From f7cc816bd9cda9115517ac621f4e8ddc2d1c2944 Mon Sep 17 00:00:00 2001 From: Wu Sheng Date: Mon, 2 Nov 2026 16:39:35 +0800 Subject: [PATCH] Bump dependencies to fix security alerts Dependencies (Cargo.lock): - bytes 1.10.1 -> 1.11.1 (GHSA-434x-w66g-qw3r, CVE-2026-25541) - rand 0.8.5 -> 0.8.6 (GHSA-cq8v-f236-94qc) - e2e: build structopt without default features. This turns off clap 2's color/suggestions/vec_map features and removes atty 0.2.14 (GHSA-g98v-hv3f-hcfr, no patched release) together with ansi_term, strsim 0.8, vec_map and hermit-abi 0.1. - Regenerate dist-material/LICENSE accordingly. time stays at 0.3.41: its fix (0.3.47) requires Rust 1.88, above the project's rust-version / pinned toolchain 1.85. GitHub Actions (ASF-allowed versions): - actions/checkout v2 -> v7 - apache/skywalking-eyes header/dependency and license-eye d299844e -> a196742f (v0.9.0) - codecov/codecov-action v2.1.0 -> v7.1.1, uploading with OIDC (use_oidc, job permissions contents: read / id-token: write), since v7 rejects tokenless uploads from non-fork branches. --- .github/workflows/ci.yaml | 16 +++++----- .github/workflows/codecov.yaml | 9 ++++-- .github/workflows/e2e.yml | 2 +- Cargo.lock | 53 +++------------------------------- dist-material/LICENSE | 9 ++---- e2e/Cargo.toml | 2 +- 6 files changed, 23 insertions(+), 68 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0fc56a1..ebec0cd 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -39,27 +39,27 @@ jobs: - doc runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: 'recursive' license-check: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: 'recursive' - name: Check License Header - uses: apache/skywalking-eyes/header/@d299844e334855087f18ae1fe3c81ae8d22bc282 + uses: apache/skywalking-eyes/header/@a196742f472feaffafea537ce5a2a4c3c53a8de4 # v0.9.0 with: config: .github/licenserc.yaml - name: Check Dependencies License - uses: apache/skywalking-eyes/dependency/@d299844e334855087f18ae1fe3c81ae8d22bc282 + uses: apache/skywalking-eyes/dependency/@a196742f472feaffafea537ce5a2a4c3c53a8de4 # v0.9.0 with: config: .github/licenserc.yaml - name: Check Dependencies Licenses Summary run: | - go install github.com/apache/skywalking-eyes/cmd/license-eye@d299844e334855087f18ae1fe3c81ae8d22bc282 + go install github.com/apache/skywalking-eyes/cmd/license-eye@a196742f472feaffafea537ce5a2a4c3c53a8de4 # v0.9.0 license-eye dependency resolve --summary ./dist-material/LICENSE.tpl -c .github/licenserc.yaml || exit 1 if [ ! -z "$(git diff -U0 ./dist-material/LICENSE)" ]; then echo "LICENSE file is not updated correctly" @@ -71,7 +71,7 @@ jobs: fmt: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: 'recursive' - name: Install Rust toolchain @@ -91,7 +91,7 @@ jobs: - "--all-features" runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: 'recursive' - name: Install protoc @@ -109,7 +109,7 @@ jobs: doc: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: 'recursive' - name: Install protoc diff --git a/.github/workflows/codecov.yaml b/.github/workflows/codecov.yaml index 1768e6e..dd7f3f4 100644 --- a/.github/workflows/codecov.yaml +++ b/.github/workflows/codecov.yaml @@ -26,8 +26,11 @@ on: jobs: test: runs-on: ubuntu-24.04 + permissions: + contents: read + id-token: write steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: true - name: Install protoc @@ -39,4 +42,6 @@ jobs: run: | cargo install cargo-tarpaulin cargo tarpaulin --out Xml - - uses: codecov/codecov-action@v2.1.0 + - uses: codecov/codecov-action@v7.1.1 + with: + use_oidc: true diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 79566d0..ca4e00b 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -29,7 +29,7 @@ jobs: e2e-rust: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v7 with: submodules: recursive - name: Prepare service container diff --git a/Cargo.lock b/Cargo.lock index 0c309b1..be02876 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -26,15 +26,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "ansi_term" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2" -dependencies = [ - "winapi", -] - [[package]] name = "anyhow" version = "1.0.97" @@ -80,17 +71,6 @@ version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" -[[package]] -name = "atty" -version = "0.2.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8" -dependencies = [ - "hermit-abi", - "libc", - "winapi", -] - [[package]] name = "autocfg" version = "1.4.0" @@ -179,9 +159,9 @@ checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd" [[package]] name = "bytes" -version = "1.10.1" +version = "1.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a" +checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33" [[package]] name = "bytesize" @@ -210,13 +190,9 @@ version = "2.34.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c" dependencies = [ - "ansi_term", - "atty", "bitflags 1.3.2", - "strsim", "textwrap", "unicode-width", - "vec_map", ] [[package]] @@ -418,15 +394,6 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" -[[package]] -name = "hermit-abi" -version = "0.1.19" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33" -dependencies = [ - "libc", -] - [[package]] name = "hostname" version = "0.4.0" @@ -959,9 +926,9 @@ checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5" [[package]] name = "rand" -version = "0.8.5" +version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" +checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" dependencies = [ "libc", "rand_chacha", @@ -1191,12 +1158,6 @@ dependencies = [ "windows-sys 0.52.0", ] -[[package]] -name = "strsim" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a" - [[package]] name = "structopt" version = "0.3.26" @@ -1557,12 +1518,6 @@ version = "0.2.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" -[[package]] -name = "vec_map" -version = "0.8.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191" - [[package]] name = "version_check" version = "0.9.5" diff --git a/dist-material/LICENSE b/dist-material/LICENSE index 3c96c7c..280077c 100644 --- a/dist-material/LICENSE +++ b/dist-material/LICENSE @@ -298,7 +298,6 @@ The text of each license is also included in licenses/LICENSE-[project].txt. https://crates.io/crates/hashbrown/0.15.2 0.15.2 Apache-2.0 OR MIT https://crates.io/crates/heck/0.3.3 0.3.3 Apache-2.0 OR MIT https://crates.io/crates/heck/0.5.0 0.5.0 Apache-2.0 OR MIT - https://crates.io/crates/hermit-abi/0.1.19 0.1.19 Apache-2.0 OR MIT https://crates.io/crates/http/1.3.1 1.3.1 Apache-2.0 OR MIT https://crates.io/crates/httparse/1.10.1 1.10.1 Apache-2.0 OR MIT https://crates.io/crates/httpdate/1.0.3 1.0.3 Apache-2.0 OR MIT @@ -337,7 +336,7 @@ The text of each license is also included in licenses/LICENSE-[project].txt. https://crates.io/crates/proc-macro-error-attr/1.0.4 1.0.4 Apache-2.0 OR MIT https://crates.io/crates/proc-macro2/1.0.94 1.0.94 Apache-2.0 OR MIT https://crates.io/crates/quote/1.0.40 1.0.40 Apache-2.0 OR MIT - https://crates.io/crates/rand/0.8.5 0.8.5 Apache-2.0 OR MIT + https://crates.io/crates/rand/0.8.6 0.8.6 Apache-2.0 OR MIT https://crates.io/crates/rand_chacha/0.3.1 0.3.1 Apache-2.0 OR MIT https://crates.io/crates/rand_core/0.6.4 0.6.4 Apache-2.0 OR MIT https://crates.io/crates/regex/1.11.1 1.11.1 Apache-2.0 OR MIT @@ -368,7 +367,6 @@ The text of each license is also included in licenses/LICENSE-[project].txt. https://crates.io/crates/unicode-width/0.1.14 0.1.14 Apache-2.0 OR MIT https://crates.io/crates/uuid/1.16.0 1.16.0 Apache-2.0 OR MIT https://crates.io/crates/vcpkg/0.2.15 0.2.15 Apache-2.0 OR MIT - https://crates.io/crates/vec_map/0.8.2 0.8.2 Apache-2.0 OR MIT https://crates.io/crates/version_check/0.9.5 0.9.5 Apache-2.0 OR MIT https://crates.io/crates/winapi/0.3.9 0.3.9 Apache-2.0 OR MIT https://crates.io/crates/winapi-i686-pc-windows-gnu/0.4.0 0.4.0 Apache-2.0 OR MIT @@ -401,13 +399,11 @@ MIT licenses The following components are provided under the MIT License. See project link for details. The text of each license is also included in licenses/LICENSE-[project].txt. - https://crates.io/crates/ansi_term/0.12.1 0.12.1 MIT https://crates.io/crates/async-stream/0.3.6 0.3.6 MIT https://crates.io/crates/async-stream-impl/0.3.6 0.3.6 MIT - https://crates.io/crates/atty/0.2.14 0.2.14 MIT https://crates.io/crates/axum/0.7.9 0.7.9 MIT https://crates.io/crates/axum-core/0.4.5 0.4.5 MIT - https://crates.io/crates/bytes/1.10.1 1.10.1 MIT + https://crates.io/crates/bytes/1.11.1 1.11.1 MIT https://crates.io/crates/clap/2.34.0 2.34.0 MIT https://crates.io/crates/h2/0.4.8 0.4.8 MIT https://crates.io/crates/hostname/0.4.0 0.4.0 MIT @@ -421,7 +417,6 @@ The text of each license is also included in licenses/LICENSE-[project].txt. https://crates.io/crates/rdkafka-sys/4.9.0+2.10.0 4.9.0+2.10.0 MIT https://crates.io/crates/redox_syscall/0.5.10 0.5.10 MIT https://crates.io/crates/slab/0.4.9 0.4.9 MIT - https://crates.io/crates/strsim/0.8.0 0.8.0 MIT https://crates.io/crates/textwrap/0.11.0 0.11.0 MIT https://crates.io/crates/tokio/1.46.1 1.46.1 MIT https://crates.io/crates/tokio-macros/2.5.0 2.5.0 MIT diff --git a/e2e/Cargo.toml b/e2e/Cargo.toml index 621064f..986236f 100644 --- a/e2e/Cargo.toml +++ b/e2e/Cargo.toml @@ -35,5 +35,5 @@ hyper-util = "0.1.10" prost = "0.13.5" rdkafka = { workspace = true } skywalking = { path = "..", features = ["kafka-reporter"] } -structopt = "0.3" +structopt = { version = "0.3", default-features = false } tokio = { version = "1", features = ["full"] }