chore(deps): bump quinn-proto to 0.11.15 (RUSTSEC-2026-0185)#67
Merged
pgrayy merged 1 commit intoJul 17, 2026
Merged
Conversation
cargo audit flags quinn-proto 0.11.14 for RUSTSEC-2026-0185 (remote memory exhaustion via unbounded out-of-order stream reassembly, 7.5 high). The fix is >= 0.11.15. quinn-proto is only present transitively via reqwest -> quinn and is not compiled into the shipped artifact (reqwest uses default-features = false with only rustls-tls; the http3/quinn feature is not enabled). So this is a Cargo.lock hygiene fix, not a runtime exposure. Bumping it clears the audit so the cargo audit step can eventually become gating again (per the continue-on-error TODO in ci.yml). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
opieter-aws
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump
quinn-proto0.11.14→0.11.15inCargo.lock(lockfile-only, 2-line change).Why
cargo auditin the CI security-audit job flags:Does this block the release?
No. Two independent reasons:
cargo auditstep inci.ymliscontinue-on-error: true, so theCI / Security auditjob passes and the release proceeds. The redXon the run is just the annotation surfacing.quinn-protois pulled only transitively viareqwest → quinn → quinn-proto.reqwestis declareddefault-features = falsewith onlyrustls-tls, so thehttp3/quinn feature is never enabled.cargo tree -i quinn-protoreturns nothing, and astringsscan of the built_nativelibrary shows no quinn/QUIC transport code (only rustls/ring TLS QUIC-key-schedule symbols, unrelated). It sits inCargo.lockbut is never compiled in.So this is Cargo.lock hygiene, not a runtime exposure.
Verification
Cargo.locknow pinsquinn-proto 0.11.15; no0.11.14entries remain.cargo auditon this branch:No vulnerabilities reported — RUSTSEC-2026-0185 cleared (previously the only finding).