[PR #1877] [MERGED] deps: upgrade Tokio 1.21.0 -> 1.24.1 #2665

New issue

Closed

opened 2026-03-16 11:01:40 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:01:40 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/1877
Author: @cpu
Created: 1/9/2023
Status: ✅ Merged
Merged: 1/10/2023
Merged by: @djc

Base: main ← Head: cpu-RUSTSEC-2023-0001

📝 Commits (1)

1056bb4 deps: upgrade Tokio 1.21.0 -> 1.24.1

📊 Changes

1 file changed (+3 additions, -4 deletions)

View changed files

📝 Cargo.lock (+3 -4)

📄 Description

Description

This branch updates the Cargo.lock file with the output produced by cargo update -p tokio, updating Tokio from 1.21.0 to 1.24.1.

Notably this resolves RUSTSEC-2023-0001, which was previously flagged in CI by cargo audit.

Note to reviewers

As a word of warning, there's a decent number of commits between these two tags and the vuln itself seems uninteresting for trust-dns. I'm probably too new to this codebase and the Tokio ecosystem to safely vet the update beyond saying that cargo make test passes locally, so this may require more analysis by a maintainer. It's also possible we could specify a more precise version to cargo update -p tokio to resolve the vuln with less of a semver jump.

Cargo audit

tip of main cargo audit output

[nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD
7232d887d1d0c0ade287e40e09250bf74a9b137a

[nix-shell:~/Code/Rust/trust-dns]$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 478 security advisories (from /home/daniel/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (231 crate dependencies)
Crate:     tokio
Version:   1.21.0
Title:     reject_remote_clients Configuration corruption
Date:      2023-01-04
ID:        RUSTSEC-2023-0001
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0001
Solution:  Upgrade to >=1.18.4, <1.19.0 OR >=1.20.3, <1.21.0 OR >=1.23.1
Dependency tree:
tokio 1.21.0
├── trust-dns-util 0.22.0
├── trust-dns-server 0.22.0
│   ├── trust-dns-integration 0.22.0
│   └── trust-dns 0.22.0
├── trust-dns-resolver 0.22.0
│   ├── trust-dns-util 0.22.0
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-recursor 0.22.0
│   │   ├── trust-dns-util 0.22.0
│   │   ├── trust-dns-server 0.22.0
│   │   └── trust-dns-integration 0.22.0
│   ├── trust-dns-integration 0.22.0
│   ├── trust-dns 0.22.0
│   └── async-std-resolver 0.22.0
├── trust-dns-recursor 0.22.0
├── trust-dns-proto 0.22.0
│   ├── trust-dns-util 0.22.0
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-resolver 0.22.0
│   ├── trust-dns-recursor 0.22.0
│   ├── trust-dns-integration 0.22.0
│   ├── trust-dns-client 0.22.0
│   │   ├── trust-dns-util 0.22.0
│   │   ├── trust-dns-server 0.22.0
│   │   ├── trust-dns-integration 0.22.0
│   │   ├── trust-dns-compatibility 0.22.0
│   │   └── trust-dns 0.22.0
│   └── trust-dns 0.22.0
├── trust-dns-integration 0.22.0
├── trust-dns-client 0.22.0
├── trust-dns 0.22.0
├── tokio-util 0.7.3
│   └── h2 0.3.14
│       ├── trust-dns-server 0.22.0
│       └── trust-dns-proto 0.22.0
├── tokio-rustls 0.23.4
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-resolver 0.22.0
│   └── trust-dns-proto 0.22.0
├── tokio-openssl 0.6.3
│   ├── trust-dns-server 0.22.0
│   ├── trust-dns-resolver 0.22.0
│   └── trust-dns-proto 0.22.0
├── tokio-native-tls 0.3.0
│   ├── trust-dns-resolver 0.22.0
│   └── trust-dns-proto 0.22.0
├── quinn 0.9.0
│   └── trust-dns-proto 0.22.0
└── h2 0.3.14

error: 1 vulnerability found!

branch cargo audit output:

[nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD
1056bb41d4b1a0a58c4d1926ab52dc60fd459a79

