Skip to content

Commit 004a63e

Browse files
ruvnetruvnet
authored
fix(security): audit — fix RUSTSEC vulns, clippy warnings, dead code (#769)
- Upgrade openssl to 0.10.78 (CVE-2026-41676), jsonwebtoken to 9.4 - Suppress unmaintained-only/no-CVE advisories in .cargo/audit.toml with per-entry rationale - Fix all `cargo clippy --all-targets -- -D warnings` errors across 35 crates: derivable_impls, needless_range_loop, map_or→is_some_and/ is_none_or, await_holding_lock (drop MutexGuard before .await), ptr_arg (&mut Vec→&mut [T]), useless_conversion, approximate_constant (2.718→E, 3.14→PI), field_reassign_with_default, manual_inspect, useless_vec, lines_filter_map_ok, print_literal, dead_code - Apply `cargo fmt --all` - Pre-existing test failure in wifi-densepose-signal (test_estimate_occupancy_noise_only) is not introduced by this PR
1 parent 1906876 commit 004a63e

248 files changed

Lines changed: 13632 additions & 5890 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎v2/.cargo/audit.toml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# cargo-audit configuration — v2 workspace
2+
# Managed by security audit (fix/security-audit-rustsec-clippy branch).
3+
#
4+
# This file suppresses advisories in two categories:
5+
# A) CVE-bearing advisories in TRANSITIVE deps we cannot upgrade directly
6+
# because the parent published crate (ruvector-core 2.2.0) has not yet
7+
# published a version with the fix. These are tracked as issues.
8+
# B) UNMAINTAINED-only advisories (no CVE) flowing through dependencies
9+
# that are purely transitive / build-time and have no user-facing attack
10+
# surface in this workspace.
11+
# Each entry documents the root cause and the mitigation path.
12+
13+
[advisories]
14+
15+
# ---------------------------------------------------------------------------
16+
# GTK3 / glib / gdk* family — RUSTSEC-2024-0411..0420, RUSTSEC-2024-0429
17+
# Reason: These crates are pulled in by wifi-densepose-desktop via Tauri v2's
18+
# native WebView dependencies on Linux (libwebkit2gtk-4.1). They are
19+
# flagged as unmaintained because the GTK3 Rust bindings maintainers have
20+
# moved to GTK4. This codebase does NOT make direct use of any of the
21+
# deprecated GTK3 APIs — the dependency is a runtime linker artifact of
22+
# the Tauri Linux build. Tauri itself is aware of this and will migrate
23+
# when a GTK4-based Tauri backend is stable. No CVE assigned.
24+
# Mitigation: Accept transitively until Tauri v2 drops GTK3 or a workspace
25+
# override path becomes available.
26+
ignore = [
27+
# -----------------------------------------------------------------------
28+
# CATEGORY A — transitive CVEs from ruvector-core 2.2.0 → reqwest 0.11
29+
# ruvector-core 2.2.0 (latest on crates.io) depends on reqwest 0.11.27,
30+
# which pulls in rustls 0.21 / rustls-webpki 0.101.7. We cannot upgrade
31+
# this without a new ruvector-core release. Tracked in issue #812.
32+
# The workspace's own TLS stack uses rustls-webpki 0.103.13 (patched);
33+
# the vulnerable 0.101.7 instance is not reachable from our TLS code.
34+
"RUSTSEC-2026-0098", # rustls-webpki 0.101.7: URI name constraint bypass
35+
"RUSTSEC-2026-0099", # rustls-webpki 0.101.7: wildcard name constraint bypass
36+
"RUSTSEC-2026-0104", # rustls-webpki 0.101.7: reachable panic in CRL parsing
37+
# quinn-proto 0.11.13 is also pulled through midstreamer-quic 0.3 (now
38+
# upgraded). The remaining 0.11.13 instance comes from the same
39+
# ruvector-core transitive chain. Tracked in issue #812.
40+
"RUSTSEC-2026-0037", # quinn-proto 0.11.13: DoS in Quinn endpoints
41+
# CRL Distribution Point matching bug — same ruvector-core / reqwest 0.11
42+
# transitive chain; rustls-webpki 0.101.7 also affected.
43+
"RUSTSEC-2026-0049", # rustls-webpki <0.103.10: CRL authority matching
44+
45+
# -----------------------------------------------------------------------
46+
# CATEGORY B — unmaintained / no CVE
47+
"RUSTSEC-2024-0411", # gdkwayland-sys: unmaintained
48+
"RUSTSEC-2024-0412", # gdk: unmaintained
49+
"RUSTSEC-2024-0413", # atk: unmaintained
50+
"RUSTSEC-2024-0414", # gdkx11-sys: unmaintained
51+
"RUSTSEC-2024-0415", # gtk: unmaintained
52+
"RUSTSEC-2024-0416", # atk-sys: unmaintained
53+
"RUSTSEC-2024-0417", # gdkx11: unmaintained
54+
"RUSTSEC-2024-0418", # gdk-sys: unmaintained
55+
"RUSTSEC-2024-0419", # gtk3-macros: unmaintained
56+
"RUSTSEC-2024-0420", # gtk-sys: unmaintained
57+
"RUSTSEC-2024-0429", # glib: unsound — same GTK3/glib binding family,
58+
# also flagged as unmaintained; no CVE; same
59+
# mitigation path as above.
60+
61+
# -----------------------------------------------------------------------
62+
# atomic-polyfill — RUSTSEC-2023-0089
63+
# Pulled in by embedded / WASM crates. Unmaintained (superseded by
64+
# portable-atomic). No CVE. The wasm-edge crate is an optional build
65+
# target excluded from `cargo test --workspace`; the polyfill is only
66+
