diff --git a/Cargo.lock b/Cargo.lock index 1152f33..1cb8fd2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -380,7 +380,7 @@ dependencies = [ "bitflags", "cexpr", "clang-sys", - "itertools 0.12.1", + "itertools", "lazy_static", "lazycell", "log", @@ -394,24 +394,6 @@ dependencies = [ "which", ] -[[package]] -name = "bindgen" -version = "0.72.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895" -dependencies = [ - "bitflags", - "cexpr", - "clang-sys", - "itertools 0.13.0", - "proc-macro2", - "quote", - "regex", - "rustc-hash 2.1.2", - "shlex 1.3.0", - "syn 2.0.117", -] - [[package]] name = "bitflags" version = "2.11.0" @@ -1011,7 +993,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -1540,7 +1522,7 @@ dependencies = [ "http", "hyper", "hyper-util", - "rustls 0.23.37", + "rustls 0.23.45", "rustls-pki-types", "tokio", "tokio-rustls 0.26.4", @@ -1834,15 +1816,6 @@ dependencies = [ "either", ] -[[package]] -name = "itertools" -version = "0.13.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186" -dependencies = [ - "either", -] - [[package]] name = "itoa" version = "1.0.18" @@ -2331,7 +2304,7 @@ dependencies = [ "mysql_common 0.37.3", "percent-encoding", "rand 0.10.0", - "rustls 0.23.37", + "rustls 0.23.45", "serde", "socket2", "thiserror 2.0.18", @@ -2351,7 +2324,7 @@ checksum = "478b0ff3f7d67b79da2b96f56f334431aef65e15ba4b29dd74a4236e29582bdc" dependencies = [ "base64 0.21.7", "bigdecimal", - "bindgen 0.72.1", + "bindgen", "bitflags", "bitvec", "btoi 0.4.3", @@ -2510,8 +2483,7 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" [[package]] name = "opensrv-mysql" version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4148ab944991b0a33be74d2636a815268974578812a9e4cf7dc785325e858154" +source = "git+https://github.com/ephpm/opensrv-mysql.git?rev=42efd446ba867066c94bcf13d31b3b3fec53ec61#42efd446ba867066c94bcf13d31b3b3fec53ec61" dependencies = [ "async-trait", "byteorder", @@ -2520,7 +2492,7 @@ dependencies = [ "nom", "pin-project-lite", "tokio", - "tokio-rustls 0.25.0", + "tokio-rustls 0.26.4", ] [[package]] @@ -2796,7 +2768,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf" dependencies = [ "anyhow", - "itertools 0.13.0", + "itertools", "proc-macro2", "quote", "syn 2.0.117", @@ -2844,7 +2816,7 @@ dependencies = [ "quinn-proto", "quinn-udp", "rustc-hash 2.1.2", - "rustls 0.23.37", + "rustls 0.23.45", "socket2", "thiserror 2.0.18", "tokio", @@ -2864,7 +2836,7 @@ dependencies = [ "rand 0.9.2", "ring", "rustc-hash 2.1.2", - "rustls 0.23.37", + "rustls 0.23.45", "rustls-pki-types", "slab", "thiserror 2.0.18", @@ -3102,7 +3074,7 @@ dependencies = [ "percent-encoding", "pin-project-lite", "quinn", - "rustls 0.23.37", + "rustls 0.23.45", "rustls-pki-types", "serde", "serde_json", @@ -3259,7 +3231,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.12.1", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -3276,23 +3248,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.22.4" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432" -dependencies = [ - "log", - "ring", - "rustls-pki-types", - "rustls-webpki 0.102.8", - "subtle", - "zeroize", -] - -[[package]] -name = "rustls" -version = "0.23.37" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "log", @@ -3345,17 +3303,6 @@ dependencies = [ "untrusted 0.9.0", ] -[[package]] -name = "rustls-webpki" -version = "0.102.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9" -dependencies = [ - "ring", - "rustls-pki-types", - "untrusted 0.9.0", -] - [[package]] name = "rustls-webpki" version = "0.103.14" @@ -3824,7 +3771,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix 1.1.4", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -4033,24 +3980,13 @@ dependencies = [ "tokio", ] -[[package]] -name = "tokio-rustls" -version = "0.25.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f" -dependencies = [ - "rustls 0.22.4", - "rustls-pki-types", - "tokio", -] - [[package]] name = "tokio-rustls" version = "0.26.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" dependencies = [ - "rustls 0.23.37", + "rustls 0.23.45", "tokio", ] @@ -4352,7 +4288,7 @@ version = "0.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "18c1dc1c0304348c39b97bc6b27cdcb1d7292454ebd0de0f30b5ee3a4c61f9bb" dependencies = [ - "bindgen 0.69.5", + "bindgen", "env_logger", "parking_lot", "tracing", @@ -4403,7 +4339,7 @@ version = "0.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d48cb47d056c3ec567745761fa6f832358ca30ef9eb0435fdcfb77c558e70089" dependencies = [ - "bindgen 0.69.5", + "bindgen", "env_logger", "genawaiter", "parking_lot", @@ -4778,7 +4714,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 2c506af..bf74e0f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -114,3 +114,19 @@ mysql_async = { version = "0.37", default-features = false, features = ["rustls- tokio-postgres = { version = "0.7", default-features = false, features = ["runtime"] } tiberius = { version = "0.12", default-features = false, features = ["rustls"] } tokio-util = { version = "0.7", features = ["compat"] } + +# SECURITY (RUSTSEC-2026-0285): opensrv-mysql 0.7.0 (crates.io, latest) pulls +# tokio-rustls 0.25 -> rustls 0.22, which is affected. There is no fixed +# crates.io release. Redirect opensrv-mysql at the ePHPm fork of 0.7.0, whose +# only change is tokio-rustls 0.25 -> 0.26 (rustls >= 0.23.45) pinned to the +# aws-lc-rs crypto provider (never `ring`). The `tls` feature and its +# auth-load-bearing `init_after_ssl` re-parse (#32) are byte-for-byte upstream. +# +# NOTE: this [patch] is honoured for litewire's OWN builds only. A patch does +# not propagate through a git dependency, so a downstream consumer (ePHPm) +# must declare the SAME patch in its own root Cargo.toml. +# +# Retire this patch when a fixed opensrv-mysql is published to crates.io, or +# when litewire migrates off opensrv-mysql. +[patch.crates-io] +opensrv-mysql = { git = "https://github.com/ephpm/opensrv-mysql.git", rev = "42efd446ba867066c94bcf13d31b3b3fec53ec61" } diff --git a/deny.toml b/deny.toml index 48b7ae4..99340ca 100644 --- a/deny.toml +++ b/deny.toml @@ -4,16 +4,13 @@ db-path = "~/.cargo/advisory-db" db-urls = ["https://github.com/rustsec/advisory-db"] ignore = [ # rustls-webpki cert-verification vulns (name constraints, CRL handling). - # After `cargo update`, these match only the OLD copies still pulled in by - # pinned dependencies: - # * 0.102.8 via opensrv-mysql 0.7.0 (latest) -> tokio-rustls 0.25 -> - # rustls 0.22. opensrv-mysql uses rustls only for server-side MySQL - # TLS, which does not exercise the name-constraint / CRL verification - # paths these advisories concern. + # The opensrv-mysql -> rustls 0.22 -> rustls-webpki 0.102.8 copy is GONE now + # that opensrv-mysql is patched to the aws-lc-rs fork on rustls >= 0.23.45 + # (see [patch.crates-io] in Cargo.toml). These now match ONLY: # * 0.101.7 via tiberius 0.12 -> rustls 0.21, a dev-dependency only # (the TDS e2e test client). Never shipped to users of the library. - # Drop once opensrv-mysql moves to rustls 0.23 and tiberius updates. - "RUSTSEC-2026-0049", + # RUSTSEC-2026-0049 no longer matches any crate (it affected the 0.102.x + # copy only) and has been dropped. Drop the rest once tiberius updates. "RUSTSEC-2026-0098", "RUSTSEC-2026-0099", "RUSTSEC-2026-0104", @@ -60,3 +57,6 @@ wildcards = "allow" unknown-registry = "warn" unknown-git = "warn" allow-registry = ["https://github.com/rust-lang/crates.io-index"] +# ePHPm fork of opensrv-mysql 0.7.0 (RUSTSEC-2026-0285 fix; see Cargo.toml +# [patch.crates-io]). Remove when opensrv-mysql moves back to a crates.io source. +allow-git = ["https://github.com/ephpm/opensrv-mysql.git"]