Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rust crate flatbuffers to v22 [SECURITY] #37

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 2, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
flatbuffers (source) dependencies major 2.1.1 -> 22.9.29
flatbuffers (source) dependencies major 2.0.0 -> 22.9.29

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-3jch-9qgp-4844

Code generated by flatbuffers' compiler is unsafe but not marked as such.
See https://github.com/google/flatbuffers/issues/6627 for details.

All users that use generated code by flatbuffers compiler are recommended to:

  1. not expose flatbuffer generated code as part of their public APIs
  2. audit their code and look for any usage of follow, push, or any method that uses them
    (e.g. self_follow).
  3. Carefuly go through the crates' documentation to understand which "safe" APIs are not
    intended to be used.

Release Notes

google/flatbuffers (flatbuffers)

v22.9.29

  • Rust soundness fixes to avoid the crate from bing labelled unsafe (#​7518).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate
Copy link
Contributor Author

renovate bot commented Sep 2, 2023

⚠ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: apps/sim-engine/Cargo.lock
Command failed: docker run --rm --name=renovate_a_sidecar --label=renovate_a_child --memory=3584m -v "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs":"/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" -v "/tmp/worker/b5a309/71d139/cache":"/tmp/worker/b5a309/71d139/cache" -e CONTAINERBASE_CACHE_DIR -w "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" ghcr.io/containerbase/sidecar:9.19.3 bash -l -c "install-tool rust 1.72.0 && cargo update --manifest-path apps/sim-engine/lib/stateful/Cargo.toml --workspace"
error: failed to load manifest for workspace member `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/bin/cli`

Caused by:
  failed to load manifest for dependency `orchestrator`

Caused by:
  failed to parse manifest at `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/lib/orchestrator/Cargo.toml`

Caused by:
  `artifact = …` requires `-Z bindeps` (hash_engine)

File name: apps/sim-engine/Cargo.lock
Command failed: docker run --rm --name=renovate_a_sidecar --label=renovate_a_child --memory=3584m -v "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs":"/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" -v "/tmp/worker/b5a309/71d139/cache":"/tmp/worker/b5a309/71d139/cache" -e CONTAINERBASE_CACHE_DIR -w "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" ghcr.io/containerbase/sidecar:9.19.3 bash -l -c "install-tool rust 1.72.0 && cargo update --manifest-path apps/sim-engine/lib/memory/Cargo.toml --workspace"
error: failed to load manifest for workspace member `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/bin/cli`

Caused by:
  failed to load manifest for dependency `orchestrator`

Caused by:
  failed to parse manifest at `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/lib/orchestrator/Cargo.toml`

Caused by:
  `artifact = …` requires `-Z bindeps` (hash_engine)

File name: apps/sim-engine/Cargo.lock
Command failed: docker run --rm --name=renovate_a_sidecar --label=renovate_a_child --memory=3584m -v "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs":"/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" -v "/tmp/worker/b5a309/71d139/cache":"/tmp/worker/b5a309/71d139/cache" -e CONTAINERBASE_CACHE_DIR -w "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" ghcr.io/containerbase/sidecar:9.19.3 bash -l -c "install-tool rust 1.72.0 && cargo update --manifest-path apps/sim-engine/lib/flatbuffers_gen/Cargo.toml --workspace"
error: failed to load manifest for workspace member `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/bin/cli`

Caused by:
  failed to load manifest for dependency `orchestrator`

Caused by:
  failed to parse manifest at `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/lib/orchestrator/Cargo.toml`

Caused by:
  `artifact = …` requires `-Z bindeps` (hash_engine)

File name: apps/sim-engine/Cargo.lock
Command failed: docker run --rm --name=renovate_a_sidecar --label=renovate_a_child --memory=3584m -v "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs":"/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" -v "/tmp/worker/b5a309/71d139/cache":"/tmp/worker/b5a309/71d139/cache" -e CONTAINERBASE_CACHE_DIR -w "/tmp/worker/b5a309/71d139/repos/github/hashintel/labs" ghcr.io/containerbase/sidecar:9.19.3 bash -l -c "install-tool rust 1.72.0 && cargo update --manifest-path apps/sim-engine/lib/execution/Cargo.toml --workspace"
error: failed to load manifest for workspace member `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/bin/cli`

Caused by:
  failed to load manifest for dependency `orchestrator`

Caused by:
  failed to parse manifest at `/tmp/worker/b5a309/71d139/repos/github/hashintel/labs/apps/sim-engine/lib/orchestrator/Cargo.toml`

Caused by:
  `artifact = …` requires `-Z bindeps` (hash_engine)

@judeallred
Copy link
Collaborator

These security issues don't apply because they're components in the build environment of a static website.

@judeallred judeallred closed this Oct 6, 2023
@renovate
Copy link
Contributor Author

renovate bot commented Oct 6, 2023

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 22.x releases. But if you manually upgrade to 22.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the deps/rs/crate-flatbuffers-vulnerability branch October 6, 2023 19:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant