search

canonical / prompting-client

GNU General Public License v3.0
8 stars 4 forks source link

fix(deps): update rust crate tonic to v0.12.3 [security] #125

Open renovate[bot] opened 1 month ago

renovate[bot] commented 1 month ago

This PR contains the following updates:

Package Type Update Change
tonic dependencies patch 0.12.1 -> 0.12.3

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-47609

Impact

note: this only affects v0.12.0 - v0.12.2

When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit.

More information can be found here

Patches

Upgrading to tonic 0.12.3 and above contains the fix.

Workarounds

A custom accept loop is a possible workaround.

Release Notes

hyperium/tonic (tonic) ### [`v0.12.3`](https://redirect.github.com/hyperium/tonic/blob/HEAD/CHANGELOG.md#0123-2024-08-29) [Compare Source](https://redirect.github.com/hyperium/tonic/compare/v0.12.2...v0.12.3) ##### Features - **server:** Added support for grpc max_connection_age ([#​1865](https://redirect.github.com/hyperium/tonic/issues/1865)) - **build:** Add `#[deprecated]` to deprecated client methods ([#​1879](https://redirect.github.com/hyperium/tonic/issues/1879)) - **build:** plumb skip_debug through prost Builder and add test ([#​1900](https://redirect.github.com/hyperium/tonic/issues/1900)) ##### Bug Fixes - **build:** Revert "fix tonic-build cargo build script outputs ([#​1821](https://redirect.github.com/hyperium/tonic/issues/1821))" which accidentally increases MSRV ([#​1898](https://redirect.github.com/hyperium/tonic/issues/1898)) - **server:** ignore more error kinds in incoming socket stream ([#​1885](https://redirect.github.com/hyperium/tonic/issues/1885)) - **transport**: do not shutdown server on broken connections ([#​1948](https://redirect.github.com/hyperium/tonic/issues/1948)) ### [`v0.12.2`](https://redirect.github.com/hyperium/tonic/blob/HEAD/CHANGELOG.md#0122-2024-08-23) [Compare Source](https://redirect.github.com/hyperium/tonic/compare/v0.12.1...v0.12.2) ##### Features - Move TimeoutExpired out of transport ([#​1826](https://redirect.github.com/hyperium/tonic/issues/1826)) - Move ConnectError type from transport ([#​1828](https://redirect.github.com/hyperium/tonic/issues/1828)) - **channel:** allow setting max_header_list_size ([#​1835](https://redirect.github.com/hyperium/tonic/issues/1835)) - **router:** Add RoutesBuilder constructor ([#​1855](https://redirect.github.com/hyperium/tonic/issues/1855)) - **tls:** Rename tls-roots feature with tls-native-roots ([#​1860](https://redirect.github.com/hyperium/tonic/issues/1860)) - **router:** Rename Routes::into_router with into_axum_router ([#​1862](https://redirect.github.com/hyperium/tonic/issues/1862)) - **router:** Implement from axum::Router for Routes ([#​1863](https://redirect.github.com/hyperium/tonic/issues/1863)) - **channel:** Re-enable TLS based on Cargo features in generated clients ([#​1866](https://redirect.github.com/hyperium/tonic/issues/1866)) - **server:** allow setting max_header_list_size ([#​1870](https://redirect.github.com/hyperium/tonic/issues/1870)) - **build:** Expose formatted service name ([#​1684](https://redirect.github.com/hyperium/tonic/issues/1684)) - **reflection:** add back support for v1alpha reflection protocol ([#​1888](https://redirect.github.com/hyperium/tonic/issues/1888)) ##### Bug Fixes - **router:** Add missing unimplemented fallback to RoutesBuilder ([#​1864](https://redirect.github.com/hyperium/tonic/issues/1864)) - **server:** Prevent server from exiting on ECONNABORTED ([#​1874](https://redirect.github.com/hyperium/tonic/issues/1874)) - **web:** fix panic in trailer parsing on multiple trailers ([#​1880](https://redirect.github.com/hyperium/tonic/issues/1880)) - **web:** fix empty trailer parsing causing infinite parser loop ([#​1883](https://redirect.github.com/hyperium/tonic/issues/1883))

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.

codecov[bot] commented 1 month ago

Welcome to Codecov :tada:

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered :open_umbrella: