From a0e0a629a726b716f04323f25b30e3e51b3d93b8 Mon Sep 17 00:00:00 2001 From: probe Date: Tue, 10 Nov 2026 16:20:48 +0800 Subject: [PATCH 1/2] chore(deps): bump rusqlite 0.41 and rmcp 3.9 for RUSTSEC advisories rusqlite 0.40.2 -> 0.41.1 (workspace), pulling libsqlite3-sys 0.38.2 -> 0.39.1: RUSTSEC-2026-0459 / CVE-2026-119375 -- bundled SQLite < 3.54.0 can return uninitialized page-cache memory when a database is opened alongside a sibling -wal file whose page size differs (local attack vector; a crafted file pair makes ordinary queries return stale process memory). libsqlite3-sys 0.39.1 bundles SQLite 3.54.1. rmcp 3.7.0 -> 3.9.0 (tui): RUSTSEC-2026-0462 -- the Streamable HTTP clients read non-streaming response bodies unbounded before 3.9.0, so a malicious or compromised MCP server could OOM the host during initialize, pre-authentication (16 MiB JSON / 64 KiB error caps from 3.9.0). Verified: dev build of codewhale-tui green; advisories clear both entries; mcp (381), memory (47), session (56) subsets green; the forkguard engine tests hang on the base pin in this sandbox as well (pre-existing local-environment issue, exercised on CI runners). Signed-off-by: probe --- Cargo.lock | 13 +++++++------ Cargo.toml | 2 +- crates/tui/Cargo.toml | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f13a1d4a5f..72f479b958 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3000,9 +3000,9 @@ dependencies = [ [[package]] name = "libsqlite3-sys" -version = "0.38.2" +version = "0.39.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8" +checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3" dependencies = [ "cc", "pkg-config", @@ -4396,9 +4396,9 @@ dependencies = [ [[package]] name = "rmcp" -version = "3.7.0" +version = "3.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ece64e19631fc38758181e637c15509a2c2709ee53bfde1e1d58f9dc991f919e" +checksum = "d24a7e92f4bcaa36b97fa93c4fa7ca8f3e669eced949345b3462dba333c7f909" dependencies = [ "async-trait", "chrono", @@ -4410,6 +4410,7 @@ dependencies = [ "reqwest", "serde", "serde_json", + "sha2 0.11.1", "thiserror 2.0.21", "tokio", "tokio-stream", @@ -4479,9 +4480,9 @@ dependencies = [ [[package]] name = "rusqlite" -version = "0.40.2" +version = "0.41.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3" +checksum = "da9bba6f3506135e120a6586df05be18b48d18896600646a4bec8f993d91a594" dependencies = [ "bitflags 2.13.2", "fallible-iterator", diff --git a/Cargo.toml b/Cargo.toml index 4a66cd6e41..701dbfa0b2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -65,7 +65,7 @@ reqwest = { version = "0.13.1", default-features = false, features = ["json", "r # multi-thread engine over channels (see crates/workflow-js). rquickjs = { version = "0.12", features = ["futures"] } rustls = { version = "0.23.36", default-features = false, features = ["ring", "std", "tls12"] } -rusqlite = { version = "0.40.2", features = ["bundled"] } +rusqlite = { version = "0.41.0", features = ["bundled"] } serde = { version = "1.0.228", features = ["derive"] } serde_json = "1.0.149" semver = "1.0.28" diff --git a/crates/tui/Cargo.toml b/crates/tui/Cargo.toml index 357c376198..a3cd02486d 100644 --- a/crates/tui/Cargo.toml +++ b/crates/tui/Cargo.toml @@ -69,7 +69,7 @@ ratatui = { version = "=0.30.2", features = ["unstable-rendered-line-info"] } regex = "1.11" reqwest = { workspace = true, features = ["blocking", "stream", "form", "http2"] } rusqlite.workspace = true -rmcp = { version = "3.7.0", default-features = false, features = ["auth", "client"] } +rmcp = { version = "3.9.0", default-features = false, features = ["auth", "client"] } rustls.workspace = true qrcode = { version = "0.14", default-features = false } similar = { version = "3", features = ["unicode"] } From ec1a4548c42a4c4b5d369d3f0acb1bd78b173bd0 Mon Sep 17 00:00:00 2001 From: probe Date: Tue, 10 Nov 2026 17:12:20 +0800 Subject: [PATCH 2/2] chore(deps): bump rio-vt 0.5.29 for RUSTSEC-2026-0430 Path traversal in the Kitty graphics protocol handler (substring guard instead of a component check, no .. rejection): untrusted terminal output can delete and read files outside the temp directory. 0.5.28 -> 0.5.29 rides teletypewriter to the same patch release; cargo deny advisories now fully green on this graph. Signed-off-by: probe --- Cargo.lock | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 72f479b958..ab81366b0c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -172,7 +172,7 @@ dependencies = [ "objc2-foundation", "parking_lot", "percent-encoding", - "windows-sys 0.61.2", + "windows-sys 0.52.0", "x11rb", ] @@ -1202,7 +1202,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1276,9 +1276,9 @@ dependencies = [ [[package]] name = "corcovado" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aac575a85cf04f046f88f7daf6ef350ebf79545ae54fe9bb081efbb638ed3194" +checksum = "9cba695e51805c1acd3501c7561dec661b81394376c4493b46c49bdf39889741" dependencies = [ "libc", "miow 0.5.0", @@ -1777,7 +1777,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1879,7 +1879,7 @@ checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78" dependencies = [ "cfg-if", "rustix", - "windows-sys 0.59.0", + "windows-sys 0.52.0", ] [[package]] @@ -4340,9 +4340,9 @@ dependencies = [ [[package]] name = "rio-grapheme-width" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a901dda1fe16da68fbe8788db5f2b4525f95b43f064618d2bb6c7361c4e9150" +checksum = "7ef9487fce3556a0b27b6598a956c4402a46b8bb25afe2ec53ab0378c75e402c" dependencies = [ "phf 0.13.1", "ucd-trie", @@ -4350,9 +4350,9 @@ dependencies = [ [[package]] name = "rio-graphics" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "40bdcb0a124c88c7e75a4f2b2953b158981bf541613b4b0146e21d07f4a104ac" +checksum = "736eb317aa3bdb7256f58b1ad18f971a831d6de928854a9aee6e13c6792bcf19" dependencies = [ "rustc-hash", "tracing", @@ -4361,15 +4361,15 @@ dependencies = [ [[package]] name = "rio-unicode" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48266e8c525eb4fb8d3ad899e1a050404fb782f876cad2df800dd5455126a99b" +checksum = "ed68c9eaee951073cac248ece99f5f1ebabf92a1c0305ac28fa622a8fa1679d5" [[package]] name = "rio-vt" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f80220ae32041e4cef8719cab57d3579cbe0dc26dd1cb1ca0693f85491e1696" +checksum = "28b1c817c56394ca5777f25a66925e9700e6d395154c7f55f1100a5f8cb0ef39" dependencies = [ "base64 0.23.1", "bitflags 2.13.2", @@ -4566,7 +4566,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4622,7 +4622,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4754,7 +4754,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8050abb251097357e24aff63ba2c52a6309ecb7d23a5474023df960a02694d8" dependencies = [ "annotate-snippets", - "base64 0.23.1", + "base64 0.22.1", "encoding_rs_io", "granit-parser", "nohash-hasher", @@ -5273,9 +5273,9 @@ dependencies = [ [[package]] name = "teletypewriter" -version = "0.5.28" +version = "0.5.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "edbf8e5a8f36cd22c3092b4895a1c5b41b9748e63ef92030b0353b1e05531e46" +checksum = "184dad5c0e9838908962751c877e10defda2cb0878f9fa9041e0404f2792adf8" dependencies = [ "corcovado", "dirs 6.0.0", @@ -5294,10 +5294,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6272,7 +6272,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]]