From 5154c5276b2fd9e263212c1f3cba82d1bfafb923 Mon Sep 17 00:00:00 2001 From: le king fu Date: Fri, 4 Sep 2026 15:44:29 -0400 Subject: [PATCH] fix(deps): update h2 to 0.4.19 to clear RUSTSEC-2026-0258 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The daily audit has failed every morning since 2026-08-19 (runs 375 to 391, 17 consecutive reds). Nothing was pushed to main in that window: RUSTSEC-2026-0258 was published on 08-17 and reached the advisory-db two days later. Empty HTTP/2 DATA frames are queued without limit, so an undrained stream grows memory without bound and can overflow into a panic. Low severity, denial of service, patched in 0.4.16. h2 is reachable on both shipped targets, checked per triple rather than with --target all: through tauri-plugin-updater -> reqwest 0.13.2 for the automatic updater, and through the app's own reqwest 0.12.28 for the licence, auth, price and feedback calls. A published fix plus a reachable crate is rule 1 of .cargo/audit.toml, so this gets fixed rather than suppressed; the suppression list and the check-rust guard are both untouched. Only the h2 stanza moves. Running `cargo update -p h2` also re-resolves seven windows-sys pointers from 0.61.2 down to 0.48/0.52/0.59, which is what #321 deliberately reverted three weeks ago after proving 0.61.2 is the state of the v0.14.0 tag and therefore the only windows-sys configuration that has actually compiled under Windows. Letting the re-resolution stand would regress that decision silently, so the bump is applied to the lockfile as a two-line change instead. `cargo metadata --locked` accepts the result without rewriting it. Verified: cargo check and cargo test --all-targets green (111 passed), cargo-audit 0.22.2 exits 0 with the same 22 allowed warnings as before, and the same binary still exits 1 on the previous lockfile — so the green is a real change of state, not a differently configured tool. Resolves #343 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01RhPofpLQTZUbkVYR3i2e2D --- CHANGELOG.fr.md | 1 + CHANGELOG.md | 1 + src-tauri/Cargo.lock | 4 ++-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.fr.md b/CHANGELOG.fr.md index fdeb94a..427cce6 100644 --- a/CHANGELOG.fr.md +++ b/CHANGELOG.fr.md @@ -30,6 +30,7 @@ - Mise à jour de deux dépendances Rust situées sur le chemin de la mise à jour automatique, corrigeant six advisories RustSec : `rustls-webpki` 0.103.9 → 0.103.13 (traitement des contraintes de nom de certificat et analyse des listes de révocation, dont une panique atteignable) et `tar` 0.4.44 → 0.4.46 (`chmod` de répertoires arbitraires en suivant des liens symboliques pendant l'extraction, et en-têtes de taille PAX mal pris en compte). Les deux sont tirées par `tauri-plugin-updater` : celle qui gère TLS travaille à chaque vérification et à chaque téléchargement de mise à jour, tandis que celle qui décompresse n'est atteinte que par des formats d'installeur que cette application ne livre pas — elle a été mise à jour quand même, plutôt que contournée par un raisonnement. Aucun changement de comportement. Une autre advisory reste signalée sur le fichier de verrouillage et ne s'applique pas au produit livré : `rsa` n'est jamais compilé, son seul parent étant un pilote MySQL qu'une application SQLite ne construit jamais. Elle est consignée comme acceptée, avec sa justification et les conditions de son retrait, plutôt que de laisser l'audit de sécurité quotidien rouge en permanence. Les deux advisories visant `quick-xml` ont été acceptées de la même façon pendant quelques heures, puis résolues pour de bon : `plist` 1.10.0 livrait déjà le `quick-xml` 0.41.0 corrigé (#310, #312). - Mise à jour de la dépendance de build `postcss` (8.5.13 → 8.5.23), corrigeant GHSA-r28c-9q8g-f849 (traversée de chemin lors du chargement automatique d'une source map précédente depuis un commentaire `sourceMappingURL`, menant à la divulgation de fichiers `.map` arbitraires). Outillage de build uniquement, aucun changement runtime ni de comportement — le CSS généré est identique octet pour octet. Une advisory reste signalée sur `react-router` et est volontairement laissée en l'état : elle vise le mode React Server Components, qu'une application de bureau locale n'exécute jamais, et aucun correctif n'existe vers lequel avancer puisque `react-router-dom` est figé en 7.18.1 (sortir de la plage concernée demanderait une migration vers react-router v8, pas un changement de