cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

security: fix audit vulnerabilities (RUSTSEC-2026-0007, RUSTSEC-2021-0141)

Browse Source 
- Update bytes 1.11.0 -> 1.11.1 (fixes integer overflow in BytesMut::reserve, CVE-2026-25541)
- Replace unmaintained dotenv 0.15.0 with dotenvy 0.15.7 (RUSTSEC-2021-0141)
- Note: rsa 0.9.10 (RUSTSEC-2023-0071) has no patch yet, pulled transitively via jsonwebtoken
This commit is contained in:
Dionisio
2026-02-14 01:37:03 +01:00
parent 4c98c5a657
commit 1c5cf97cc5
3 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+3 -9
View File
@@ -278,9 +278,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
[[package]] [[package]]
name = "bytes" name = "bytes"
version = "1.11.0" version = "1.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
[[package]] [[package]]
name = "bzip2" name = "bzip2"
@@ -546,12 +546,6 @@ dependencies = [
"syn", "syn",
] ]
[[package]]
name = "dotenv"
version = "0.15.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
[[package]] [[package]]
name = "dotenvy" name = "dotenvy"
version = "0.15.7" version = "0.15.7"
@@ -1706,7 +1700,7 @@ dependencies = [
"base64", "base64",
"bytes", "bytes",
"chrono", "chrono",
"dotenv", "dotenvy",
"flate2", "flate2",
"fs2", "fs2",
"futures", "futures",
Cargo.toml
+2 -2
View File
@@ -10,7 +10,7 @@ axum = { version = "0.8.8", features = ["multipart", "http1", "tokio", "macros"]
tokio = { version = "1.49.0", features = ["full"] } tokio = { version = "1.49.0", features = ["full"] }
tokio-util = { version = "0.7.18", features = ["io", "codec"] } tokio-util = { version = "0.7.18", features = ["io", "codec"] }
tokio-stream = { version = "0.1.18", features = ["fs"] } tokio-stream = { version = "0.1.18", features = ["fs"] }
bytes = "1.11.0" bytes = "1.11.1"
tempfile = "3.25.0" tempfile = "3.25.0"
tower = "0.5.3" tower = "0.5.3"
tower-http = { version = "0.6.8", features = ["fs", "compression-gzip", "trace", "cors", "add-extension", "request-id"] } tower-http = { version = "0.6.8", features = ["fs", "compression-gzip", "trace", "cors", "add-extension", "request-id"] }
@@ -36,7 +36,7 @@ argon2 = "0.5.3"
rand_core = { version = "0.6", features = ["std", "getrandom"] } rand_core = { version = "0.6", features = ["std", "getrandom"] }
hyper = { version = "1.8.1", features = ["full"] } hyper = { version = "1.8.1", features = ["full"] }
quick-xml = "0.39.0" quick-xml = "0.39.0"
dotenv = "0.15.0" dotenvy = "0.15.7"
lru = "0.16.3" lru = "0.16.3"
memmap2 = "0.9" memmap2 = "0.9"
http-range-header = "0.4" http-range-header = "0.4"
src/bin/migrate.rs
+3 -3
View File
@@ -10,10 +10,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
// Load environment variables (.env.local first, then .env) // Load environment variables (.env.local first, then .env)
if let Ok(path) = env::var("DOTENV_PATH") { if let Ok(path) = env::var("DOTENV_PATH") {
dotenv::from_path(Path::new(&path)).ok(); dotenvy::from_path(Path::new(&path)).ok();
} else { } else {
dotenv::from_filename(".env.local").ok(); dotenvy::from_filename(".env.local").ok();
dotenv::dotenv().ok(); dotenvy::dotenv().ok();
} }
// Get DATABASE_URL from environment variables // Get DATABASE_URL from environment variables