GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Bump rustix to 1.1.6 by gz · Pull Request #7757 · feldera/feldera

Conversation

@gz

@gz gz commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Lockfile-only bump of rustix, flagged by the container image scan (JFrog Xray, no CVE assigned yet, so Dependabot has no alert).

Crate Old New Advisory
rustix 1.0.7 1.1.6 GHSA-jh2m-fhpj-3vr7, high

The advisory covers the xattr getters, which only the xattr crate (via tar and opendal-service-fs) calls. The move stays within the semver range, so no manifest changes. rustix 1.1.6 pulls linux-raw-sys 0.12.1; the remaining lockfile churn is windows-sys reselection for Windows targets.

Validated: cargo check -p [email protected] passes, pre-commit passes on Cargo.lock.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@gz
Bump rustix to 1.1.6
e09aa5c 
Security scans flag rustix 1.0.7 (GHSA-jh2m-fhpj-3vr7): the xattr getters can hit undefined behavior on zero-size buffers. rustix 1.1.6 is the patched release.

The bump stays within the semver range, so this is a lockfile-only change. It pulls linux-raw-sys 0.12.1; the remaining churn is windows-sys reselection for Windows targets.

Signed-off-by: Gerd Zellweger <[email protected]>
@mythical-fred-oss

mythical-fred-oss Bot commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

LGTM

What I ran (debug, --locked):

Check Result
cargo check -p [email protected] -p tempfile -p xattr -p tar -p fd-lock -p async-io -p polling -p terminal_size ✅
cargo test -p fda (tempfile + rustyline/fd-lock + clap/terminal_size) ✅ 51 passed
cargo tree -i rustix 1.0.7 is gone; only 1.1.6 and 0.38.44 remain
  • No new crates and no new windows-sys versions (still 0.48/0.52/0.59/0.61). The windows-sys downgrades only affect Windows targets.
  • rustix 0.38.44 is still in the lockfile, pulled in by crossterm via comfy-table/arrow-cast. Its xattr getters take &mut [u8], not the 1.x Buffer API, and nothing on that path calls xattr. I don't think it is affected, but the image scan may still list it.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
mihaibudiu
mihaibudiu approved these changes Oct 31, 2026
View reviewed changes
@gz
gz enabled auto-merge October 31, 2026 05:16
@gz
gz added this pull request to the merge queue Oct 31, 2026
Merged via the queue into main with commit f1ca84c Oct 31, 2026
3 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@gz
gz deleted the bump-rustix branch October 31, 2026 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mihaibudiu mihaibudiu mihaibudiu approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@gz @mihaibudiu
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.