Skip to content

fix(deps): update tracing-subscriber to 0.3.20 (low CVE-2025-58160)#216

Merged
louisliu2048 merged 1 commit intomainfrom
fix/security-tracing-subscriber-3
Mar 20, 2026
Merged

fix(deps): update tracing-subscriber to 0.3.20 (low CVE-2025-58160)#216
louisliu2048 merged 1 commit intomainfrom
fix/security-tracing-subscriber-3

Conversation

@github-actions
Copy link
Contributor

Description

Bumps tracing-subscriber to resolve a low severity vulnerability.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)

Security Alert

Change

Raised the minimum version floor for tracing-subscriber in crates/builder/Cargo.toml from 0.3.18 to 0.3.20. The lock file already resolved to 0.3.22 so this is a no-op at build time, but it encodes the safe minimum and prevents any future cargo update from selecting a version below the patched threshold.

Note: a second instance of tracing-subscriber 0.2.25 exists in the lock file as a transitive dependency of ark-relations 0.5.1 (which requires ^0.2). That instance cannot be updated to the 0.3.x line without an upstream change to ark-relations and is outside the scope of this PR.

Checklist

  • I have reviewed the relevant code guidelines in the docs/ folder
  • My code follows the coding standards of this project
  • I have performed a self-review of my own code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@louisliu2048 louisliu2048 merged commit 7068d36 into main Mar 20, 2026
6 checks passed
@Vui-Chee Vui-Chee deleted the fix/security-tracing-subscriber-3 branch March 20, 2026 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants