From 46e92e642b905c11c40a4c67cfba005efee30ca9 Mon Sep 17 00:00:00 2001 From: asto Date: Mon, 9 Nov 2026 20:30:15 +0800 Subject: [PATCH 1/4] =?UTF-8?q?build(deps):=20=E5=8D=87=E7=BA=A7rusqlite?= =?UTF-8?q?=200.41=E4=BF=AERUSTSEC-2026-0459?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit libsqlite3-sys 0.38.2 捆绑的 SQLite <3.54.0 存在页缓存未初始化内存读取（RUSTSEC-2026-0459/CVE-2026-119375，需本地构造 db+wal 对才可触发）；rusqlite 0.41.1 随 libsqlite3-sys 0.39.1 捆绑修补版 SQLite 3.54.1。全工作区编译零 API 变更。 Signed-off-by: asto --- Cargo.lock | 8 ++++---- Cargo.toml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f13a1d4a5f..d7a68c7531 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3000,9 +3000,9 @@ dependencies = [ [[package]] name = "libsqlite3-sys" -version = "0.38.2" +version = "0.39.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8" +checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3" dependencies = [ "cc", "pkg-config", @@ -4479,9 +4479,9 @@ dependencies = [ [[package]] name = "rusqlite" -version = "0.40.2" +version = "0.41.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3" +checksum = "da9bba6f3506135e120a6586df05be18b48d18896600646a4bec8f993d91a594" dependencies = [ "bitflags 2.13.2", "fallible-iterator", diff --git a/Cargo.toml b/Cargo.toml index 4a66cd6e41..701dbfa0b2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -65,7 +65,7 @@ reqwest = { version = "0.13.1", default-features = false, features = ["json", "r # multi-thread engine over channels (see crates/workflow-js). rquickjs = { version = "0.12", features = ["futures"] } rustls = { version = "0.23.36", default-features = false, features = ["ring", "std", "tls12"] } -rusqlite = { version = "0.40.2", features = ["bundled"] } +rusqlite = { version = "0.41.0", features = ["bundled"] } serde = { version = "1.0.228", features = ["derive"] } serde_json = "1.0.149" semver = "1.0.28" From 4353d2992547ef804169371bd261a1939557c1b7 Mon Sep 17 00:00:00 2001 From: asto Date: Mon, 9 Nov 2026 22:14:40 +0800 Subject: [PATCH 2/4] =?UTF-8?q?build(deps):=20=E5=8D=87=E7=BA=A7rmcp=203.9?= =?UTF-8?q?=E4=BF=AERUSTSEC-2026-0462?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rmcp <3.9.0 的 Streamable HTTP 客户端把非流式响应体无界读入内存（reqwest 与 Unix socket 客户端两形态）。子模块锁随父仓 #2519 同步到 3.9.0，全 workspace 编译零调用点变更。 锁随附 cargo 解析器强制重归一（非手改）：windows-sys 引用 0.61.2→0.59.0 ×10 包、tempfile 内 getrandom 0.4.3→0.3.4——两版本在锁内本就并存，仅引用切换、无新增包；自 base 锁以 `cargo update -p rusqlite@0.40.2 --precise 0.41.1` + `cargo update -p rmcp@3.7.0 --precise 3.9.0`（cargo 1.99.1）逐字节复现，diff exit=0。 Signed-off-by: asto --- Cargo.lock | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d7a68c7531..e88a365271 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -172,7 +172,7 @@ dependencies = [ "objc2-foundation", "parking_lot", "percent-encoding", - "windows-sys 0.61.2", + "windows-sys 0.59.0", "x11rb", ] @@ -1202,7 +1202,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1648,7 +1648,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1777,7 +1777,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -3328,7 +3328,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4396,9 +4396,9 @@ dependencies = [ [[package]] name = "rmcp" -version = "3.7.0" +version = "3.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ece64e19631fc38758181e637c15509a2c2709ee53bfde1e1d58f9dc991f919e" +checksum = "d24a7e92f4bcaa36b97fa93c4fa7ca8f3e669eced949345b3462dba333c7f909" dependencies = [ "async-trait", "chrono", @@ -4410,6 +4410,7 @@ dependencies = [ "reqwest", "serde", "serde_json", + "sha2 0.11.1", "thiserror 2.0.21", "tokio", "tokio-stream", @@ -4565,7 +4566,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4621,7 +4622,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5293,10 +5294,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5328,7 +5329,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874" dependencies = [ "rustix", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -6271,7 +6272,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] From f1fefdde3707bc0269e068dbebf37d5c9505f178 Mon Sep 17 00:00:00 2001 From: asto Date: Tue, 10 Nov 2026 05:30:00 +0000 Subject: [PATCH 3/4] =?UTF-8?q?build(deps):=20=E5=8D=87=E7=BA=A7rio-vt=200?= =?UTF-8?q?.5.29=E4=BF=AERUSTSEC-2026-0430?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rio-vt ≤0.5.28 的 Kitty 图形协议路径穿越可致越权文件删除/读取（RUSTSEC-2026-0430，fix 0.5.29 已发布）。仅锁变更：rio 家族六包同步 0.5.29（rio-vt/teletypewriter/rio-graphics/rio-unicode/rio-grapheme-width，corcovado 随 teletypewriter 依赖升级）。 锁随附 cargo 解析器强制重归一（非手改）：windows-sys 引用 0.59.0→0.52.0 ×8 与 0.59.0→0.61.2 ×3 重统一、serde-saphyr 内 base64 0.23.1→0.22.1；自上级锁以 `cargo update -p rio-vt -p teletypewriter -p rio-graphics -p rio-unicode -p rio-grapheme-width`（cargo 1.99.1）逐字节复现，diff exit=0。 Signed-off-by: asto --- Cargo.lock | 48 ++++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index e88a365271..ab81366b0c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -172,7 +172,7 @@ dependencies = [ "objc2-foundation", "parking_lot", "percent-encoding", - "windows-sys 0.59.0", + "windows-sys 0.52.0", "x11rb", ] @@ -1202,7 +1202,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -1276,9 +1276,9 @@ dependencies = [ [[package]] name = "corcovado" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aac575a85cf04f046f88f7daf6ef350ebf79545ae54fe9bb081efbb638ed3194" +checksum = "9cba695e51805c1acd3501c7561dec661b81394376c4493b46c49bdf39889741" dependencies = [ "libc", "miow 0.5.0", @@ -1648,7 +1648,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -1777,7 +1777,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -1879,7 +1879,7 @@ checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78" dependencies = [ "cfg-if", "rustix", - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -3328,7 +3328,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -4340,9 +4340,9 @@ dependencies = [ [[package]] name = "rio-grapheme-width" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a901dda1fe16da68fbe8788db5f2b4525f95b43f064618d2bb6c7361c4e9150" +checksum = "7ef9487fce3556a0b27b6598a956c4402a46b8bb25afe2ec53ab0378c75e402c" dependencies = [ "phf 0.13.1", "ucd-trie", @@ -4350,9 +4350,9 @@ dependencies = [ [[package]] name = "rio-graphics" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "40bdcb0a124c88c7e75a4f2b2953b158981bf541613b4b0146e21d07f4a104ac" +checksum = "736eb317aa3bdb7256f58b1ad18f971a831d6de928854a9aee6e13c6792bcf19" dependencies = [ "rustc-hash", "tracing", @@ -4361,15 +4361,15 @@ dependencies = [ [[package]] name = "rio-unicode" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48266e8c525eb4fb8d3ad899e1a050404fb782f876cad2df800dd5455126a99b" +checksum = "ed68c9eaee951073cac248ece99f5f1ebabf92a1c0305ac28fa622a8fa1679d5" [[package]] name = "rio-vt" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f80220ae32041e4cef8719cab57d3579cbe0dc26dd1cb1ca0693f85491e1696" +checksum = "28b1c817c56394ca5777f25a66925e9700e6d395154c7f55f1100a5f8cb0ef39" dependencies = [ "base64 0.23.1", "bitflags 2.13.2", @@ -4566,7 +4566,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -4622,7 +4622,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -4754,7 +4754,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8050abb251097357e24aff63ba2c52a6309ecb7d23a5474023df960a02694d8" dependencies = [ "annotate-snippets", - "base64 0.23.1", + "base64 0.22.1", "encoding_rs_io", "granit-parser", "nohash-hasher", @@ -5273,9 +5273,9 @@ dependencies = [ [[package]] name = "teletypewriter" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "edbf8e5a8f36cd22c3092b4895a1c5b41b9748e63ef92030b0353b1e05531e46" +checksum = "184dad5c0e9838908962751c877e10defda2cb0878f9fa9041e0404f2792adf8" dependencies = [ "corcovado", "dirs 6.0.0", @@ -5297,7 +5297,7 @@ dependencies = [ "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -5329,7 +5329,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874" dependencies = [ "rustix", - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -6272,7 +6272,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] From a1b49087bb49cdeb988fedb1566ed03700f1e3b9 Mon Sep 17 00:00:00 2001 From: asto Date: Tue, 10 Nov 2026 15:18:07 +0800 Subject: [PATCH 4/4] =?UTF-8?q?build(deps):=20=E5=A3=B0=E6=98=8E=201.89=20?= =?UTF-8?q?=E4=B8=8E=E9=94=81=E5=AE=9A=E5=9B=BE=E5=AE=9E=E9=99=85=E4=B8=8B?= =?UTF-8?q?=E9=99=90=E5=AF=B9=E9=BD=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 评审指出（pinvou3#2519）：uuid 1.29.0 在 2026-11 通告升级前就已进入 Cargo.lock 且声明 rust-version 1.89，本次 rusqlite 0.41.1 又加同一下 限——1.88 工具链在锁图上必然失败，声明的 1.88 不再成立，也不把首次破 坏 1.88 构建归因给本次升级。同步声明为 1.89，让旧工具链得到清晰的 requires rustc 1.89+ 报错而不是编译中的 E0658；aes 0.9.2 锁针与 MSRV 脱钩（保留其自身可复现性理由），回落 1.88 的前提是整个锁图不再含任何 要求 1.89 的 crate。 Signed-off-by: asto --- Cargo.toml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 701dbfa0b2..945ddcc592 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -30,14 +30,18 @@ version = "0.9.12" edition = "2024" # Rust 1.88 stabilized `let_chains` in `if`/`while` conditions, which the # codebase relies on extensively. Cargo enforces this so users on older -# toolchains get a clear "package requires rustc 1.88+" error instead of a +# toolchains get a clear "package requires rustc 1.89+" error instead of a # confusing E0658 from rustc. # -# Lock-held for this MSRV: aes is deliberately kept at 0.9.2 in Cargo.lock; -# 0.9.3 (what secret-service's crypto-rust pulls on a bare `cargo update`) -# declares rust-version 1.89. Re-examine when secret-service drops its aes -# 0.9 requirement or the workspace MSRV reaches 1.89. -rust-version = "1.88" +# The declared floor must match the lock graph: uuid 1.29.0 (in Cargo.lock +# since before the 2026-11 advisory upgrades) already declares +# rust-version 1.89, and rusqlite 0.41.1 adds the same floor, so a 1.88 +# toolchain fails on the lock itself no matter what this workspace declares. +# The former "hold aes at 0.9.2 to keep 1.88" stance is therefore no longer +# load-bearing for the MSRV (the aes pin stays for its own reproducibility +# reasons); going back down requires the whole locked graph to drop every +# 1.89-requiring crate, not just this declaration. +rust-version = "1.89" license = "MIT" repository = "https://github.com/Hmbown/CodeWhale"