version) (#311). +- Mise à jour de la dépendance Rust `h2` (0.4.13 → 0.4.19), corrigeant RUSTSEC-2026-0258 (les frames HTTP/2 `DATA` vides sont acceptées et mises en file sans aucune limite : sur un flux qui n'est pas activement drainé, la mémoire croît sans borne et la longueur accumulée peut déborder en panique). Sévérité faible, déni de service uniquement. `h2` est la couche HTTP/2 de hyper, et elle se trouve sur deux chemins qu'emprunte cette application : la vérification et le téléchargement des mises à jour automatiques, via `tauri-plugin-updater`, ainsi que les appels de licence, d'authentification, de cours et de rétroaction, via le `reqwest` de l'application elle-même. Chacun de ces appels est une requête sortante vers un serveur que l'application choisit, donc atteindre la faille suppose un point d'accès hostile ou compromis plutôt qu'un service exposé — elle a été mise à jour quand même, plutôt que contournée par un raisonnement, au même titre que `rustls-webpki` avant elle. Aucun changement de comportement : seul le fichier de verrouillage bouge, `Cargo.toml` est intouché (#343). ## [0.14.0] - 2026-07-18 diff --git a/CHANGELOG.md b/CHANGELOG.md index d6c7ff0..39f4819 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,6 +30,7 @@ - Updated two Rust dependencies sitting on the automatic-update path, clearing six RustSec advisories: `rustls-webpki` 0.103.9 → 0.103.13 (certificate name-constraint handling and certificate-revocation-list parsing, including a reachable panic) and `tar` 0.4.44 → 0.4.46 (arbitrary directory `chmod` by following symlinks during extraction, and mishandled PAX size headers). Both are pulled in by `tauri-plugin-updater`: the TLS one runs on every update check and download, while the archive one is only reached by installer formats this app does not ship — it was updated anyway rather than reasoned around. No behaviour change. One further advisory is still reported against the lockfile and does not apply to the shipped product: `rsa` is never compiled at all, its only parent being a MySQL driver that a SQLite application never builds. It is recorded as accepted, with its justification and the conditions for removing it, instead of leaving the daily security audit permanently red. The two advisories against `quick-xml` were accepted the same way for a few hours, then resolved outright: `plist` 1.10.0 turned out to ship the fixed `quick-xml` 0.41.0 (#310, #312). - Updated the build-time dependency `postcss` (8.5.13 → 8.5.23), clearing GHSA-r28c-9q8g-f849 (path traversal while auto-loading a previous source map from a `sourceMappingURL` comment, leading to arbitrary `.map` file disclosure). Build tooling only, no runtime or behaviour change — the generated CSS is byte-for-byte identical. One advisory remains reported against `react-router`, and is deliberately left as is: it targets the React Server Components mode, which a local desktop app never runs, and no fix exists to move forward to since `react-router-dom` is frozen at 7.18.1 (leaving the affected range would mean migrating to react-router v8, not bumping a version) (#311). +- Updated the Rust dependency `h2` (0.4.13 → 0.4.19), clearing RUSTSEC-2026-0258 (empty HTTP/2 `DATA` frames are accepted and queued without any limit: on a stream that is not actively drained, memory grows unbounded and the queued length can overflow into a panic). Low severity, denial of service only. `h2` is hyper's HTTP/2 layer, and it sits on two paths this application does take: the automatic update check and download, through `tauri-plugin-updater`, and the licence, authentication, market-price and feedback calls, through the app's own `reqwest`. Each of those is an outbound request to a server the application itself picks, so reaching the flaw takes a hostile or compromised endpoint rather than an exposed listener — it was updated anyway rather than reasoned around, on the same grounds as the `rustls-webpki` bump before it. No behaviour change: only the lockfile moves, `Cargo.toml` is untouched (#343). ## [0.14.0] - 2026-07-18 diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index c4319f8..c36a1e7 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -1809,9 +1809,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.13" +version = "0.4.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54" +checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16" dependencies = [ "atomic-waker", "bytes",