Files
pezkuwi-telemetry/backend/common/Cargo.toml
T
Satoshi Qazi Muhammed a4fbd9c061 Move vulnerable dependencies to patched versions
Backend (Cargo.lock): openssl 0.10.55 -> 0.10.81, bytes 1.12.1, h2 0.3.27,
tokio 1.26 -> 1.47.1 (mio 1.x), url 2.3.1 -> 2.5.7 (idna 1.1), rand 0.8.8,
spin 0.9.9, time 0.3.55, ring 0.17.14.

Three alerts needed manifest changes:

- tokio-rustls 0.23 -> 0.26 (rustls 0.20 -> 0.23), which is what moves
  ring off 0.16. The ring provider is selected explicitly instead of the
  default aws-lc-rs, so the image build needs no cmake/C toolchain; roots
  still come from webpki-roots (now 1.0). Checked against live hosts: a
  valid certificate connects, an expired one and a name mismatch are
  refused.
- maxminddb 0.23 -> 0.27: lookup() now returns a result that is decoded,
  and the City model's fields are no longer Options. The existing
  locate_random_ip test (12.5.56.25 -> "Gardena") passes.
- structopt (clap 2, which pulled atty) -> clap 4 derive in telemetry_core,
  telemetry_shard and the soak tests; criterion 0.4 -> 0.5 for the same
  reason. Both binaries' arguments were parsed before and after for the
  docker-compose invocations and a set of other cases: identical results,
  except that `--feed-timeout` given without a value is now an error where
  structopt silently used the default. --denylist keeps taking every value
  up to the next flag (num_args = 1..), as its help text describes.

Frontend: npm audit fix within ranges, and webpack-dev-server 4 -> 5.2.6
(no devServer options are configured, so nothing to migrate). Left:
sockjs -> uuid 8 inside webpack-dev-server 5; the fix is 6.0, which needs
Node 22 while CI runs 20, and it is the local dev server only.

Checked: backend cargo test (58 passed), clippy, fmt; frontend lint,
prettier, test and build.
2026-10-03 04:25:49 +04:00

38 lines
1.2 KiB
TOML

[package]
name = "common"
version = "0.1.0"
authors = ["Dijital Kurdistan Tech Institute <admin@pezkuwichain.io>"]
edition = "2021"
license = "GPL-3.0"
[dependencies]
anyhow = "1.0.42"
base64 = { default-features = false, features = ["alloc"], version = "0.21" }
bimap = "0.6.1"
bytes = "1.0.1"
flume = "0.10.8"
fnv = "1.0.7"
futures = "0.3.15"
hex = "0.4.3"
http = "0.2.4"
hyper = { version = "0.14.11", features = ["full"] }
log = "0.4"
num-traits = "0.2"
pin-project-lite = "0.2.7"
primitive-types = { version = "0.12.1", features = ["serde"] }
rustc-hash = "1.1.0"
serde = { version = "1.0", features = ["derive"] }
serde_json = { version = "1.0", features = ["raw_value"] }
sha-1 = { default-features = false, version = "0.10.1" }
soketto = "0.7.1"
thiserror = "1.0.24"
tokio = { version = "1.8.2", features = ["full"] }
tokio-util = { version = "0.7.4", features = ["compat"] }
arrayvec = { version = "0.7.1", features = ["serde"] }
# ring rather than the default aws-lc-rs provider: no cmake/C toolchain in the image build.
tokio-rustls = { version = "0.26.6", default-features = false, features = ["logging", "ring", "tls12"] }
webpki-roots = "1.0.9"
[dev-dependencies]
bincode = "1.3.3"