server::{ - authority::{Authority, ZoneType}, - store::in_memory::InMemoryAuthority, + store::in_memory::InMemoryZoneHandler, + zone_handler::{AxfrPolicy, LookupOptions, ZoneHandler, ZoneType}, }; use common::{ @@ -61,7 +61,8 @@ async fn dns_server_basic() { version: SemVer::new(1, 2, 3), }; - let inner = InMemoryAuthority::empty(host.clone(), ZoneType::Primary, false); + let inner = + InMemoryZoneHandler::empty(host.clone(), ZoneType::Primary, AxfrPolicy::Deny); let auth = AuthorityImpl { config, @@ -83,26 +84,36 @@ async fn dns_server_basic() { assert_eq!(auth.ipv6_addrs.lock().unwrap().len(), 1); let result_a = auth - .lookup(&host.clone().into(), RecordType::A, Default::default()) + .lookup( + &host.clone().into(), + RecordType::A, + None, + LookupOptions::default(), + ) .await - .unwrap() + .expect("lookup must not fail") .unwrap_records() .iter() .cloned() .collect::>(); assert_eq!(result_a.len(), 1); - assert_eq!(result_a[0].data(), Some(&RData::A(ip1.into()))); + assert_eq!(result_a[0].data, RData::A(ip1.into())); let result_aaaa = auth - .lookup(&host.clone().into(), RecordType::AAAA, Default::default()) + .lookup( + &host.clone().into(), + RecordType::AAAA, + None, + LookupOptions::default(), + ) .await - .unwrap() + .expect("lookup must not fail") .unwrap_records() .iter() .cloned() .collect::>(); assert_eq!(result_aaaa.len(), 1); - assert_eq!(result_aaaa[0].data(), Some(&RData::AAAA(ip2.into()))); + assert_eq!(result_aaaa[0].data, RData::AAAA(ip2.into())); handle_command(&auth, DnsServerCommand::DelAddress(ip1.into())); handle_command(&auth, DnsServerCommand::DelAddress(ip2.into())); @@ -145,7 +156,11 @@ mod same_software_version_addr_selection_test { }; let cur_soft_info = SoftwareInfo::current(&chain_config); - let inner = InMemoryAuthority::empty(config.host.clone(), ZoneType::Primary, false); + let inner = InMemoryZoneHandler::empty( + config.host.clone(), + ZoneType::Primary, + AxfrPolicy::Deny, + ); let auth = AuthorityImpl { config, chain_config: Arc::clone(&chain_config), @@ -170,7 +185,7 @@ mod same_software_version_addr_selection_test { let selected_v4_addrs = records[0] .1 .records_without_rrsigs() - .map(|rec| assert_matches_return_val!(rec.data(), Some(&RData::A(a)), a.0)) + .map(|rec| assert_matches_return_val!(&rec.data, RData::A(a), a.0)) .collect::>(); assert_eq!( selected_v4_addrs.len(), @@ -188,7 +203,7 @@ mod same_software_version_addr_selection_test { let selected_v6_addrs = records[1] .1 .records_without_rrsigs() - .map(|rec| assert_matches_return_val!(rec.data(), Some(&RData::AAAA(a)), a.0)) + .map(|rec| assert_matches_return_val!(&rec.data, RData::AAAA(a), a.0)) .collect::>(); assert_eq!( selected_v6_addrs.len(), diff --git a/dns-server/src/error.rs b/dns-server/src/error.rs index c48cdd854..8780068d8 100644 --- a/dns-server/src/error.rs +++ b/dns-server/src/error.rs @@ -15,7 +15,7 @@ use std::net::AddrParseError; -use hickory_client::proto::error::ProtoError; +use hickory_proto::ProtoError; use p2p::{error::P2pError, peer_manager::peerdb_common}; use thiserror::Error; use utils::try_as::TryAsRef; diff --git a/utils/Cargo.toml b/utils/Cargo.toml index 07bf8959a..e53e75b3c 100644 --- a/utils/Cargo.toml +++ b/utils/Cargo.toml @@ -21,7 +21,7 @@ fixed-hash.workspace = true heck.workspace = true num-traits.workspace = true parity-scale-codec.workspace = true -probabilistic-collections.workspace = true +siphasher.workspace = true qrcodegen.workspace = true slave-pool.workspace = true thiserror.workspace = true diff --git a/utils/src/bloom_filters/bloom_filter.rs b/utils/src/bloom_filters/bloom_filter.rs index 4577b9dc2..0dd3c3ec2 100644 --- a/utils/src/bloom_filters/bloom_filter.rs +++ b/utils/src/bloom_filters/bloom_filter.rs @@ -13,14 +13,39 @@ // See the License for the specific language governing