Skip to content

fix(deps): opensrv-mysql → aws-lc-rs fork on rustls ≥0.23.45 (RUSTSEC-2026-0285) #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
luthermonson merged 1 commit into from
Oct 5, 2026
Merged

fix(deps): opensrv-mysql → aws-lc-rs fork on rustls ≥0.23.45 (RUSTSEC-2026-0285) #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 19 additions & 83 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 16 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,3 +114,19 @@ mysql_async = { version = "0.37", default-features = false, features = ["rustls-
tokio-postgres = { version = "0.7", default-features = false, features = ["runtime"] }
tiberius = { version = "0.12", default-features = false, features = ["rustls"] }
tokio-util = { version = "0.7", features = ["compat"] }

# SECURITY (RUSTSEC-2026-0285): opensrv-mysql 0.7.0 (crates.io, latest) pulls
# tokio-rustls 0.25 -> rustls 0.22, which is affected. There is no fixed
# crates.io release. Redirect opensrv-mysql at the ePHPm fork of 0.7.0, whose
# only change is tokio-rustls 0.25 -> 0.26 (rustls >= 0.23.45) pinned to the
# aws-lc-rs crypto provider (never `ring`). The `tls` feature and its
# auth-load-bearing `init_after_ssl` re-parse (#32) are byte-for-byte upstream.
#
# NOTE: this [patch] is honoured for litewire's OWN builds only. A patch does
# not propagate through a git dependency, so a downstream consumer (ePHPm)
# must declare the SAME patch in its own root Cargo.toml.
#
# Retire this patch when a fixed opensrv-mysql is published to crates.io, or
# when litewire migrates off opensrv-mysql.
[patch.crates-io]
opensrv-mysql = { git = "https://github.com/ephpm/opensrv-mysql.git", rev = "42efd446ba867066c94bcf13d31b3b3fec53ec61" }
16 changes: 8 additions & 8 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,13 @@ db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
ignore = [
# rustls-webpki cert-verification vulns (name constraints, CRL handling).
# After `cargo update`, these match only the OLD copies still pulled in by
# pinned dependencies:
# * 0.102.8 via opensrv-mysql 0.7.0 (latest) -> tokio-rustls 0.25 ->
# rustls 0.22. opensrv-mysql uses rustls only for server-side MySQL
# TLS, which does not exercise the name-constraint / CRL verification
# paths these advisories concern.
# The opensrv-mysql -> rustls 0.22 -> rustls-webpki 0.102.8 copy is GONE now
# that opensrv-mysql is patched to the aws-lc-rs fork on rustls >= 0.23.45
# (see [patch.crates-io] in Cargo.toml). These now match ONLY:
# * 0.101.7 via tiberius 0.12 -> rustls 0.21, a dev-dependency only
# (the TDS e2e test client). Never shipped to users of the library.
# Drop once opensrv-mysql moves to rustls 0.23 and tiberius updates.
"RUSTSEC-2026-0049",
# RUSTSEC-2026-0049 no longer matches any crate (it affected the 0.102.x
# copy only) and has been dropped. Drop the rest once tiberius updates.
"RUSTSEC-2026-0098",
"RUSTSEC-2026-0099",
"RUSTSEC-2026-0104",
Expand Down Expand Up @@ -60,3 +57,6 @@ wildcards = "allow"
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# ePHPm fork of opensrv-mysql 0.7.0 (RUSTSEC-2026-0285 fix; see Cargo.toml
# [patch.crates-io]). Remove when opensrv-mysql moves back to a crates.io source.
allow-git = ["https://github.com/ephpm/opensrv-mysql.git"]
Loading