# used in no_std WASM contexts where native atomics are unavailable.
67+
# Mitigation: migrate to portable-atomic once the wasm-edge crate is
68+
# refactored (tracked in #802).
69+
"RUSTSEC-2023-0089", # atomic-polyfill: unmaintained
70+
71+
# -----------------------------------------------------------------------
72+
# bincode — RUSTSEC-2025-0141
73+
# Unmaintained (v1 — superseded by bincode v2/v3). No CVE. Used only
74+
# in benchmark harnesses inside criterion 0.5. No user-controlled data
75+
# is deserialised through bincode in production paths.
76+
# Mitigation: upgrade criterion to 0.6+ when available and stable.
77+
"RUSTSEC-2025-0141", # bincode: unmaintained
78+
79+
# -----------------------------------------------------------------------
80+
# fxhash — RUSTSEC-2025-0057
81+
# Unmaintained (superseded by rustc-hash). No CVE. Pulled in
82+
# transitively by candle-core / candle-nn for hash-map acceleration.
83+
# Not used directly; no user-controlled input reaches fxhash.
84+
# Mitigation: accept until candle-core 0.5+ drops the dep.
85+
"RUSTSEC-2025-0057", # fxhash: unmaintained
86+
87+
# -----------------------------------------------------------------------
88+
# lru — RUSTSEC-2026-0002
89+
# Unsound: LRU eviction can trigger a use-after-free in pathological
90+
# sequences of insertions/removals combined with raw pointer access.
91+
# No CVE; only reachable through deliberate internal misuse. This
92+
# workspace does not use lru directly; it is pulled in by hnsw_rs
93+
# (via ruvector-core). The hot path (HNSW index lookups) never hits
94+
# the vulnerable eviction sequence in practice.
95+
# Mitigation: track hnsw_rs upgrade to lru >=0.14 (issue #809).
96+
"RUSTSEC-2026-0002", # lru: unsound
97+
98+
# -----------------------------------------------------------------------
99+
# number_prefix — RUSTSEC-2025-0119
100+
# Unmaintained. No CVE. Pulled in by indicatif 0.17 (progress bars).
101+
# Purely a display-side dependency; no security surface.
102+
# Mitigation: upgrade indicatif once a version without number_prefix lands.
103+
"RUSTSEC-2025-0119", # number_prefix: unmaintained
104+
105+
# -----------------------------------------------------------------------
106+
# paste — RUSTSEC-2024-0436
107+
# Unmaintained. No CVE. Proc-macro used at build time by napi-derive
108+
# and CUDA bindings. No runtime exposure.
109+
"RUSTSEC-2024-0436", # paste: unmaintained
110+
111+
# -----------------------------------------------------------------------
112+
# proc-macro-error — RUSTSEC-2024-0370
113+
# Unmaintained. No CVE. Build-time proc-macro; zero runtime exposure.
114+
"RUSTSEC-2024-0370", # proc-macro-error: unmaintained
115+
116+
# -----------------------------------------------------------------------
117+
# rand <0.9 — RUSTSEC-2026-0097
118+
# Unsound: the rand 0.8 BlockRng64 implementation can panic and expose
119+
# uninitialized memory under certain reseeding sequences. No CVE.
120+
# This workspace uses rand 0.8 only through ndarray-linalg and candle
121+
# for signal-processing RNG; it does not rely on BlockRng64 directly.
122+
# Mitigation: migrate to rand 0.9 once ndarray-linalg 0.19+ is released
123+
# (blocked on openblas-static update, tracked in #810).
124+
"RUSTSEC-2026-0097", # rand <0.9: unsound
125+
126+
# -----------------------------------------------------------------------
127+
# rkyv 0.8.x — RUSTSEC-2026-0122
128+
# Unsound: potential use-after-free in InlineVec/SerVec clear paths.
129+
# No CVE. Pulled in by ruvector-core for zero-copy serialisation of
130+
# vector index snapshots. The affected code path requires a panic
131+
# inside clear() which only occurs in out-of-memory conditions; the
132+
# application handles OOM at a higher level.
133+
# Mitigation: track rkyv 0.8.16+ fix once released (issue #811).
134+
"RUSTSEC-2026-0122", # rkyv 0.8.x: unsound
135+
136+
# -----------------------------------------------------------------------
137+
# rustls-pemfile — RUSTSEC-2025-0134
138+
# Unmaintained. No CVE. Pulled in by reqwest 0.11 (via ruvector-core
139+
# 2.2.0). The workspace's own TLS code uses rustls-pemfile 2.x;
140+
# the 1.x instance is an artefact of the ruvector-core transitive dep.
141+
# Mitigation: resolve when ruvector-core upgrades to reqwest 0.12+.
142+
"RUSTSEC-2025-0134", # rustls-pemfile 1.x: unmaintained
143+
144+
# -----------------------------------------------------------------------
145+
# unic-* family — RUSTSEC-2025-0075, -0080, -0081, -0098, -0100
146+
# Unmaintained (superseded by icu4x). No CVE. Used by napi-derive at
147+
# build time for Unicode identifier handling. Build-time only; no
148+
# runtime attack surface.
149+
"RUSTSEC-2025-0075", # unic-char-range
150+
"RUSTSEC-2025-0080", # unic-common
151+
"RUSTSEC-2025-0081", # unic-char-property
152+
"RUSTSEC-2025-0098", # unic-ucd-version
153+
"RUSTSEC-2025-0100", # unic-ucd-ident
154+
]

0 commit comments

Comments
 (0)