permissions and // limitations under the License. -use std::{fmt::Debug, hash::Hash}; - -use probabilistic_collections::SipHasherBuilder; +use std::{ + fmt::Debug, + hash::{Hash, Hasher}, + marker::PhantomData, +}; use randomness::{Rng, RngExt as _}; +use siphasher::sip::SipHasher13; /// A space-efficient probabilistic data structure to test for membership in a set. -pub struct BloomFilter(probabilistic_collections::bloom::BloomFilter); +/// +/// Items can be added, but never removed. `contains` never produces false negatives, +/// but may produce false positives with a probability of at most `fpp` for filters +/// that contain no more than `size` items. +/// +/// We used to depend on the `probabilistic_collections` crate here, but it is +/// abandoned (and pulls in the vulnerable `rand` 0.7), so this is a minimal +/// reimplementation of the functionality that we need. +pub struct BloomFilter { + /// The bit array, storing `bit_count` bits + bits: Vec, + + /// The number of bits in the bit array (commonly denoted as `m`) + bit_count: usize, + + /// The number of hash functions (commonly denoted as `k`) + hash_count: u32, + + /// The pair of hashers used to derive the item indices (Kirsch-Mitzenmacher scheme) + hashers: [SipHasher13; 2], + + _phantom: PhantomData, +} impl BloomFilter { /// Constructs a new, empty `BloomFilter` with an estimated max capacity of `size` items, @@ -28,31 +53,71 @@ impl BloomFilter { pub fn new(size: usize, fpp: f64, rng: &mut impl Rng) -> Self { assert!(size > 0); assert!(fpp > 0.0 && fpp < 1.0); - Self( - probabilistic_collections::bloom::BloomFilter::::with_hashers( - size, - fpp, - [ - SipHasherBuilder::from_seed(rng.random(), rng.random()), - SipHasherBuilder::from_seed(rng.random(), rng.random()), - ], - ), - ) + + // The optimal number of bits per item: -log2(fpp) / (ln(2)^2) + #[allow(clippy::float_arithmetic)] + let (bit_count, hash_count) = { + let ln2 = std::f64::consts::LN_2; + let bit_count = -((size as f64) * fpp.ln()) / (ln2 * ln2); + let hash_count = ((bit_count / size as f64) * ln2).round(); + + ( + bit_count.ceil() as usize, + // Round down but ensure that there is at least one hash function. + std::cmp::max(hash_count as u32, 1), + ) + }; + + Self { + bits: vec![0; bit_count.div_ceil(u64::BITS as usize)], + bit_count, + hash_count, + hashers: [ + SipHasher13::new_with_keys(rng.random(), rng.random()), + SipHasher13::new_with_keys(rng.random(), rng.random()), + ], + _phantom: PhantomData, + } + } + + fn indices(&self, value: &T) -> impl Iterator + '_ { + let hashes: [u64; 2] = { + let mut hash1 = self.hashers[0]; + let mut hash2 = self.hashers[1]; + value.hash(&mut hash1); + value.hash(&mut hash2); + [hash1.finish(), hash2.finish()] + }; + + let bit_count = self.bit_count as u64; + (0..self.hash_count).map(move |i| { + // The Kirsch-Mitzenmacher scheme: h1 + i*h2 + i^2, modulo the number of bits. + // 128-bit arithmetic is used to avoid overflows. + let idx = (hashes[0] as u128) + .wrapping_add((i as u128) * (hashes[1] as u128)) + .wrapping_add((i as u128) * (i as u128)); + (idx % bit_count as u128) as usize + }) } /// Inserts an element into the bloom filter pub fn insert(&mut self, value: &T) { - self.0.insert(value); + let indices: Vec = self.indices(value).collect(); + for idx in indices { + self.bits[idx / u64::BITS as usize] |= 1 << (idx % u64::BITS as usize); + } } /// Checks if an element is possibly in the bloom filter pub fn contains(&self, value: &T) -> bool { - self.0.contains(value) + self.indices(value).all(|idx| { + self.bits[idx / u64::BITS as usize] & (1 << (idx % u64::BITS as usize)) != 0 + }) } /// Clears the bloom filter, removing all elements pub fn clear(&mut self) { - self.0.clear(); + self.bits.fill(0); } } @@ -61,3 +126,100 @@ impl Debug for BloomFilter { f.debug_tuple("BloomFilter").finish() } } + +#[cfg(test)] +mod tests { + use test_utils::random::Seed; + + use super::BloomFilter; + + #[rstest::rstest] + #[trace] + #[case(Seed::from_entropy())] + fn no_false_negatives(#[case] seed: Seed) { + let mut rng = test_utils::random::make_seedable_rng(seed); + let mut filter = BloomFilter::::new(1000, 0.001, &mut rng); + + for i in 0..1000u64 { + filter.insert(&i); + } + + for i in 0..1000u64 { + assert!(filter.contains(&i), "false negative for {i}"); + } + } + + #[rstest::rstest] + #[trace] + #[case(Seed::from_entropy())] + fn false_positive_rate(#[case] seed: Seed) { + let mut rng = test_utils::random::make_seedable_rng(seed); + let mut filter = BloomFilter::::new(1000, 0.001, &mut rng); + + for i in 0..1000u64 { + filter.insert(&i); + } + + // Check 100k items that were never inserted and count the false positives. + // The expected number is about 100; the sanity bounds are generous. + let mut false_positives = 0; + for i in 10_000u64..110_000 { + if filter.contains(&i) { + false_positives += 1; + } + } + assert!( + false_positives > 10 && false_positives < 300, + "invalid number of false positives: {false_positives}" + ); + } + + #[rstest::rstest] + #[trace] + #[case(Seed::from_entropy())] + fn clear(#[case] seed: Seed) { + let mut rng = test_utils::random::make_seedable_rng(seed); + let mut filter = BloomFilter::::new(100, 0.01, &mut rng); + + for i in 0..100u64 { + filter.insert(&i); + } + + filter.clear(); + + // After clearing, most items must be reported as absent. Note that a bloom + // filter cannot guarantee this for previously inserted items, but a cleared + // (all-zero) filter must not report any false positives at all. + assert!(filter.bits.iter().all(|&word| word == 0)); + for i in 0..100u64 { + assert!(!filter.contains(&i)); + } + } + + #[rstest::rstest] + #[trace] + #[case(Seed::from_entropy())] + fn randomized_hash_keys(#[case] seed: Seed) { + // Two filters constructed with different rng states must not share hash keys, + // otherwise persistent false positives would plague long-lived filters. + let mut rng = test_utils::random::make_seedable_rng(seed); + let filter1 = BloomFilter::::new(100, 0.01, &mut rng); + let filter2 = BloomFilter::::new(100, 0.01, &mut rng); + + assert_ne!( + filter1.indices(&12345u64).collect::>(), + filter2.indices(&12345u64).collect::>(), + ); + } + + #[test] + fn deterministic_behavior() { + // The same item must always map to the same indices within a given filter. + let mut rng = randomness::make_pseudo_rng(); + let mut filter = BloomFilter::::new(100, 0.01, &mut rng); + filter.insert(&"hello".to_owned()); + + assert!(filter.contains(&"hello".to_owned())); + assert!(!filter.contains(&"world".to_owned())); + } +} From 08348363c66b32d865c66835b622147ee680ee03 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Mon, 14 Sep 2026 22:45:16 +0400 Subject: [PATCH 6/7] Address OCR review findings - Propagate the hickory server termination error instead of logging it - Document that dynamic DNS updates stay rejected (ZoneHandler default) - Remove the per-insert allocation in the bloom filter hot path - Import TSigResponseContext instead of an inline path - Refresh imports.lock and prune 7 exemptions that vendor audits now cover --- dns-server/src/dns_server/mod.rs | 13 +-- dns-server/src/dns_server/tests.rs | 10 +-- dns-server/src/error.rs | 4 + dns-server/src/main.rs | 1 + supply-chain/config.toml | 97 +++++++++------------- supply-chain/imports.lock | 104 ++++++++---------------- utils/src/bloom_filters/bloom_filter.rs | 39 ++++++--- 7 files changed, 115 insertions(+), 153 deletions(-) diff --git a/dns-server/src/dns_server/mod.rs b/dns-server/src/dns_server/mod.rs index 558d64d04..abbb967a6 100644 --- a/dns-server/src/dns_server/mod.rs +++ b/dns-server/src/dns_server/mod.rs @@ -23,7 +23,7 @@ use std::{ use futures::never::Never; use hickory_proto::rr::{ - LowerName, Name, RData, RecordSet, RecordType, RrKey, + LowerName, Name, RData, RecordSet, RecordType, RrKey, TSigResponseContext, rdata::{NS, SOA}, }; use hickory_server::{ @@ -134,9 +134,7 @@ impl DnsServer { "Cmd handling loop", ); - if let Err(err) = server.block_until_done().await { - log::error!("Hickory DNS server terminated with an error: {err}"); - } + server.block_until_done().await?; Err(DnsServerError::Other( "hickory DNS server terminated unexpectedly", @@ -171,7 +169,7 @@ impl AuthorityImplConfig { } } -/// Wrapper for InMemoryAuthority that selects random addresses every second +/// Wrapper for InMemoryZoneHandler that selects random addresses every second struct AuthorityImpl { chain_config: Arc, config: AuthorityImplConfig, @@ -355,6 +353,9 @@ impl AuthorityImpl { } } +/// Note: dynamic DNS updates (RFC 2136) are not supported. The `ZoneHandler::update` +/// default implementation responds with `NotImplemented`, which preserves the behavior +/// of the previous hickory 0.24-based code. #[async_trait::async_trait] impl ZoneHandler for AuthorityImpl { fn zone_type(&self) -> ZoneType { @@ -390,7 +391,7 @@ impl ZoneHandler for AuthorityImpl { &self, request: &Request, lookup_options: LookupOptions, - ) -> (LookupControlFlow, Option) { + ) -> (LookupControlFlow, Option) { log::trace!( "In search, src = {:?}, protocol = {:?}, header = {:?}, query = {:?}, lookup_options = {:?}", request.src(), diff --git a/dns-server/src/dns_server/tests.rs b/dns-server/src/dns_server/tests.rs index 5cf15eb4c..892fa72a8 100644 --- a/dns-server/src/dns_server/tests.rs +++ b/dns-server/src/dns_server/tests.rs @@ -61,8 +61,7 @@ async fn dns_server_basic() { version: SemVer::new(1, 2, 3), }; - let inner = - InMemoryZoneHandler::empty(host.clone(), ZoneType::Primary, AxfrPolicy::Deny); + let inner = InMemoryZoneHandler::empty(host.clone(), ZoneType::Primary, AxfrPolicy::Deny); let auth = AuthorityImpl { config, @@ -156,11 +155,8 @@ mod same_software_version_addr_selection_test { }; let cur_soft_info = SoftwareInfo::current(&chain_config); - let inner = InMemoryZoneHandler::empty( - config.host.clone(), - ZoneType::Primary, - AxfrPolicy::Deny, - ); + let inner = + InMemoryZoneHandler::empty(config.host.clone(), ZoneType::Primary, AxfrPolicy::Deny); let auth = AuthorityImpl { config, chain_config: Arc::clone(&chain_config), diff --git a/dns-server/src/error.rs b/dns-server/src/error.rs index 8780068d8..364752343 100644 --- a/dns-server/src/error.rs +++ b/dns-server/src/error.rs @@ -16,6 +16,7 @@ use std::net::AddrParseError; use hickory_proto::ProtoError; +use hickory_server::net::NetError; use p2p::{error::P2pError, peer_manager::peerdb_common}; use thiserror::Error; use utils::try_as::TryAsRef; @@ -24,6 +25,8 @@ use utils::try_as::TryAsRef; pub enum DnsServerError { #[error("Proto error: {0}")] ProtoError(#[from] ProtoError), + #[error("Net error: {0}")] + NetError(#[from] NetError), #[error("Parse error: {0}")] AddrParseError(#[from] AddrParseError), #[error("IO error: {0}")] @@ -47,6 +50,7 @@ impl TryAsRef for DnsServerError { fn try_as_ref(&self) -> Option<&storage::Error> { match self { DnsServerError::ProtoError(_) + | DnsServerError::NetError(_) | DnsServerError::AddrParseError(_) | DnsServerError::IoError(_) | DnsServerError::P2pError(_) diff --git a/dns-server/src/main.rs b/dns-server/src/main.rs index d7dd4ae15..98bafc035 100644 --- a/dns-server/src/main.rs +++ b/dns-server/src/main.rs @@ -143,6 +143,7 @@ async fn run(options: DnsServerRunOptions) -> anyhow::Result { open_storage(open_storage_backend(storage_data_dir)) } DnsServerError::ProtoError(_) + | DnsServerError::NetError(_) | DnsServerError::AddrParseError(_) | DnsServerError::IoError(_) | DnsServerError::P2pError(_) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index c3f896bd7..5edc91f9d 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -34,6 +34,9 @@ audit-as-crates-io = true [policy.iced_aw] audit-as-crates-io = true +[policy.iced_glyphon] +audit-as-crates-io = true + [policy.ledger-lib] audit-as-crates-io = true @@ -116,10 +119,6 @@ criteria = "safe-to-deploy" version = "0.4.10" criteria = "safe-to-deploy" -[[exemptions.bincode]] -version = "1.3.3" -criteria = "safe-to-deploy" - [[exemptions.bip39]] version = "2.2.2" criteria = "safe-to-deploy" @@ -288,6 +287,10 @@ criteria = "safe-to-run" version = "0.5.0" criteria = "safe-to-run" +[[exemptions.critical-section]] +version = "1.2.0" +criteria = "safe-to-deploy" + [[exemptions.crypto-common]] version = "0.2.2" criteria = "safe-to-deploy" @@ -476,10 +479,6 @@ criteria = "safe-to-deploy" version = "1.0.0" criteria = "safe-to-deploy" -[[exemptions.endian-type]] -version = "0.1.2" -criteria = "safe-to-deploy" - [[exemptions.enum-iterator]] version = "2.3.0" criteria = "safe-to-deploy" @@ -652,6 +651,10 @@ criteria = "safe-to-deploy" version = "0.2.1" criteria = "safe-to-deploy" +[[exemptions.hickory-net]] +version = "0.26.3" +criteria = "safe-to-deploy" + [[exemptions.hidapi]] version = "2.6.4" criteria = "safe-to-deploy" @@ -680,6 +683,10 @@ criteria = "safe-to-deploy" version = "0.1.1" criteria = "safe-to-deploy" +[[exemptions.iced_glyphon]] +version = "0.6.0@git:acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1" +criteria = "safe-to-deploy" + [[exemptions.impl-trait-for-tuples]] version = "0.2.3" criteria = "safe-to-deploy" @@ -696,10 +703,26 @@ criteria = "safe-to-run" version = "0.19.0" criteria = "safe-to-deploy" +[[exemptions.jni]] +version = "0.22.4" +criteria = "safe-to-deploy" + +[[exemptions.jni-macros]] +version = "0.22.4" +criteria = "safe-to-deploy" + [[exemptions.jni-sys]] version = "0.3.0" criteria = "safe-to-deploy" +[[exemptions.jni-sys]] +version = "0.4.1" +criteria = "safe-to-deploy" + +[[exemptions.jni-sys-macros]] +version = "0.4.1" +criteria = "safe-to-deploy" + [[exemptions.jni-utils]] version = "0.1.1" criteria = "safe-to-deploy" @@ -785,7 +808,7 @@ version = "0.2.1" criteria = "safe-to-deploy" [[exemptions.lru]] -version = "0.12.5" +version = "0.16.4" criteria = "safe-to-deploy" [[exemptions.lyon]] @@ -860,10 +883,6 @@ criteria = "safe-to-deploy" version = "0.6.0+11769913" criteria = "safe-to-deploy" -[[exemptions.nibble_vec]] -version = "0.1.0" -criteria = "safe-to-deploy" - [[exemptions.nix]] version = "0.29.0" criteria = "safe-to-deploy" @@ -916,10 +935,6 @@ criteria = "safe-to-deploy" version = "0.2.2" criteria = "safe-to-deploy" -[[exemptions.objc2-core-graphics]] -version = "0.3.2" -criteria = "safe-to-deploy" - [[exemptions.objc2-core-image]] version = "0.2.2" criteria = "safe-to-deploy" @@ -1028,24 +1043,20 @@ criteria = "safe-to-run" version = "0.4.0" criteria = "safe-to-deploy" -[[exemptions.postgres-protocol]] -version = "0.6.12" -criteria = "safe-to-deploy" - -[[exemptions.postgres-types]] -version = "0.2.14" +[[exemptions.portable-atomic]] +version = "1.15.0" criteria = "safe-to-deploy" [[exemptions.ppv-lite86]] version = "0.2.21" criteria = "safe-to-deploy" -[[exemptions.prettytable-rs]] -version = "0.10.0" +[[exemptions.prefix-trie]] +version = "0.8.4" criteria = "safe-to-deploy" -[[exemptions.probabilistic-collections]] -version = "0.7.0" +[[exemptions.prettytable-rs]] +version = "0.10.0" criteria = "safe-to-deploy" [[exemptions.proc-macro-crate]] @@ -1108,38 +1119,14 @@ criteria = "safe-to-deploy" version = "0.7.0" criteria = "safe-to-deploy" -[[exemptions.radix_trie]] -version = "0.2.1" -criteria = "safe-to-deploy" - -[[exemptions.rand]] -version = "0.7.3" -criteria = "safe-to-deploy" - -[[exemptions.rand_chacha]] -version = "0.2.2" -criteria = "safe-to-deploy" - [[exemptions.rand_chacha]] version = "0.10.0" criteria = "safe-to-deploy" -[[exemptions.rand_core]] -version = "0.5.1" -criteria = "safe-to-deploy" - [[exemptions.rand_core]] version = "0.10.1" criteria = "safe-to-deploy" -[[exemptions.rand_hc]] -version = "0.2.0" -criteria = "safe-to-deploy" - -[[exemptions.rand_xorshift]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.range-alloc]] version = "0.1.4" criteria = "safe-to-deploy" @@ -1320,8 +1307,8 @@ criteria = "safe-to-deploy" version = "0.3.8" criteria = "safe-to-deploy" -[[exemptions.simdutf8]] -version = "0.1.5" +[[exemptions.simd_cesu8]] +version = "1.2.0" criteria = "safe-to-deploy" [[exemptions.slave-pool]] @@ -1432,10 +1419,6 @@ criteria = "safe-to-deploy" version = "1.10.0" criteria = "safe-to-deploy" -[[exemptions.tokio-postgres]] -version = "0.7.18" -criteria = "safe-to-deploy" - [[exemptions.tokio-socks]] version = "0.5.2" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index a0429baa2..7ccea6f8d 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -553,13 +553,6 @@ user-id = 6423 user-login = "zeenix" user-name = "Zeeshan Ali Khan" -[[publisher.enum-as-inner]] -version = "0.6.1" -when = "2024-09-09" -user-id = 1300 -user-login = "bluejekyll" -user-name = "Benjamin Fry" - [[publisher.errno]] version = "0.3.14" when = "2025-09-09" @@ -630,13 +623,6 @@ user-id = 33035 user-login = "taiki-e" user-name = "Taiki Endo" -[[publisher.getrandom]] -version = "0.1.16" -when = "2020-12-31" -user-id = 5059 -user-login = "newpavlov" -user-name = "Artyom Pavlov" - [[publisher.getrandom]] version = "0.2.17" when = "2026-01-11" @@ -711,23 +697,16 @@ user-id = 1588 user-login = "apoelstra" user-name = "Andrew Poelstra" -[[publisher.hickory-client]] -version = "0.24.4" -when = "2025-02-19" -user-id = 1300 -user-login = "bluejekyll" -user-name = "Benjamin Fry" - [[publisher.hickory-proto]] -version = "0.24.4" -when = "2025-02-19" +version = "0.26.3" +when = "2026-09-10" user-id = 1300 user-login = "bluejekyll" user-name = "Benjamin Fry" [[publisher.hickory-server]] -version = "0.24.4" -when = "2025-02-19" +version = "0.26.3" +when = "2026-09-10" user-id = 1300 user-login = "bluejekyll" user-name = "Benjamin Fry" @@ -809,13 +788,6 @@ user-id = 45266 user-login = "hecrj" user-name = "Héctor" -[[publisher.iced_glyphon]] -version = "0.6.0" -when = "2024-09-18" -user-id = 45266 -user-login = "hecrj" -user-name = "Héctor" - [[publisher.iced_graphics]] version = "0.13.0" when = "2024-09-18" @@ -1009,13 +981,6 @@ user-id = 6741 user-login = "Darksonn" user-name = "Alice Ryhl" -[[publisher.md-5]] -version = "0.10.6" -when = "2023-09-22" -user-id = 5059 -user-login = "newpavlov" -user-name = "Artyom Pavlov" - [[publisher.memchr]] version = "2.8.0" when = "2026-02-06" @@ -1234,15 +1199,15 @@ user-login = "tarcieri" user-name = "Tony Arcieri" [[publisher.postgres-protocol]] -version = "0.6.10" -when = "2026-01-14" +version = "0.6.12" +when = "2026-06-12" user-id = 55015 user-login = "paolobarbolini" user-name = "Paolo Barbolini" [[publisher.postgres-types]] -version = "0.2.12" -when = "2026-01-14" +version = "0.2.14" +when = "2026-06-12" user-id = 55015 user-login = "paolobarbolini" user-name = "Paolo Barbolini" @@ -1575,13 +1540,6 @@ user-id = 5059 user-login = "newpavlov" user-name = "Artyom Pavlov" -[[publisher.siphasher]] -version = "0.3.11" -when = "2023-08-23" -user-id = 468 -user-login = "jedisct1" -user-name = "Frank Denis" - [[publisher.siphasher]] version = "1.0.2" when = "2026-01-27" @@ -1702,8 +1660,8 @@ user-login = "Darksonn" user-name = "Alice Ryhl" [[publisher.tokio-postgres]] -version = "0.7.16" -when = "2026-01-14" +version = "0.7.18" +when = "2026-06-12" user-id = 55015 user-login = "paolobarbolini" user-name = "Paolo Barbolini" @@ -1939,13 +1897,6 @@ user-id = 189 user-login = "BurntSushi" user-name = "Andrew Gallant" -[[publisher.wasi]] -version = "0.9.0+wasi-snapshot-preview1" -when = "2019-12-02" -user-id = 6825 -user-login = "sunfishcode" -user-name = "Dan Gohman" - [[publisher.wasi]] version = "0.11.1+wasi-snapshot-preview1" when = "2025-06-10" @@ -2046,13 +1997,6 @@ user-id = 64539 user-login = "kennykerr" user-name = "Kenny Kerr" -[[publisher.windows-core]] -version = "0.62.2" -when = "2025-10-06" -user-id = 64539 -user-login = "kennykerr" -user-name = "Kenny Kerr" - [[publisher.windows-future]] version = "0.2.1" when = "2025-05-15" @@ -4184,11 +4128,6 @@ who = "David Cook " criteria = "safe-to-deploy" version = "0.9.0" -[[audits.isrg.audits.chacha20]] -who = "David Cook " -criteria = "safe-to-deploy" -version = "0.10.0" - [[audits.isrg.audits.cpufeatures]] who = "David Cook " criteria = "safe-to-deploy" @@ -5088,6 +5027,22 @@ https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_so """ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.objc2-core-graphics]] +who = "Andy Leiserson " +criteria = "safe-to-deploy" +version = "0.3.2" +notes = """ +Contains substantial unsafe code, as is typical for FFI. + +The (non-published) `header-translator` crate that produces generated bindings +in this crate was also reviewed, in lieu of a full review of the generated +bindings. + +Users of this crate should be aware of the information in +https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.objc2-encode]] who = "Andy Leiserson " criteria = "safe-to-deploy" @@ -5297,6 +5252,13 @@ criteria = "safe-to-deploy" delta = "1.1.0 -> 1.3.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.simdutf8]] +who = "Henri Sivonen " +criteria = "safe-to-deploy" +version = "0.1.5" +notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.smallvec]] who = "Erich Gubler " criteria = "safe-to-deploy" diff --git a/utils/src/bloom_filters/bloom_filter.rs b/utils/src/bloom_filters/bloom_filter.rs index 0dd3c3ec2..3b991f8db 100644 --- a/utils/src/bloom_filters/bloom_filter.rs +++ b/utils/src/bloom_filters/bloom_filter.rs @@ -80,19 +80,33 @@ impl BloomFilter { } } - fn indices(&self, value: &T) -> impl Iterator + '_ { + fn indices(&self, value: &T) -> impl Iterator { + Self::compute_indices(&self.hashers, self.bit_count, self.hash_count, value) + } + + /// Computes the bit indices for the given value. Takes all the parameters by value or + /// reference to local data (as opposed to borrowing from `self`), so that it can be used + /// while `self.bits` is being mutated without any borrow gymnastics or allocations. + fn compute_indices( + hashers: &[SipHasher13; 2], + bit_count: usize, + hash_count: u32, + value: &T, + ) -> impl Iterator { let hashes: [u64; 2] = { - let mut hash1 = self.hashers[0]; - let mut hash2 = self.hashers[1]; + let mut hash1 = hashers[0]; + let mut hash2 = hashers[1]; value.hash(&mut hash1); value.hash(&mut hash2); [hash1.finish(), hash2.finish()] }; - let bit_count = self.bit_count as u64; - (0..self.hash_count).map(move |i| { - // The Kirsch-Mitzenmacher scheme: h1 + i*h2 + i^2, modulo the number of bits. - // 128-bit arithmetic is used to avoid overflows. + let bit_count = bit_count as u64; + (0..hash_count).map(move |i| { + // Enhanced double hashing: h1 + i*h2 + i^2, modulo the number of bits. + // (The extra quadratic term distinguishes it from the canonical + // Kirsch-Mitzenmacher scheme, which is fine for a bloom filter as long as + // the index mapping is deterministic.) 128-bit arithmetic avoids overflows. let idx = (hashes[0] as u128) .wrapping_add((i as u128) * (hashes[1] as u128)) .wrapping_add((i as u128) * (i as u128)); @@ -102,17 +116,18 @@ impl BloomFilter { /// Inserts an element into the bloom filter pub fn insert(&mut self, value: &T) { - let indices: Vec = self.indices(value).collect(); - for idx in indices { + let hashers = self.hashers; + let bit_count = self.bit_count; + let hash_count = self.hash_count; + for idx in Self::compute_indices(&hashers, bit_count, hash_count, value) { self.bits[idx / u64::BITS as usize] |= 1 << (idx % u64::BITS as usize); } } /// Checks if an element is possibly in the bloom filter pub fn contains(&self, value: &T) -> bool { - self.indices(value).all(|idx| { - self.bits[idx / u64::BITS as usize] & (1 << (idx % u64::BITS as usize)) != 0 - }) + self.indices(value) + .all(|idx| self.bits[idx / u64::BITS as usize] & (1 << (idx % u64::BITS as usize)) != 0) } /// Clears the bloom filter, removing all elements From c8adf0016e488bcc709993d564213647d88fbdf1 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Tue, 15 Sep 2026 00:36:07 +0400 Subject: [PATCH 7/7] Address OCR review findings (round 2) - Reword the bloom filter FPP guarantee (approximately, not at most) - Fix the misleading 'round down' comment (round() rounds to nearest) - Make the dynamic DNS update comment accurate (NotImplemented is a stricter rejection than the old indirect rejection) - Restore alphabetical ordering of utils dependencies --- dns-server/src/dns_server/mod.rs | 6 ++++-- utils/Cargo.toml | 2 +- utils/src/bloom_filters/bloom_filter.rs | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/dns-server/src/dns_server/mod.rs b/dns-server/src/dns_server/mod.rs index abbb967a6..c214e3093 100644 --- a/dns-server/src/dns_server/mod.rs +++ b/dns-server/src/dns_server/mod.rs @@ -354,8 +354,10 @@ impl AuthorityImpl { } /// Note: dynamic DNS updates (RFC 2136) are not supported. The `ZoneHandler::update` -/// default implementation responds with `NotImplemented`, which preserves the behavior -/// of the previous hickory 0.24-based code. +/// default implementation responds with `NotImplemented`, which is a stricter rejection +/// than the previous hickory 0.24-based code (which delegated to `InMemoryAuthority`'s +/// RFC 2136 processing and only rejected updates indirectly, for the lack of any +/// configured signature keys). A public seed node must never accept updates. #[async_trait::async_trait] impl ZoneHandler for AuthorityImpl { fn zone_type(&self) -> ZoneType { diff --git a/utils/Cargo.toml b/utils/Cargo.toml index e53e75b3c..eac3709fe 100644 --- a/utils/Cargo.toml +++ b/utils/Cargo.toml @@ -21,8 +21,8 @@ fixed-hash.workspace = true heck.workspace = true num-traits.workspace = true parity-scale-codec.workspace = true -siphasher.workspace = true qrcodegen.workspace = true +siphasher.workspace = true slave-pool.workspace = true thiserror.workspace = true tokio = { workspace = true, default-features = false, features = ["macros", "rt", "sync", "tracing"] } diff --git a/utils/src/bloom_filters/bloom_filter.rs b/utils/src/bloom_filters/bloom_filter.rs index 3b991f8db..129ff44f1 100644 --- a/utils/src/bloom_filters/bloom_filter.rs +++ b/utils/src/bloom_filters/bloom_filter.rs @@ -25,7 +25,7 @@ use siphasher::sip::SipHasher13; /// A space-efficient probabilistic data structure to test for membership in a set. /// /// Items can be added, but never removed. `contains` never produces false negatives, -/// but may produce false positives with a probability of at most `fpp` for filters +/// but may produce false positives with a probability of approximately `fpp` for filters /// that contain no more than `size` items. /// /// We used to depend on the `probabilistic_collections` crate here, but it is @@ -63,7 +63,7 @@ impl BloomFilter { ( bit_count.ceil() as usize, - // Round down but ensure that there is at least one hash function. + // Round to the nearest integer, but ensure at least one hash function. std::cmp::max(hash_count as u32, 1), ) };