starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 19:25:56 +03:00

[GH-ISSUE #2661] hickory-proto 0.24.1 is affected by RUSTSEC-2024-0421 #1040

New issue

Closed

opened 2026-03-16 01:24:41 +03:00 by kerem · 6 comments

kerem commented

2026-03-16 01:24:41 +03:00

Owner

Originally created by @MarkusPettersson98 on GitHub (Dec 9, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2661

Hello!

Just want to let you know that the latest release of hickory-proto is affected by RUSTSEC-2024-0421 because of its dependence on idna 0.4.0. The solution is to upgrade to idna 1.0.0 (at least), which was done in the 0.25.4-alpha.4 release.

Originally created by @MarkusPettersson98 on GitHub (Dec 9, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2661 Hello! Just want to let you know that the latest release of `hickory-proto` is affected by [RUSTSEC-2024-0421](https://rustsec.org/advisories/RUSTSEC-2024-0421) because of its dependence on `idna 0.4.0`. The solution is to upgrade to `idna 1.0.0` (at least), which was done in the [`0.25.4-alpha.4 release`](https://github.com/hickory-dns/hickory-dns/releases/tag/v0.25.0-alpha.4).

kerem closed this issue

2026-03-16 01:24:46 +03:00

kerem commented

2026-03-16 01:24:52 +03:00

Author

Owner

@djc commented on GitHub (Dec 9, 2024):

Yes, we're aware. For now, the recommended mitigation is to upgrade to 0.25.0-alpha.4, although I guess we could probably release a 0.24.2 if there's strong demand for it.

@djc commented on GitHub (Dec 9, 2024): Yes, we're aware. For now, the recommended mitigation is to upgrade to 0.25.0-alpha.4, although I guess we could probably release a 0.24.2 if there's strong demand for it.

kerem commented

2026-03-16 01:24:57 +03:00

Author

Owner

@svix-jplatte commented on GitHub (Dec 9, 2024):

Upgrading to the alpha is only really an option if the only dependency on hickory is your own, rather than an indirect one (e.g. via reqwest's hickory-dns feature). A patch release would be appreciated.

@svix-jplatte commented on GitHub (Dec 9, 2024): Upgrading to the alpha is only really an option if the only dependency on hickory is your own, rather than an indirect one (e.g. via reqwest's `hickory-dns` feature). A patch release would be appreciated.

kerem commented

2026-03-16 01:25:02 +03:00

Author

Owner

@DDtKey commented on GitHub (Dec 9, 2024):

First of all, thank you for the maintenance!

I've temporary switched to a patched version from my fork, and probably it can be an option to release 0.24.2?
I've opened a PR just in case https://github.com/hickory-dns/hickory-dns/pull/2662

Because waiting major release is an issue, it involves many transient deps. Updating a patch version is much simpler to fix vulnerability

Currently, if anyone interested in using my workaround, here it is:

[patch.crates-io]
proto = { package = "hickory-proto", git = "https://github.com/DDtKey/hickory-dns.git", branch = "release-0.24/patch-idna" }

@DDtKey commented on GitHub (Dec 9, 2024): First of all, thank you for the maintenance! I've temporary switched to a patched version from my fork, and probably it can be an option to release `0.24.2`? I've opened a PR just in case https://github.com/hickory-dns/hickory-dns/pull/2662 Because waiting major release is an issue, it involves many transient deps. Updating a patch version is much simpler to fix vulnerability Currently, if anyone interested in using my workaround, here it is: ``` [patch.crates-io] proto = { package = "hickory-proto", git = "https://github.com/DDtKey/hickory-dns.git", branch = "release-0.24/patch-idna" } ```

kerem commented

2026-03-16 01:25:07 +03:00

Author

Owner

@x86pup commented on GitHub (Dec 9, 2024):

A 0.24.2 release would be appreciated. My project uses 0.24.1 for now as there are some breaking changes in 0.25.0, so we can't upgrade at the moment.

@x86pup commented on GitHub (Dec 9, 2024): A 0.24.2 release would be appreciated. My project uses 0.24.1 for now as there are some breaking changes in 0.25.0, so we can't upgrade at the moment.

kerem commented

2026-03-16 01:25:12 +03:00

Author

Owner

@MarkusPettersson98 commented on GitHub (Dec 9, 2024):

We would also appreciate a patch release, even though it is not critical 😊

@MarkusPettersson98 commented on GitHub (Dec 9, 2024): We would also appreciate a patch release, even though it is not critical :blush:

kerem commented

2026-03-16 01:25:17 +03:00

Author

Owner

@djc commented on GitHub (Dec 10, 2024):

We've released 0.24.2 versions of all the crates. @DDtKey thanks for your efforts on fixing this!

@djc commented on GitHub (Dec 10, 2024): We've released 0.24.2 versions of all the crates. @DDtKey thanks for your efforts on fixing this!

kerem referenced this issue

2026-03-16 03:27:24 +03:00

[PR #1040] [CLOSED] Bump h2 from 0.2.1 to 0.2.2 #1908