Files
pezkuwi-telemetry/backend/telemetry_core/Cargo.toml
T
Satoshi Qazi Muhammed a4fbd9c061 Move vulnerable dependencies to patched versions
Backend (Cargo.lock): openssl 0.10.55 -> 0.10.81, bytes 1.12.1, h2 0.3.27,
tokio 1.26 -> 1.47.1 (mio 1.x), url 2.3.1 -> 2.5.7 (idna 1.1), rand 0.8.8,
spin 0.9.9, time 0.3.55, ring 0.17.14.

Three alerts needed manifest changes:

- tokio-rustls 0.23 -> 0.26 (rustls 0.20 -> 0.23), which is what moves
  ring off 0.16. The ring provider is selected explicitly instead of the
  default aws-lc-rs, so the image build needs no cmake/C toolchain; roots
  still come from webpki-roots (now 1.0). Checked against live hosts: a
  valid certificate connects, an expired one and a name mismatch are
  refused.
- maxminddb 0.23 -> 0.27: lookup() now returns a result that is decoded,
  and the City model's fields are no longer Options. The existing
  locate_random_ip test (12.5.56.25 -> "Gardena") passes.
- structopt (clap 2, which pulled atty) -> clap 4 derive in telemetry_core,
  telemetry_shard and the soak tests; criterion 0.4 -> 0.5 for the same
  reason. Both binaries' arguments were parsed before and after for the
  docker-compose invocations and a set of other cases: identical results,
  except that `--feed-timeout` given without a value is now an error where
  structopt silently used the default. --denylist keeps taking every value
  up to the next flag (num_args = 1..), as its help text describes.

Frontend: npm audit fix within ranges, and webpack-dev-server 4 -> 5.2.6
(no devServer options are configured, so nothing to migrate). Left:
sockjs -> uuid 8 inside webpack-dev-server 5; the fix is 6.0, which needs
Node 22 while CI runs 20, and it is the local dev server only.

Checked: backend cargo test (58 passed), clippy, fmt; frontend lint,
prettier, test and build.
2026-10-03 04:25:49 +04:00

49 lines
1.2 KiB
TOML

[package]
name = "telemetry_core"
version = "0.1.0"
authors = ["Dijital Kurdistan Tech Institute <admin@pezkuwichain.io>"]
edition = "2021"
license = "GPL-3.0"
[dependencies]
anyhow = "1.0.41"
bimap = "0.6.1"
bincode = "1.3.3"
bytes = "1.0.1"
common = { path = "../common" }
flume = "0.10.8"
futures = "0.3.15"
hex = "0.4.3"
http = "0.2.4"
hyper = "0.14.11"
log = "0.4.14"
maxminddb = "0.27.0"
num_cpus = "1.13.0"
once_cell = "1.8.0"
parking_lot = "0.12.1"
primitive-types = { version = "0.12.1", features = ["serde"] }
rayon = "1.5.1"
reqwest = { version = "0.11.4", features = ["json"] }
rustc-hash = "1.1.0"
serde = { version = "1.0.126", features = ["derive"] }
serde_json = "1.0.64"
simple_logger = "4.0.0"
smallvec = "1.6.1"
soketto = "0.7.1"
clap = { version = "4.5", features = ["derive"] }
thiserror = "1.0.25"
tokio = { version = "1.10.1", features = ["full"] }
tokio-util = { version = "0.7.4", features = ["compat"] }
[target.'cfg(not(target_env = "msvc"))'.dependencies]
jemallocator = "0.5.0"
[dev-dependencies]
shellwords = "1.1.0"
test_utils = { path = "../test_utils" }
criterion = { version = "0.5", features = ["async", "async_tokio"] }
[[bench]]
name = "subscribe"
harness = false