pezkuwichain/pezkuwi-sdk
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
388 Commits 1 Branch 0 Tags
main
Commit Graph

12 Commits

Author SHA1 Message Date
pezkuwichain 787efa3cce fix(security): update vulnerable dependencies, clean up deny.toml 
Cargo.lock updates (cargo update):
- tar 0.4.44 -> 0.4.45 (RUSTSEC-2026-0067, RUSTSEC-2026-0068)
- rustls-webpki 0.103.9 -> 0.103.11 (RUSTSEC-2026-0049)
- tracing-subscriber 0.3.22 -> 0.3.23
- yamux 0.13.8 -> 0.13.10 (RUSTSEC-2024-0428 for 0.13.x branch)

deny.toml: remove fixed advisory ignores, add accurate tracking comments

Remaining known issues (cannot fix without toolchain/vendor upgrade):
- wasmtime 37.x: fix in 42.x requires rustc 1.91 (pinned to 1.88)
- yamux 0.12.1: locked by libp2p-yamux 0.47.0 in zombienet vendor
 2026-04-14 00:15:21 +03:00
pezkuwichain a0607b420c fix(security): add missing advisory ignores for cargo-audit + cargo-deny 
Re-add RUSTSEC-2023-0071 (rsa) and RUSTSEC-2025-0055 (tracing-subscriber)
which were incorrectly removed — they are still in transitive deps.

Add new advisories:
- RUSTSEC-2026-0067 (tar symlink traversal) — no 0.4.x patch available
- RUSTSEC-2026-0068 (tar link following) — no 0.4.x patch available
 2026-03-28 15:47:09 +03:00
pezkuwichain fd197ae78f fix: presale benchmark missing args + security audit advisory cleanup 
- Fix refund_cancelled_presale benchmark: add missing start_index and
  batch_size arguments (0, 100) to match the 3-param extrinsic signature
- Remove 3 stale RUSTSEC advisories from deny.toml and security-audit.yml
  (RUSTSEC-2023-0071, RUSTSEC-2025-0055, RUSTSEC-2026-0002 no longer in deps)
- Add RUSTSEC-2026-0049 (rustls-webpki) to ignore lists (upstream kube/jsonrpsee
  haven't released compatible versions yet)
 2026-03-27 09:34:47 +03:00
pezkuwichain 827128f5f7 chore: format deny.toml with taplo (alphabetical license order) 2026-03-05 03:41:02 +03:00
pezkuwichain 2fbe8da2cd fix(security): add NCSA and CDLA-Permissive-2.0 licenses, disable fail-fast 
- Add NCSA and CDLA-Permissive-2.0 to allowed licenses in deny.toml
  (both are permissive open-source licenses used by transitive deps)
- Set fail-fast: false on cargo-deny matrix so all checks run
  independently even if one fails
 2026-03-05 03:28:41 +03:00
pezkuwichain 6e307b0999 fix(security): set unmaintained=none in deny.toml 
All unmaintained crate warnings are transitive upstream dependencies
that we cannot replace. Disable unmaintained checks in cargo-deny
to prevent false CI failures. Track via quarterly review instead.
 2026-03-05 03:11:35 +03:00
pezkuwichain 4f672222f7 fix(security): upgrade deps and enforce security audit workflow 
- Upgrade bytes 1.11.0 → 1.11.1 (RUSTSEC-2026-0007 integer overflow)
- Upgrade time 0.3.46 → 0.3.47 (RUSTSEC-2026-0009 DoS stack exhaustion)
- Upgrade git2 0.20.3 → 0.20.4 (RUSTSEC-2026-0008 undefined behavior)
- Upgrade keccak 0.1.5 → 0.1.6 (RUSTSEC-2026-0012 unsoundness)
- Add ignore rules in deny.toml for unfixable upstream advisories
  (wasmtime 37.x, rsa, tracing-subscriber 0.2.x, lru)
- Remove continue-on-error from security-audit workflow — audit is now
  enforced and will block CI on new unignored vulnerabilities
 2026-03-05 03:00:59 +03:00
pezkuwichain 20ad3489ee fix(ci): fix deny.toml taplo formatting (tabs + sorted arrays) 2026-02-25 21:43:36 +03:00
pezkuwichain 070553a89d fix(ci): add GPL-3.0-only to allowed licenses, fix taplo formatting 2026-02-25 21:27:05 +03:00
pezkuwichain e5b3f453eb fix(ci): fix cargo-deny v2 config and make security audit informational 2026-02-25 21:09:34 +03:00
pezkuwichain 535ab80740 fix(ci): update deny.toml to cargo-deny v2 format 2026-02-25 19:44:38 +03:00
pezkuwichain c55a371edb fix(ci): fix build failures and add security audit workflow 
- build-linux-stable: disable forklift GCS cache (RUSTC_WRAPPER="")
  that panics without GCP credentials on VPS runners
- prepare-bridges-zombienet-artifacts: fix bridges/testing path to
  pezbridges/testing (rebrand path was not updated in workflow)
- build-rustdoc: use CARGO_TARGET_DIR instead of ./target for doc
  output path (docs generated at /cache/target/doc, not ./target/doc)
- build-push-image-*: add workspace permission fix step before checkout
  to handle root-owned files left by Docker container jobs
- All build jobs: increase timeout from 120 to 180 minutes for VPS
- Add cargo-deny + cargo-audit security audit workflow (weekly + on PR)
- Add deny.toml with license, advisory, and source checks
 2026-02-25 19:39:47 +03:00