[nix-shell:~/Code/Rust/trust-dns]$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 478 security advisories (from /home/daniel/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (231 crate dependencies)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/1877 **Author:** [@cpu](https://github.com/cpu) **Created:** 1/9/2023 **Status:** ✅ Merged **Merged:** 1/10/2023 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `cpu-RUSTSEC-2023-0001` --- ### 📝 Commits (1) - [`1056bb4`](https://github.com/hickory-dns/hickory-dns/commit/1056bb41d4b1a0a58c4d1926ab52dc60fd459a79) deps: upgrade Tokio 1.21.0 -> 1.24.1 ### 📊 Changes **1 file changed** (+3 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+3 -4) </details> ### 📄 Description #### Description This branch updates the `Cargo.lock` file with the output produced by `cargo update -p tokio`, updating Tokio from [1.21.0](https://github.com/tokio-rs/tokio/releases/tag/tokio-1.21.0) to [1.24.1](https://github.com/tokio-rs/tokio/releases/tag/tokio-1.24.1). Notably this resolves [RUSTSEC-2023-0001](https://rustsec.org/advisories/RUSTSEC-2023-0001), which was previously flagged in CI by `cargo audit`. #### Note to reviewers As a word of warning, there's a [decent number of commits](https://github.com/tokio-rs/tokio/compare/tokio-1.21.0...tokio-1.24.1) between these two tags and the vuln itself seems uninteresting for trust-dns. I'm probably too new to this codebase and the Tokio ecosystem to safely vet the update beyond saying that `cargo make test` passes locally, so this may require more analysis by a maintainer. It's also possible we could specify a more precise version to `cargo update -p tokio` to resolve the vuln with less of a semver jump. #### Cargo audit <details> <summary>tip of main cargo audit output</summary> ``` [nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD 7232d887d1d0c0ade287e40e09250bf74a9b137a [nix-shell:~/Code/Rust/trust-dns]$ cargo audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 478 security advisories (from /home/daniel/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabilities (231 crate dependencies) Crate: tokio Version: 1.21.0 Title: reject_remote_clients Configuration corruption Date: 2023-01-04 ID: RUSTSEC-2023-0001 URL: https://rustsec.org/advisories/RUSTSEC-2023-0001 Solution: Upgrade to >=1.18.4, <1.19.0 OR >=1.20.3, <1.21.0 OR >=1.23.1 Dependency tree: tokio 1.21.0 ├── trust-dns-util 0.22.0 ├── trust-dns-server 0.22.0 │ ├── trust-dns-integration 0.22.0 │ └── trust-dns 0.22.0 ├── trust-dns-resolver 0.22.0 │ ├── trust-dns-util 0.22.0 │ ├── trust-dns-server 0.22.0 │ ├── trust-dns-recursor 0.22.0 │ │ ├── trust-dns-util 0.22.0 │ │ ├── trust-dns-server 0.22.0 │ │ └── trust-dns-integration 0.22.0 │ ├── trust-dns-integration 0.22.0 │ ├── trust-dns 0.22.0 │ └── async-std-resolver 0.22.0 ├── trust-dns-recursor 0.22.0 ├── trust-dns-proto 0.22.0 │ ├── trust-dns-util 0.22.0 │ ├── trust-dns-server 0.22.0 │ ├── trust-dns-resolver 0.22.0 │ ├── trust-dns-recursor 0.22.0 │ ├── trust-dns-integration 0.22.0 │ ├── trust-dns-client 0.22.0 │ │ ├── trust-dns-util 0.22.0 │ │ ├── trust-dns-server 0.22.0 │ │ ├── trust-dns-integration 0.22.0 │ │ ├── trust-dns-compatibility 0.22.0 │ │ └── trust-dns 0.22.0 │ └── trust-dns 0.22.0 ├── trust-dns-integration 0.22.0 ├── trust-dns-client 0.22.0 ├── trust-dns 0.22.0 ├── tokio-util 0.7.3 │ └── h2 0.3.14 │ ├── trust-dns-server 0.22.0 │ └── trust-dns-proto 0.22.0 ├── tokio-rustls 0.23.4 │ ├── trust-dns-server 0.22.0 │ ├── trust-dns-resolver 0.22.0 │ └── trust-dns-proto 0.22.0 ├── tokio-openssl 0.6.3 │ ├── trust-dns-server 0.22.0 │ ├── trust-dns-resolver 0.22.0 │ └── trust-dns-proto 0.22.0 ├── tokio-native-tls 0.3.0 │ ├── trust-dns-resolver 0.22.0 │ └── trust-dns-proto 0.22.0 ├── quinn 0.9.0 │ └── trust-dns-proto 0.22.0 └── h2 0.3.14 error: 1 vulnerability found! ``` </details> <details> <summary>branch cargo audit output:</summary> ``` [nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD 1056bb41d4b1a0a58c4d1926ab52dc60fd459a79 [nix-shell:~/Code/Rust/trust-dns]$ cargo audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 478 security advisories (from /home/daniel/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabilities (231 crate dependencies) ``` </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>