fix: tier 1 security & stability patches (RUSTSEC + agent panic + rbw edit) - #2
Merged
Merged
Conversation
- Bump bytes 1.11.0 → 1.12.1 (RUSTSEC-2026-0007) and rustls-webpki 0.103.8 → 0.103.13 (RUSTSEC-2026-0049), Cargo.lock only — no Cargo.toml changes (upstream PR doy#325) - Replace .unwrap() with log::warn!() in agent error-send path so a broken pipe when the client disconnects mid-pinentry no longer silently panics the tokio task (upstream PR doy#332) - Add BITWARDEN_CLIENT_VERSION constant to src/api.rs and apply it consistently across all request paths including the cipher-update blocking client that was causing "rbw edit" to fail (upstream PR doy#328); extended to our prelogin_blocking() and server_config() calls
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RUSTSEC-2026-0007andRUSTSEC-2026-0049doy/rbw#325): Cargo.lock-only bumps to clear active advisories —bytes1.11.0→1.12.1 (RUSTSEC-2026-0007) andrustls-webpki0.103.8→0.103.13 (RUSTSEC-2026-0049). No direct dependency changes..unwrap()withlog::warn!()in the agent's error-send path. When a client disconnects mid-pinentry the agent no longer silently crashes with an opaque "EOF while parsing" error on the client side.BITWARDEN_CLIENT_VERSIONconstant and apply it to all request paths. The missing header on the cipher-update blocking client was causingrbw editto fail with "Cannot edit item. Update to the latest version of Bitwarden." Also extended to ourprelogin_blocking()andserver_config()calls added in the rbw-doctor change.Test plan
cargo checkclean (done locally)rbw editno longer returns "Cannot edit item" on a modern Bitwarden/Vaultwarden server