Repository navigation
fix(deps): bump pulldown-cmark to 0.13.5 for RUSTSEC-2026-0414 - #8644
Merged
Merged
Conversation
RUSTSEC-2026-0414 (published 2026-10-28) flags pulldown-cmark 0.13.4: with `Options::ENABLE_WIKILINKS` set, a `[[a|]]` wikilink leaks its sibling chain into the following content, so event output grows exponentially with input size. cargo-deny now fails the Security lane on main and on every pull request that touches a Rust path. buzz-relay's only use is `render_policy_document` in api/invites.rs, which parses operator-authored Markdown with `Parser::new` and default options, so the wikilinks path is never enabled; this is a dependency policy fix rather than an exploitable one. `cargo update -p pulldown-cmark --precise 0.13.5` is the only change; the Cargo.toml requirement `0.13.4` already admits it. The same re-resolution moves data-encoding-macro-internal's `syn` edge from 2.0.117 to the 1.0.109 already in the lock (its requirement is `>=1, <3`); both versions remain present, so no crate is added or removed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>
github-actions
Bot
added
the
codex-security-review-current
🔐 Codex Security Review
Review SummaryOverall Risk: NONE
FindingsNo concrete security, correctness, or reliability findings were identified. Notes
Generated by Codex Security Review | |
brow
approved these changes
Oct 28, 2026
ravarora2
added a commit
that referenced
this pull request
Oct 28, 2026
…-handler * origin/main: perf(db,relay): bound thread participant scans and coalesce live summaries (#8635) mobile: find DMs opened ahead of the list everywhere (#8646) BUZZ-413: Add user deletion fence storage (#8632) fix(mobile): open new DMs without waiting for a full channel reload (#8638) Stop requiring the 0032 roster trigger at relay startup (#8611) fix(relay): store a kind:9000 and its membership writes in one transaction (#8606) fix(deps): bump pulldown-cmark to 0.13.5 for RUSTSEC-2026-0414 (#8644) feat(relay): log who and why for NIP-FI shadow would-deny (#8634) feat(mobile): add full-screen profile setup with inline avatar editing (#8628) fix(mobile): preserve invite onboarding and offer identity setup (#8617) refactor(schema): stop auto-fencing new tables in desired-state bootstrap (#8620) Signed-off-by: Ravneet Arora <rarora@squareup.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
pulldown-cmark0.13.4 → 0.13.5 inCargo.lockto clear RUSTSEC-2026-0414, whichcargo-denystarted flagging this morning. The advisory landed in the RustSec database at 08:50 UTC on 2026-10-28; main's last Security run passed at 00:24 UTC, and every PR touching a Rust path since (e.g. #8613,jitter/block-staging-relay-domain) fails the required Security check on it. Main will go red on its next Rust-path push until this merges.Exposure
Not exploitable in Buzz: the advisory requires
Options::ENABLE_WIKILINKS, which is off by default. The relay's only use isrender_policy_documentincrates/buzz-relay/src/api/invites.rs, which parses operator-authored policy Markdown viaParser::newwith default options. This is a dependency-policy fix.Change
cargo update -p pulldown-cmark --precise 0.13.5under the pinned 1.98.1 toolchain;crates/buzz-relay/Cargo.tomlalready requires0.13.4(^0.13.4), so no manifest edit.data-encoding-macro-internal'ssynedge from 2.0.117 to the 1.0.109 already in the lock (declared requirement>=1, <3). No crate is added or removed.desktop/src-tauri/Cargo.lockdoes not containpulldown-cmark, andcargo-denyonly checks the root workspace.Not touched here:
deny.toml:50'sRUSTSEC-2026-0381ignore now warnsadvisory-not-detected(the crate is gone). Harmless; can be removed separately.Verification
cargo update --dry-runshowedpulldown-cmarkas the only version change before applying.🤖 Generated with Claude Code