search

starcoinorg / starcoin

Starcoin - A Move smart contract blockchain network that scales by layering
Apache License 2.0
1.38k stars 289 forks source link

Bump the cargo group with 7 updates #4195

Closed dependabot[bot] closed 2 months ago

dependabot[bot] commented 2 months ago

Bumps the cargo group with 7 updates:

Package From To
h2 0.3.15 0.3.26
openssl 0.10.45 0.10.66
quinn-proto 0.9.2 0.9.6
rustix 0.36.14 0.36.17
shlex 1.1.0 1.3.0
snow 0.9.1 0.9.6
whoami 1.3.0 1.5.2

Updates h2 from 0.3.15 to 0.3.26

Release notes

Sourced from h2's releases.

v0.3.26

What's Changed

  • Limit number of CONTINUATION frames for misbehaving connections.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.

v0.3.25

What's Changed

Full Changelog: https://github.com/hyperium/h2/compare/v0.3.24...v0.3.25

v0.3.24

Fixed

  • Limit error resets for misbehaving connections.

v0.3.23

What's Changed

v0.3.22

What's Changed

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

New Contributors

v0.3.21

What's Changed

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

New Contributors

v0.3.20

Bug Fixes

... (truncated)

Changelog

Sourced from h2's changelog.

0.3.26 (April 3, 2024)

  • Limit number of CONTINUATION frames for misbehaving connections.

0.3.25 (March 15, 2024)

  • Improve performance decoding many headers.

0.3.24 (January 17, 2024)

  • Limit error resets for misbehaving connections.

0.3.23 (January 10, 2024)

  • Backport fix from 0.4.1 for stream capacity assignment.

0.3.22 (November 15, 2023)

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

0.3.21 (August 21, 2023)

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

0.3.20 (June 26, 2023)

  • Fix panic if a server received a request with a :status pseudo header in the 1xx range.
  • Fix panic if a reset stream had pending push promises that were more than allowed.
  • Fix potential flow control overflow by subtraction, instead returning a connection error.

0.3.19 (May 12, 2023)

  • Fix counting reset streams when triggered by a GOAWAY.
  • Send too_many_resets in opaque debug data of GOAWAY when too many resets received.

0.3.18 (April 17, 2023)

  • Fix panic because of opposite check in is_remote_local().

0.3.17 (April 13, 2023)

  • Add Error::is_library() method to check if the originated inside h2.
  • Add max_pending_accept_reset_streams(usize) option to client and server builders.
  • Fix theoretical memory growth when receiving too many HEADERS and then RST_STREAM frames faster than an application can accept them off the queue.

... (truncated)

Commits


Updates openssl from 0.10.45 to 0.10.66

Release notes

Sourced from openssl's releases.

openssl-v0.10.66

What's Changed

Full Changelog: https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.65...openssl-v0.10.66

openssl-v0.10.65

What's Changed

New Contributors

Full Changelog: https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.64...openssl-v0.10.65

openssl-v0.10.64

What's Changed

... (truncated)

Commits
  • ad70a0b Merge pull request #2267 from alex/bump-for-release
  • 5ce473b Release openssl v0.10.66
  • aef36e0 Merge pull request #2266 from alex/mem-bio-invariant
  • 142deef Fixed invariant violation in MemBio::get_buf with empty results
  • 32f150b Merge pull request #2265 from alex/bump-for-release
  • 98addd2 Release openssl v0.10.65 and openssl-sys v0.9.103
  • 7c7958d Merge pull request #2262 from alex/pkey-api
  • d7b12cc Switch Pkey::from_ to use set1 functions
  • 22ffa9a Merge pull request #2258 from sfackler/init-md
  • 9de3794 Initialize OpenSSL in MD constructors
  • Additional commits viewable in compare view


Updates quinn-proto from 0.9.2 to 0.9.6

Release notes

Sourced from quinn-proto's releases.

quinn-proto-0.11.8, quinn 0.11.5

What's Changed

quinn-proto-0.11.7, quinn 0.11.4

This releases fixes a server-side denial of service attack first introduced in 0.11.0, tracked as https://github.com/quinn-rs/quinn/security/advisories/GHSA-vr26-jcq5-fjj8.

What's Changed

quinn-proto-0.11.6 & quinn 0.11.3

What's Changed

Commits


Updates rustix from 0.36.14 to 0.36.17

Commits
  • 76c998c chore: Release rustix version 0.36.17
  • 1c6013a Fix p{read,write}v{,v2}'s encoding of the offset argument on Linux. (#896) (#...
  • 6534992 chore: Release rustix version 0.36.16
  • 4928cf7 Disable riscv64 testing.
  • 8cc159c Fix the test_ttyname_ok test when /dev/stdin is inaccessable. (#821)
  • 6dc7ba9 Downgrade dependencies and disable tests to compile under Rust 1.48.
  • ded8986 Disable MIPS in CI. (#793)
  • 739f9c3 Fixes for Dir on macOS, FreeBSD, and WASI.
  • 87481a9 Merge pull request from GHSA-c827-hfw6-qwvm
  • 5b764b5 chore: Release rustix version 0.36.15
  • Additional commits viewable in compare view


Updates shlex from 1.1.0 to 1.3.0

Changelog

Sourced from shlex's changelog.

1.3.0

  • Full fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27:
    • Deprecates quote APIs in favor of try_ equivalents that complain about nul bytes.
    • Also adds a builder API, which allows re-enabling nul bytes without using the deprecated interface, and in the future can allow other things (as discussed in quoting_warning).
    • Adds documentation about various security risks that remain, particularly with interactive shells.
  • Adds explicit MSRV of 1.46.0.

1.2.1

  • Partial fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27 without bumping MSRV:
    • The bytes { and \xa0 are now escaped by quoting functions.

1.2.0

  • Adds bytes module to support operating directly on byte strings.
Commits


Updates snow from 0.9.1 to 0.9.6

Release notes

Sourced from snow's releases.

v0.9.6

  • Validate invalid PSK positions when building a Noise protocol.
  • Raise errors in various typos/mistakes in Noise patterns when parsing.
  • Deprecate the sodiumoxide backend, as that crate is no longer maintained. We may eventually migrate it to a maintaned version of the crate, but for now it's best to warn users.
  • Set a hard limit in read_message() in transport mode to 65535 to be fully compliant with the Noise specification.

Full Changelog: https://github.com/mcginty/snow/compare/v0.9.5...v0.9.6

v0.9.5

This is a security release that fixes a logic flaw in decryption in TransportState (i.e. the stateful one), where the nonce could increase even when decryption failed, which can cause a desync between the sender and receiver, opening this up as a denial of service vector if the attacker has the ability to inject packets in the channel Noise is talking over.

More details can be found in the advisory: https://github.com/mcginty/snow/security/advisories/GHSA-7g9j-g5jg-3vv3

All users are encouraged to update.

v0.9.4

This is a dependency version bump release because a couple of important dependencies released new versions that needed a Cargo.toml bump:

  • ring 0.17
  • pqcrypto-kyber 0.8
  • aes-gcm 0.10
  • chacha20poly1305 0.10

v0.9.3

This is a quick patch release to use the stable 4.0 version of curve25519-dalek.

v0.9.2

This is a patch release to address a correctness issue for compliance with the Noise specification: the nonce $2^{64} - 1$ is reserved for rekeying, and CipherState and StatelessCipherState did not check that, instead just making sure that there was no integer overflow.

Thanks to @​kjvalencik for reporting the issue and @​complexspaces for contributing the fix PR (#152).

Thanks to @​robyoder as well for fixing broken links and making sure all links were HTTPS (#151).

Full Changelog: https://github.com/mcginty/snow/compare/v0.9.1...v0.9.2

Commits
  • a4be73f meta: v0.9.6 release
  • 9e53dcf TransportState: limit read_message size to 65535
  • faf0560 Deprecate sodiumoxide resolver
  • 308a24d Add warnings about multiple calls to same method in Builder
  • f280991 Error when extraneous parameters are included in string to parse
  • dbdcc48 Error on duplicate modifiers in parameter string
  • 8b1a819 Validate PSK index in pattern to avoid panic
  • 74e30cf meta: v0.9.5 release
  • 12e8ae5 Stateful nonce desync fix
  • 02c26b7 Remove clap from simple example
  • Additional commits viewable in compare view


Updates whoami from 1.3.0 to 1.5.2

Changelog

Sourced from whoami's changelog.

[1.5.2] - 2024-09-02

Changed

  • Updated redox_syscall to 0.5
  • Replace target_os = daku with daku cfg
  • Improved repository documentation

[1.5.1] - 2024-03-09

Fixed

  • Broken link in docs

[1.5.0] - 2024-03-03

Added

  • WASI support
  • Redox support
  • Fallible functions
    • whoami::fallible::devicename()
    • whoami::fallible::devicename_os()
    • whoami::fallible::distro()
    • whoami::fallible::hostname() - notably doesn't normalize to lowercase
    • whoami::fallible::realname()
    • whoami::fallible::realname_os()
    • whoami::fallible::username()
    • whoami::fallible::username_os()
  • whoami::Language
  • whoami::Country
  • whoami::langs()
  • whoami::fallible::account()
  • whoami::fallible::account_os()
  • whoami::DesktopEnv::is_gtk()
  • whoami::DesktopEnv::is_kde()

Removed

  • Generated device names that infer casing based on the hostname when the device name is not available - now returns the hostname unchanged
  • Partial (potentially unsound) support for Android, iOS, watchOS, tvOS, Fuchsia, Haiku, Solaris, and a few others. These targets now use the "fake" implementation.

Changed

  • Deprecated whoami::distro_os()
  • Deprecated whoami::hostname()
  • Deprecated whoami::hostname_os()

... (truncated)

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/starcoinorg/starcoin/network/alerts).
coderabbitai[bot] commented 2 months ago

[!IMPORTANT]

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Tips ### Chat There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai): - Review comments: Directly reply to a review comment made by CodeRabbit. Example: -- `I pushed a fix in commit , please review it.` -- `Generate unit testing code for this file.` - `Open a follow-up GitHub issue for this discussion.` - Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples: -- `@coderabbitai generate unit testing code for this file.` -- `@coderabbitai modularize this function.` - PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples: -- `@coderabbitai generate interesting stats about this repository and render them as a table.` -- `@coderabbitai read src/utils.ts and generate unit testing code.` -- `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.` -- `@coderabbitai help me debug CodeRabbit configuration file.` Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. ### CodeRabbit Commands (Invoked using PR comments) - `@coderabbitai pause` to pause the reviews on a PR. - `@coderabbitai resume` to resume the paused reviews. - `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository. - `@coderabbitai full review` to do a full review from scratch and review all the files again. - `@coderabbitai summary` to regenerate the summary of the PR. - `@coderabbitai resolve` resolve all the CodeRabbit review comments. - `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository. - `@coderabbitai help` to get help. ### Other keywords and placeholders - Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed. - Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description. - Add `@coderabbitai` anywhere in the PR title to generate the title automatically. ### CodeRabbit Configuration File (`.coderabbit.yaml`) - You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository. - Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information. - If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json` ### Documentation and Community - Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit. - Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback. - Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.
dependabot[bot] commented 2 months ago

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml