chore(deps): bump the cargo group across 1 directory with 3 updates#31
Merged
Conversation
Bumps the cargo group with 3 updates in the / directory: [openssl](https://github.com/rust-openssl/rust-openssl), [rustls-webpki](https://github.com/rustls/webpki) and [tar](https://github.com/composefs/tar-rs). Updates `openssl` from 0.10.78 to 0.10.80 - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.80) Updates `rustls-webpki` from 0.103.12 to 0.103.13 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.12...v/0.103.13) Updates `tar` from 0.4.45 to 0.4.46 - [Release notes](https://github.com/composefs/tar-rs/releases) - [Commits](composefs/tar-rs@0.4.45...0.4.46) --- updated-dependencies: - dependency-name: openssl dependency-version: 0.10.80 dependency-type: indirect dependency-group: cargo - dependency-name: rustls-webpki dependency-version: 0.103.13 dependency-type: indirect dependency-group: cargo - dependency-name: tar dependency-version: 0.4.46 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
WomB0ComB0
approved these changes
May 31, 2026
WomB0ComB0
added a commit
that referenced
this pull request
Jun 2, 2026
…s CVEs Supersedes the ignore-list approach in the previous commit, per gemini-code-assist review on #33. solana-program-test is a [patch.crates-io] *path* dependency, so Cargo resolves it through the root Cargo.lock and never reads vendor/solana-program-test/Cargo.lock. That nested lockfile is unused by the build, yet osv-scanner treated its directory as a separate scan project and reported false positives (openssl 0.10.74, rustls-webpki 0.103.6, tar 0.4.44) already patched in the root lockfile (openssl 0.10.80, rustls-webpki 0.103.13, tar 0.4.46 via #31). Delete the unused vendor/solana-program-test/Cargo.lock and its companion osv-scanner.toml, matching sibling vendored crates vendor/solana-invoke and vendor/solana-keypair, which ship no lockfile. Removes the false-positive source entirely instead of maintaining an ever-growing ignore list. Verified: osv-scanner scan source --recursive --config=osv-scanner.toml . -> "No issues found".
WomB0ComB0
added a commit
that referenced
this pull request
Jun 2, 2026
* chore(security): ignore vendored solana-program-test openssl/webpki/tar advisories The osv-scanner job flagged 10 advisories in vendor/solana-program-test/ Cargo.lock that the main workspace already resolved (#31) but the vendored dev-only test harness still pins: - openssl 0.10.74 — 8 GHSAs (main workspace on 0.10.80) - rustls-webpki 0.103.6 — RUSTSEC-2026-0104 (new alias; main on 0.103.13+) - tar 0.4.44 — GHSA-3pv8-6f4r-ffg2 (main on 0.4.46) These are reported under GHSA/newer-RUSTSEC ids not covered by the existing RUSTSEC entries, so they are listed explicitly with rationale. The vendor is a dev-dependency only; on-chain BPF bytecode ships none of it. Re-vendoring solana-program-test from a newer Solana release is the real fix. Verified locally: `osv-scanner scan source --lockfile=vendor/ solana-program-test/Cargo.lock --config=...` → "No issues found". * chore(security): drop unused vendored lockfile instead of ignoring its CVEs Supersedes the ignore-list approach in the previous commit, per gemini-code-assist review on #33. solana-program-test is a [patch.crates-io] *path* dependency, so Cargo resolves it through the root Cargo.lock and never reads vendor/solana-program-test/Cargo.lock. That nested lockfile is unused by the build, yet osv-scanner treated its directory as a separate scan project and reported false positives (openssl 0.10.74, rustls-webpki 0.103.6, tar 0.4.44) already patched in the root lockfile (openssl 0.10.80, rustls-webpki 0.103.13, tar 0.4.46 via #31). Delete the unused vendor/solana-program-test/Cargo.lock and its companion osv-scanner.toml, matching sibling vendored crates vendor/solana-invoke and vendor/solana-keypair, which ship no lockfile. Removes the false-positive source entirely instead of maintaining an ever-growing ignore list. Verified: osv-scanner scan source --recursive --config=osv-scanner.toml . -> "No issues found".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the cargo group with 3 updates in the / directory: openssl, rustls-webpki and tar.
Updates
opensslfrom 0.10.78 to 0.10.80Release notes
Sourced from openssl's releases.
Commits
35be7aeRelease openssl 0.10.80 and openssl-sys 0.9.116 (#2639)19eceb2Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-pad...b460eb3Prefer Homebrew openssl@4 and stop looking for openssl@1.1 (#2633)649f2d9Release openssl 0.10.79 and openssl-sys 0.9.115 (#2632)257f9b2Fix output buffer overflow for AES key-wrap-with-padding ciphers (#2630)d43e917Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders (#2631)f46519cAdd PkeyCtxRef::set_context_string for ML-DSA (#2629)ad9ae31Bind OSSL_PARAM_modified and use it for seed_into (#2628)4e25c9bFix process abort when verify/PSK callbacks fire after SSL_CTX swap (#2624)3dd8f42Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction (#2626)Updates
rustls-webpkifrom 0.103.12 to 0.103.13Release notes
Sourced from rustls-webpki's releases.
Commits
2879b2cPrepare 0.103.132c49773Improve tests for padding ofBitStringFlags4e3c0b3Correct validation of BIT STRING constraints39c91d2Actually fail closed for URI matching against excluded subtreesUpdates
tarfrom 0.4.45 to 0.4.46Release notes
Sourced from tar's releases.
Commits
fc459c1Release 0.4.4643e05a8ci: Add crates.io trusted publishing workflowbba5666Update repo linkscd94c46docs: Document TOCTOU / concurrent-mutation threat model1b4997cbuilder: Expand docs for follow_symlinks and append_dir_allbab14ddarchive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm)2349b49Add support of absolute paths39d0311Update some links59d803eUpdate astral-tokio-tar requirement from 0.5 to 0.68296b9aci: Fix and re-enable reverse dependency testing (#444)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.