Skip to main content

max / makenotwork

audit Run 14 Phase 1: close ammonia mXSS, refresh dep tree, codify advisory triage - ammonia 4.1.2 -> 4.1.3 closes RUSTSEC-2026-0193 (mXSS via MathML annotation-xml), which was directly in the user-markdown sanitization path (docengine render_permissive). - cargo update refreshes the tree: clears quinn-proto (2026-0185), anyhow (2026-0190), memmap2 (2026-0186), rand (2026-0097); async-stripe rc.5 -> rc.6; AWS SDK + axum bumps. - .cargo/audit.toml: triaged ignore list, one rationale per remaining transitive advisory (rsa sig-verify N/A, AWS-SDK rustls-webpki to trusted S3, git2 UB on server-owned repos, unmaintained transitives). cargo audit now exits clean from a documented posture. - run-ci.sh reads the config instead of an inline --ignore with a stale sqlx-mysql comment. - sanitizer/markdown suites + full lib suite (1813) green on the new ammonia/html5ever. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-01 22:45 UTC
Commit: 7c69fa447a3a53e72777dfef6be83124eab4e5c7
Parent: d858d8b
4 files changed, +147 insertions, -96 deletions
A server/.cargo/audit.toml +36
@@ -0,0 +1,36 @@
1 + # cargo-audit configuration — triaged advisory posture for the MNW server.
2 + #
3 + # Every ignore below is a transitive advisory we cannot resolve by bumping our
4 + # own direct deps, each with a rationale and (where relevant) the upstream we're
5 + # waiting on. Directly-fixable advisories are NOT parked here — they get fixed in
6 + # Cargo.toml/Cargo.lock (e.g. the ammonia mXSS RUSTSEC-2026-0193 was closed by
7 + # bumping to 4.1.3, not ignored). Re-review this list on every dependency audit.
8 +
9 + [advisories]
10 + ignore = [
11 + # rsa — Marvin timing side-channel on RSA *decryption*. Pulled only by the
12 + # signature-*verification* crates (apple-codesign, authenticode, yara-x); we
13 + # never decrypt with rsa, so the decryption-oracle attack does not apply.
14 + "RUSTSEC-2023-0071",
15 +
16 + # rustls-webpki (0.101 line) — name-constraint bypass + CRL-parse panic.
17 + # Transitive via the AWS S3 SDK's rustls 0.21 TLS stack (aws-smithy-http-client).
18 + # It only validates certs for the trusted S3/STS endpoints we dial, not
19 + # attacker-supplied certs. Clears when the AWS SDK moves to rustls 0.23.
20 + "RUSTSEC-2026-0098",
21 + "RUSTSEC-2026-0099",
22 + "RUSTSEC-2026-0104",
23 +
24 + # git2 — UB in Remote::list() / BlameHunk-from-buffer Signature. We call
25 + # neither on untrusted input (repos are server-owned); awaiting a git2 release.
26 + "RUSTSEC-2026-0183",
27 + "RUSTSEC-2026-0184",
28 +
29 + # Unmaintained-crate warnings, all transitive (no direct dep, no code change
30 + # available to us). Tracked for when upstreams migrate off them.
31 + "RUSTSEC-2025-0141", # bincode (unmaintained) — via transitive tooling
32 + "RUSTSEC-2020-0095", # difference (unmaintained) — via a dev/test dep
33 + "RUSTSEC-2024-0436", # paste (unmaintained) — via proc-macro deps
34 + "RUSTSEC-2025-0134", # rustls-pemfile (unmaintained) — via AWS SDK TLS
35 + "RUSTSEC-2026-0173", # proc-macro-error2 (unmaintained) — via a macro dep
36 + ]
M server/Cargo.lock +95 -81
@@ -23,19 +23,19 @@ version = "0.5.2"
23 23 source = "registry+https://github.com/rust-lang/crates.io-index"
24 24 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
25 25 dependencies = [
26 - "crypto-common 0.1.6",
26 + "crypto-common 0.1.7",
27 27 "generic-array",
28 28 ]
29 29
30 30 [[package]]
31 31 name = "aes"
32 - version = "0.8.4"
32 + version = "0.9.1"
33 33 source = "registry+https://github.com/rust-lang/crates.io-index"
34 - checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
34 + checksum = "f1fc76eaeac4c9164506c466d4ffdd8ec9d0c5bf57ee97177c4d8eceb3a0e138"
35 35 dependencies = [
36 - "cfg-if",
37 - "cipher",
38 - "cpufeatures 0.2.17",
36 + "cipher 0.5.2",
37 + "cpubits",
38 + "cpufeatures 0.3.0",
39 39 ]
40 40
41 41 [[package]]
@@ -68,14 +68,13 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
68 68
69 69 [[package]]
70 70 name = "ammonia"
71 - version = "4.1.2"
71 + version = "4.1.3"
72 72 source = "registry+https://github.com/rust-lang/crates.io-index"
73 - checksum = "17e913097e1a2124b46746c980134e8c954bc17a6a59bb3fde96f088d126dde6"
73 + checksum = "68b9d3370580a12f4b7a10fdcc18b28942c083ba570e3d954fe59d10951b85a2"
74 74 dependencies = [
75 - "cssparser 0.35.0",
75 + "cssparser 0.37.0",
76 76 "html5ever",
77 77 "maplit",
78 - "tendril",
79 78 "url",
80 79 ]
81 80
@@ -90,9 +89,9 @@ dependencies = [
90 89
91 90 [[package]]
92 91 name = "annotate-snippets"
93 - version = "0.12.15"
92 + version = "0.12.16"
94 93 source = "registry+https://github.com/rust-lang/crates.io-index"
95 - checksum = "92570a3f9c98e7e84df84b71d0965ac99b1871fcd75a3773a3bd1bad13f64cf7"
94 + checksum = "f211a51805bc641f3ad5b7664c77d2547af685cc33b4cd8d31964027a46f13f1"
96 95 dependencies = [
97 96 "anstyle",
98 97 "memchr",
@@ -151,9 +150,9 @@ dependencies = [
151 150
152 151 [[package]]
153 152 name = "anyhow"
154 - version = "1.0.102"
153 + version = "1.0.103"
155 154 source = "registry+https://github.com/rust-lang/crates.io-index"
156 - checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
155 + checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
157 156
158 157 [[package]]
159 158 name = "apple-bundles"
@@ -179,17 +178,17 @@ dependencies = [
179 178 "apple-xar",
180 179 "base64 0.22.1",
181 180 "bcder",
182 - "bitflags 2.11.0",
181 + "bitflags 2.13.0",
183 182 "bytes",
184 183 "chrono",
185 184 "clap",
186 185 "cryptographic-message-syntax",
187 - "der 0.7.10",
186 + "der",
188 187 "dialoguer",
189 188 "difference",
190 189 "digest 0.10.7",
191 190 "dirs",
192 - "elliptic-curve 0.13.8",
191 + "elliptic-curve",
193 192 "env_logger",
194 193 "figment",
195 194 "filetime",
@@ -204,12 +203,12 @@ dependencies = [
204 203 "oid-registry 0.7.1",
205 204 "once_cell",
206 205 "p12",
207 - "p256 0.13.2",
206 + "p256",
208 207 "pem",
209 208 "pkcs1",
210 - "pkcs8 0.10.2",
209 + "pkcs8",
211 210 "plist",
212 - "rand 0.8.5",
211 + "rand 0.8.6",
213 212 "rasn",
214 213 "rayon",
215 214 "regex",
@@ -224,10 +223,10 @@ dependencies = [
224 223 "serde_json",
225 224 "serde_yaml",
226 225 "sha2 0.10.9",
227 - "signature 2.2.0",
226 + "signature",
228 227 "simple-file-manifest",
229 228 "spake2",
230 - "spki 0.7.3",
229 + "spki",
231 230 "subtle",
232 231 "tempfile",
233 232 "thiserror 2.0.18",
@@ -276,14 +275,14 @@ dependencies = [
276 275 "flate2",
277 276 "log",
278 277 "md-5 0.10.6",
279 - "rand 0.8.5",
278 + "rand 0.8.6",
280 279 "reqwest",
281 280 "scroll 0.12.0",
282 281 "serde",
283 282 "serde-xml-rs",
284 283 "sha1 0.10.6",
285 284 "sha2 0.10.9",
286 - "signature 2.2.0",
285 + "signature",
287 286 "thiserror 2.0.18",
288 287 "url",
289 288 "x509-certificate",
@@ -301,6 +300,15 @@ dependencies = [
301 300 ]
302 301
303 302 [[package]]
303 + name = "arc-swap"
304 + version = "1.9.2"
305 + source = "registry+https://github.com/rust-lang/crates.io-index"
306 + checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
307 + dependencies = [
308 + "rustversion",
309 + ]
310 +
311 + [[package]]
304 312 name = "argon2"
305 313 version = "0.5.3"
306 314 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -314,9 +322,9 @@ dependencies = [
314 322
315 323 [[package]]
316 324 name = "arrayvec"
317 - version = "0.7.6"
325 + version = "0.7.7"
318 326 source = "registry+https://github.com/rust-lang/crates.io-index"
319 - checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
327 + checksum = "f02882884d3e1bc524fb12c79f107f6ad0e1cfd498c536ffb494301740995dfe"
320 328
321 329 [[package]]
322 330 name = "ascii_tree"
@@ -348,10 +356,10 @@ dependencies = [
348 356 "memchr",
349 357 "proc-macro2",
350 358 "quote",
351 - "rustc-hash 2.1.1",
359 + "rustc-hash 2.1.2",
352 360 "serde",
353 361 "serde_derive",
354 - "syn 2.0.117",
362 + "syn 2.0.118",
355 363 ]
356 364
357 365 [[package]]
@@ -384,9 +392,9 @@ dependencies = [
384 392
385 393 [[package]]
386 394 name = "asn1-rs"
387 - version = "0.7.1"
395 + version = "0.7.2"
388 396 source = "registry+https://github.com/rust-lang/crates.io-index"
389 - checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60"
397 + checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
390 398 dependencies = [
391 399 "asn1-rs-derive 0.6.0",
392 400 "asn1-rs-impl",
@@ -406,7 +414,7 @@ checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
406 414 dependencies = [
407 415 "proc-macro2",
408 416 "quote",
409 - "syn 2.0.117",
417 + "syn 2.0.118",
410 418 "synstructure",
411 419 ]
412 420
@@ -418,7 +426,7 @@ checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
418 426 dependencies = [
419 427 "proc-macro2",
420 428 "quote",
421 - "syn 2.0.117",
429 + "syn 2.0.118",
422 430 "synstructure",
423 431 ]
424 432
@@ -430,7 +438,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
430 438 dependencies = [
431 439 "proc-macro2",
432 440 "quote",
433 - "syn 2.0.117",
441 + "syn 2.0.118",
434 442 ]
435 443
436 444 [[package]]
@@ -462,20 +470,20 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
462 470 dependencies = [
463 471 "proc-macro2",
464 472 "quote",
465 - "syn 2.0.117",
473 + "syn 2.0.118",
466 474 ]
467 475
468 476 [[package]]
469 477 name = "async-stripe"
470 - version = "1.0.0-rc.5"
478 + version = "1.0.0-rc.6"
471 479 source = "registry+https://github.com/rust-lang/crates.io-index"
472 - checksum = "03ec8493f89fb9d9ac1848988955ec192df8e0ebf4d4bbd85fd93df9f681e890"
480 + checksum = "fbbfb37a60928c837f3d1db41ed9561a69e86052e5ea11451bfc8406fd22d99e"
473 481 dependencies = [
474 482 "async-stripe-client-core",
475 483 "async-stripe-shared",
476 484 "bytes",
477 485 "http-body-util",
478 - "hyper 1.8.1",
486 + "hyper 1.10.1",
479 487 "hyper-tls",
480 488 "hyper-util",
481 489 "miniserde",
@@ -486,9 +494,9 @@ dependencies = [
486 494
487 495 [[package]]
488 496 name = "async-stripe-billing"
489 - version = "1.0.0-rc.5"
497 + version = "1.0.0-rc.6"
490 498 source = "registry+https://github.com/rust-lang/crates.io-index"
491 - checksum = "e2340b289cd5e34bb9b8b3eebed4e7a9729831ebee01388965ad4d88fd7a5a3b"
499 + checksum = "7cc8d927d27943b360584e527524efba0bc92c15cee39e33efee64c0727e9e2a"
492 500 dependencies = [
493 501 "async-stripe-client-core",
494 502 "async-stripe-shared",
@@ -502,9 +510,9 @@ dependencies = [
502 510
503 511 [[package]]
504 512 name = "async-stripe-checkout"
505 - version = "1.0.0-rc.5"
513 + version = "1.0.0-rc.6"
506 514 source = "registry+https://github.com/rust-lang/crates.io-index"
507 - checksum = "d23c5f0fbbc4fef893e1c673438687e0b4e7970171fbf9fd011911643200e1b3"
515 + checksum = "1a7cc969611dc770fbffe5520128d53fb7618f2f64cacdcc5fdc80066042bd92"
508 516 dependencies = [
509 517 "async-stripe-client-core",
510 518 "async-stripe-shared",
@@ -518,9 +526,9 @@ dependencies = [
518 526
519 527 [[package]]
520 528 name = "async-stripe-client-core"
521 - version = "1.0.0-rc.5"
529 + version = "1.0.0-rc.6"
522 530 source = "registry+https://github.com/rust-lang/crates.io-index"
523 - checksum = "10f095837711eb1c3ee02604b4e1d44b117014fb74da99ad4f2d70e907dbdc41"
531 + checksum = "fb102f82be32b4be0af662746ecc1b632371903eb096e8d840505431277e090c"
524 532 dependencies = [
525 533 "async-stripe-shared",
526 534 "async-stripe-types",
@@ -536,9 +544,9 @@ dependencies = [
536 544
537 545 [[package]]
538 546 name = "async-stripe-connect"
539 - version = "1.0.0-rc.5"
547 + version = "1.0.0-rc.6"
540 548 source = "registry+https://github.com/rust-lang/crates.io-index"
541 - checksum = "12156e6b2118316feb9c51edef29a2705a5a653a60da03ff592936dd5dbbb0b2"
549 + checksum = "ecf55fcf7e4ef8174a80af33586342a20eef7bdbe86c6d77f0459747c6e5561a"
542 550 dependencies = [
543 551 "async-stripe-client-core",
544 552 "async-stripe-shared",
@@ -552,9 +560,9 @@ dependencies = [
552 560
553 561 [[package]]
554 562 name = "async-stripe-core"
555 - version = "1.0.0-rc.5"
563 + version = "1.0.0-rc.6"
556 564 source = "registry+https://github.com/rust-lang/crates.io-index"
557 - checksum = "ee9710c3d64db48dda1ec0b4976d091b7f40cabc8ed7bcab9e93b608b70b405c"
565 + checksum = "d0a62f29770d512604b6b85e977ec692f7fe31449a6af1c2ad39a4a3559992b3"
558 566 dependencies = [
559 567 "async-stripe-client-core",
560 568 "async-stripe-shared",
@@ -568,9 +576,9 @@ dependencies = [
568 576
569 577 [[package]]
570 578 name = "async-stripe-payment"
571 - version = "1.0.0-rc.5"
579 + version = "1.0.0-rc.6"
572 580 source = "registry+https://github.com/rust-lang/crates.io-index"
573 - checksum = "f57b37183dd9fcb700af54acc49e0dbd738b3f4596b0feb486c5d2dab0d22bac"
581 + checksum = "9063ec5de6b3c6ea14141911fd55eb2e54051acc9c0223b4ce7f938295f587fb"
574 582 dependencies = [
575 583 "async-stripe-client-core",
576 584 "async-stripe-shared",
@@ -584,9 +592,9 @@ dependencies = [
584 592
585 593 [[package]]
586 594 name = "async-stripe-product"
587 - version = "1.0.0-rc.5"
595 + version = "1.0.0-rc.6"
588 596 source = "registry+https://github.com/rust-lang/crates.io-index"
589 - checksum = "ec3ca828f2568de98ac380c851519e7f1c4ef41beee801d3e8f5744ee93c8c53"
597 + checksum = "7453e7a781fe3f4933b3662dd174b7b6aa02e0e96a77b2c8945732ba132f1392"
590 598 dependencies = [
591 599 "async-stripe-client-core",
592 600 "async-stripe-shared",
@@ -600,9 +608,9 @@ dependencies = [
600 608
601 609 [[package]]
602 610 name = "async-stripe-shared"
603 - version = "1.0.0-rc.5"
611 + version = "1.0.0-rc.6"
604 612 source = "registry+https://github.com/rust-lang/crates.io-index"
605 - checksum = "a352c5e36a92aa8bdd4326c8211b9a26e822e6cb4b7516a47282396a4938a231"
613 + checksum = "80a31d49bf137889e1ece81c2aca94d144c041815388df5b8616a787e7beb611"
606 614 dependencies = [
607 615 "async-stripe-types",
608 616 "miniserde",
@@ -614,9 +622,9 @@ dependencies = [
614 622
615 623 [[package]]
616 624 name = "async-stripe-types"
617 - version = "1.0.0-rc.5"
625 + version = "1.0.0-rc.6"
618 626 source = "registry+https://github.com/rust-lang/crates.io-index"
619 - checksum = "8e1ec9960b89b1f556bf885403dd208d173a8c42d028fcd7baeca9ad2bfb13f6"
627 + checksum = "b461a9cc3cd14d56843aa9eced46b3d0e8c1937a2c735e224be5c6e529258c22"
620 628 dependencies = [
621 629 "miniserde",
622 630 "serde",
@@ -632,7 +640,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
632 640 dependencies = [
633 641 "proc-macro2",
634 642 "quote",
635 - "syn 2.0.117",
643 + "syn 2.0.118",
636 644 ]
637 645
638 646 [[package]]
@@ -667,27 +675,27 @@ checksum = "86c421a87e3dd1a3024c86e0787106b6ba40d9b434fe0ebeffbd24a242dc144d"
667 675 dependencies = [
668 676 "cms",
669 677 "const-oid 0.9.6",
670 - "der 0.7.10",
678 + "der",
671 679 "digest 0.10.7",
672 680 "object 0.37.3",
673 681 "rsa",
674 682 "sha1 0.10.6",
675 683 "sha2 0.10.9",
676 - "spki 0.7.3",
684 + "spki",
677 685 "x509-cert",
678 686 ]
679 687
680 688 [[package]]
681 689 name = "autocfg"
682 - version = "1.5.0"
690 + version = "1.5.1"
683 691 source = "registry+https://github.com/rust-lang/crates.io-index"
684 - checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
692 + checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
685 693
686 694 [[package]]
687 695 name = "aws-config"
688 - version = "1.8.15"
696 + version = "1.8.18"
689 697 source = "registry+https://github.com/rust-lang/crates.io-index"
690 - checksum = "11493b0bad143270fb8ad284a096dd529ba91924c5409adeac856cc1bf047dbc"
698 + checksum = "e33f815b73a3899c03b380d543532e5865f230dce9678d108dc10732a8682275"
691 699 dependencies = [
692 700 "aws-credential-types",
693 701 "aws-runtime",
@@ -699,12 +707,13 @@ dependencies = [
699 707 "aws-smithy-json",
700 708 "aws-smithy-runtime",
701 709 "aws-smithy-runtime-api",
710 + "aws-smithy-schema",
702 711 "aws-smithy-types",
703 712 "aws-types",
704 713 "bytes",
705 714 "fastrand",
706 715 "hex",
707 - "http 1.4.0",
716 + "http 1.4.2",
708 717 "sha1 0.10.6",
709 718 "time",
710 719 "tokio",
@@ -727,9 +736,9 @@ dependencies = [
727 736
728 737 [[package]]
729 738 name = "aws-lc-rs"
730 - version = "1.16.2"
739 + version = "1.17.1"
731 740 source = "registry+https://github.com/rust-lang/crates.io-index"
732 - checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
741 + checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
733 742 dependencies = [
734 743 "aws-lc-sys",
735 744 "zeroize",
@@ -737,21 +746,22 @@ dependencies = [
737 746
738 747 [[package]]
739 748 name = "aws-lc-sys"
740 - version = "0.39.0"
749 + version = "0.42.0"
741 750 source = "registry+https://github.com/rust-lang/crates.io-index"
742 - checksum = "1fa7e52a4c5c547c741610a2c6f123f3881e409b714cd27e6798ef020c514f0a"
751 + checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
743 752 dependencies = [
744 753 "cc",
745 754 "cmake",
746 755 "dunce",
747 756 "fs_extra",
757 + "pkg-config",
748 758 ]
749 759
750 760 [[package]]
751 761 name = "aws-runtime"
752 - version = "1.7.3"
762 + version = "1.7.5"
753 763 source = "registry+https://github.com/rust-lang/crates.io-index"
754 - checksum = "5dcd93c82209ac7413532388067dce79be5a8780c1786e5fae3df22e4dee2864"
764 + checksum = "6c9b9de216a988dd54b754a82a7660cfe14cee4f6782ae4524470972fa0ccb39"
755 765 dependencies = [
756 766 "aws-credential-types",
757 767 "aws-sigv4",
@@ -766,7 +776,7 @@ dependencies = [
766 776 "bytes-utils",
767 777 "fastrand",
768 778 "http 0.2.12",
769 - "http 1.4.0",
779 + "http 1.4.2",
770 780 "http-body 0.4.6",
771 781 "http-body 1.0.1",
772 782 "percent-encoding",
@@ -777,10 +787,11 @@ dependencies = [
777 787
778 788 [[package]]
779 789 name = "aws-sdk-s3"
780 - version = "1.131.0"
790 + version = "1.137.0"
781 791 source = "registry+https://github.com/rust-lang/crates.io-index"
782 - checksum = "fe1b8c5282bf859170836045296b3cd710b7573aceb909498366bb508a41058e"
792 + checksum = "c2dd7213994e2ff9382ff100403b78c30d1b74cdfcd8fa9d0d1dc3a94a5c4874"
783 793 dependencies = [
794 + "arc-swap",
784 795 "aws-credential-types",
785 796 "aws-runtime",
786 797 "aws-sigv4",
@@ -800,7 +811,7 @@ dependencies = [
800 811 "hex",
801 812 "hmac 0.13.0",
802 813 "http 0.2.12",
803 - "http 1.4.0",
814 + "http 1.4.2",
804 815 "http-body 1.0.1",
805 816 "lru",
806 817 "percent-encoding",
@@ -812,10 +823,11 @@ dependencies = [
812 823
813 824 [[package]]
814 825 name = "aws-sdk-sso"
815 - version = "1.97.0"
826 + version = "1.102.0"
816 827 source = "registry+https://github.com/rust-lang/crates.io-index"
817 - checksum = "9aadc669e184501caaa6beafb28c6267fc1baef0810fb58f9b205485ca3f2567"
828 + checksum = "8c82b3ac19f1431854f7ace3a7531674633e286bfdde21976893bfee36fd493b"
818 829 dependencies = [
830 + "arc-swap",
819 831 "aws-credential-types",
820 832 "aws-runtime",
821 833 "aws-smithy-async",
@@ -829,17 +841,18 @@ dependencies = [
829 841 "bytes",
830 842 "fastrand",
831 843 "http 0.2.12",
832 - "http 1.4.0",
844 + "http 1.4.2",
833 845 "regex-lite",
834 846 "tracing",
835 847 ]
836 848
837 849 [[package]]
838 850 name = "aws-sdk-ssooidc"
839 - version = "1.99.0"
851 + version = "1.104.0"
840 852 source = "registry+https://github.com/rust-lang/crates.io-index"
841 - checksum = "1342a7db8f358d3de0aed2007a0b54e875458e39848d54cc1d46700b2bfcb0a8"
853 + checksum = "321000d2b4c5519ee573f73167f612efd7329322d9b26969ad1979f0427f1913"
842 854 dependencies = [
855 + "arc-swap",
843 856 "aws-credential-types",
844 857 "aws-runtime",
845 858 "aws-smithy-async",
@@ -853,17 +866,18 @@ dependencies = [
853 866 "bytes",
854 867 "fastrand",
855 868 "http 0.2.12",
856 - "http 1.4.0",
869 + "http 1.4.2",
857 870 "regex-lite",
858 871 "tracing",
859 872 ]
860 873
861 874 [[package]]
862 875 name = "aws-sdk-sts"
863 - version = "1.101.0"
876 + version = "1.107.0"
864 877 source = "registry+https://github.com/rust-lang/crates.io-index"
865 - checksum = "ab41ad64e4051ecabeea802d6a17845a91e83287e1dd249e6963ea1ba78c428a"
878 + checksum = "3d0d328ba962af23ecfa3c9f23b98d3d35e325fa218d7f13d17a6bf522f8a560"
866 879 dependencies = [
880 + "arc-swap",
867 881 "aws-credential-types",
868 882 "aws-runtime",
869 883 "aws-smithy-async",
@@ -878,16 +892,16 @@ dependencies = [
878 892 "aws-types",
Lines truncated
M server/Cargo.toml +12 -12
@@ -132,21 +132,21 @@ semver = "1"
132 132 # S3 Storage
133 133 s3-storage = { path = "../shared/s3-storage" }
134 134
135 - # Stripe Payments — async-stripe 1.0.0-rc.5 (split into sub-crates).
135 + # Stripe Payments — async-stripe 1.0.0-rc.6 (split into sub-crates).
136 136 # The umbrella `async-stripe` provides the HTTP client; resource types live in
137 137 # per-domain sub-crates. The `deserialize` feature on each resource crate is
138 138 # required to derive `serde::Deserialize` on Subscription, Invoice, etc — we
139 - # parse them from webhook payloads ourselves (no built-in webhook helper in
140 - # rc.5; see `payments::webhooks::verify_signature` for our HMAC check).
141 - async-stripe = { version = "1.0.0-rc.5", features = ["default-tls"] }
142 - async-stripe-shared = { version = "1.0.0-rc.5", features = ["deserialize"] }
143 - async-stripe-billing = { version = "1.0.0-rc.5", features = ["deserialize", "subscription", "billing_portal_session"] }
144 - async-stripe-checkout = { version = "1.0.0-rc.5", features = ["deserialize", "checkout_session"] }
145 - async-stripe-connect = { version = "1.0.0-rc.5", features = ["deserialize", "account", "account_link", "transfer"] }
146 - async-stripe-core = { version = "1.0.0-rc.5", features = ["deserialize", "balance", "refund", "customer"] }
147 - async-stripe-payment = { version = "1.0.0-rc.5", features = ["deserialize"] }
148 - async-stripe-product = { version = "1.0.0-rc.5", features = ["deserialize", "product", "price"] }
149 - async-stripe-types = { version = "1.0.0-rc.5", features = ["deserialize"] }
139 + # parse them from webhook payloads ourselves (no built-in webhook helper in the
140 + # rc line; see `payments::webhooks::verify_signature` for our HMAC check).
141 + async-stripe = { version = "1.0.0-rc.6", features = ["default-tls"] }
142 + async-stripe-shared = { version = "1.0.0-rc.6", features = ["deserialize"] }
143 + async-stripe-billing = { version = "1.0.0-rc.6", features = ["deserialize", "subscription", "billing_portal_session"] }
144 + async-stripe-checkout = { version = "1.0.0-rc.6", features = ["deserialize", "checkout_session"] }
145 + async-stripe-connect = { version = "1.0.0-rc.6", features = ["deserialize", "account", "account_link", "transfer"] }
146 + async-stripe-core = { version = "1.0.0-rc.6", features = ["deserialize", "balance", "refund", "customer"] }
147 + async-stripe-payment = { version = "1.0.0-rc.6", features = ["deserialize"] }
148 + async-stripe-product = { version = "1.0.0-rc.6", features = ["deserialize", "product", "price"] }
149 + async-stripe-types = { version = "1.0.0-rc.6", features = ["deserialize"] }
150 150 reqwest = { version = "0.12", features = ["json", "cookies"] }
151 151 urlencoding = "2.1.3"
152 152
M server/deploy/run-ci.sh +4 -3
@@ -83,9 +83,10 @@ run_step "cargo clippy" cargo clippy --features fast-tests --all-targets -- -D w
83 83
84 84 # Step 5: Security audit (optional)
85 85 if command -v cargo-audit &>/dev/null; then
86 - # Ignore known unfixable advisories:
87 - # RUSTSEC-2023-0071: rsa via sqlx-mysql (MNW uses Postgres, not affected)
88 - run_step "cargo audit" cargo audit --ignore RUSTSEC-2023-0071
86 + # Ignored advisories + rationale live in .cargo/audit.toml (each is a
87 + # transitive advisory we can't fix by bumping our own deps). Directly-fixable
88 + # advisories are fixed in Cargo.toml, never parked in the ignore list.
89 + run_step "cargo audit" cargo audit
89 90 else
90 91 echo ""
91 92 echo "[skip] cargo-audit not installed (cargo install cargo-audit)"