Skip to content

Commit f03e9e1

Browse files
fix(deps): bump openssl 0.10.78 -> 0.10.80 (closes 3 Dependabot alerts) (#46)
Three open Dependabot alerts on the panll default branch (1 high, 2 moderate) all pointed at the transitive `openssl` crate pulled in via `reqwest = "0.12"`: #12 (HIGH) GHSA-… — X509Ref::ocsp_responders UB on non-UTF-8 OCSP URLs (patched in 0.10.79) #13 (medium) rust-openssl heap buffer overflow when encrypting with AES key-wrap-with-padding (patched in 0.10.79) #14 (medium) rust-openssl potential OOB write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (patched in 0.10.80) Bumping to 0.10.80 (the highest patched-version requirement) closes all three at once. Lockfile-only change — no Cargo.toml touched, no behaviour change in panll. openssl-sys is dragged from 0.9.114 to 0.9.116 as required by the openssl bump. GitHub flagged these on push of the standards#93 .gitignore PR (#45); unrelated to that PR's scope, addressed separately here. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 04acd06 commit f03e9e1

1 file changed

Lines changed: 4 additions & 5 deletions

File tree

Cargo.lock

Lines changed: 4 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)