Repository navigation
fix: update TLS and Tokio security patches - #3
Open
MudassarTariq wants to merge 1 commit into
Open
MudassarTariq wants to merge 1 commit into
MudassarTariq wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The released lockfile contains affected rustls, rustls-webpki, webpki-roots and Tokio versions. Refresh rustls to 0.23.46, rustls-webpki to 0.103.16, webpki-roots to 1.0.11 and Tokio to 1.51.6. The roots update includes the additional eMudhra root removals released on October 23. Keep reqwest 0.12.28 and the production client implementation unchanged.
Add local TLS tests covering rejection of an untrusted certificate, successful verified TLS with an explicitly trusted test certificate, response bodies and repeated response headers. Certificate generation and the server dependency are confined to dev-dependencies. Add an opt-in live test that verifies the real API's TLS connection and HTTP 401 mapping with an intentionally invalid key; it needs no customer credential. Add Linux and Windows test/build/package CI for Rust 1.88 and stable.
Validation on macOS arm64:
Applications must update their own Cargo.lock and rebuild; updating a library lockfile does not repair existing downstream locks or binaries. The README includes the update command and patched versions. Authenticated successful single/bulk live lookups were not run. Linux and Windows results are provided by the new CI checks.
References: rustls 0.23.46, webpki certificate distrust, webpki-roots 1.0.11, Tokio I/O safety.