Skip to content

fix: update idna to resolve CVE-2024-12224#3

Draft
dannyneira wants to merge 1 commit into
mainfrom
independabot/idna-CVE-2024-12224
Draft

fix: update idna to resolve CVE-2024-12224#3
dannyneira wants to merge 1 commit into
mainfrom
independabot/idna-CVE-2024-12224

Conversation

@dannyneira
Copy link
Copy Markdown
Member

Summary

Details

  • idna was pulled in transitively through url -> tungstenite 0.21 -> tokio-tungstenite -> axum -> async-graphql-axum.
  • No direct dependency was added; the lockfile was refreshed with cargo update -p url --precise 2.5.7 so the existing dependency graph resolves to patched idna 1.1.0.
  • No Dependabot error was present for this alert.

Verification

  • cargo tree -i idna shows idna v1.1.0.
  • cargo audit no longer reports CVE-2024-12224 / GHSA-h97m-ww89-6jmq; it still reports unrelated pre-existing advisories for other packages.
  • cargo build passes.
  • cargo test passes.

Conversation: https://staging.warp.dev/conversation/037d7257-35d0-4480-b311-9a4b8441ecf8
Run: https://oz.staging.warp.dev/runs/019e36aa-7c51-76af-885c-8b70061e1ab5
This PR was generated with Oz.

Co-Authored-By: Oz <oz-agent@warp.dev>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant