Commit f03e9e1
fix(deps): bump openssl 0.10.78 -> 0.10.80 (closes 3 Dependabot alerts) (#46)
Three open Dependabot alerts on the panll default branch (1 high, 2
moderate) all pointed at the transitive `openssl` crate pulled in via
`reqwest = "0.12"`:
#12 (HIGH) GHSA-… — X509Ref::ocsp_responders UB on non-UTF-8
OCSP URLs (patched in 0.10.79)
#13 (medium) rust-openssl heap buffer overflow when encrypting
with AES key-wrap-with-padding (patched in 0.10.79)
#14 (medium) rust-openssl potential OOB write in
CipherCtxRef::cipher_update_inplace for AES-KW-PAD
ciphers (patched in 0.10.80)
Bumping to 0.10.80 (the highest patched-version requirement) closes
all three at once. Lockfile-only change — no Cargo.toml touched, no
behaviour change in panll. openssl-sys is dragged from 0.9.114 to
0.9.116 as required by the openssl bump.
GitHub flagged these on push of the standards#93 .gitignore PR (#45);
unrelated to that PR's scope, addressed separately here.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>1 parent 04acd06 commit f03e9e1
1 file changed
Lines changed: 4 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments