Repository navigation
chore: release 0.9.1 - #203
Merged
Merged
Conversation
Bump crates and the npm wrapper to 0.9.1 to ship #202.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Collaborator
Author
|
Dependency audit fails on the same two rustls 0.21.12 advisories (RUSTSEC-2026-0346, RUSTSEC-2026-0349) as main. They come from tonic 0.10, and this PR only changes version numbers. There's no fix short of the tonic/hyper 1.x migration. See the #202 discussion for why neither looks reachable in Ordo. |
tonic 0.10's TLS stack pulled in rustls 0.21.12, which has RUSTSEC-2026-0346 and RUSTSEC-2026-0349 and no fixed 0.21 release. tonic 0.12 uses rustls 0.23, so cargo deny passes again. - tonic 0.10 -> 0.12, prost 0.12 -> 0.13, tonic-build 0.10 -> 0.12; generated gRPC code regenerated. - UDS test client wraps UnixStream in hyper_util's TokioIo (hyper 1 IO traits).
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before: crates and the npm wrapper are at 0.9.0, so the fixes from #202 are only on main. Dependency audit fails on main because tonic 0.10's TLS stack pulls in rustls 0.21.12 (RUSTSEC-2026-0346, RUSTSEC-2026-0349).
After: everything is at 0.9.1 and cargo deny passes. Once this merges, the CLI and server release workflows publish 0.9.1.
How: version bump in the workspace, each crate's Cargo.toml, Cargo.lock and npm/package.json. tonic 0.10 -> 0.12 and prost 0.12 -> 0.13, which use rustls 0.23; the generated gRPC code is regenerated, and the UDS test client wraps its stream in hyper_util's TokioIo. Checked locally: clippy, all 638 workspace tests (including the gRPC-over-UDS tests),
cargo deny check, and a gRPC Health and Eval call against the server with--grpc-tls-enabled.