[PR #1886] [MERGED] deps: upgrade bumpalo 3.11.0 -> 3.11.1 #2671

New issue

Closed

opened 2026-03-16 11:01:57 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:01:57 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/1886
Author: @cpu
Created: 1/17/2023
Status: ✅ Merged
Merged: 1/18/2023
Merged by: @djc

Base: main ← Head: cpu-RUSTSEC-2022-0078

📝 Commits (1)

9c25952 deps: upgrade bumpalo 3.11.0 -> 3.11.1

📊 Changes

1 file changed (+2 additions, -2 deletions)

View changed files

📝 Cargo.lock (+2 -2)

📄 Description

This commit updates the Cargo.lock file with the output produced by cargo update -p bumpalo --precise 3.11.1, updating a transitive dependency on the bumpalo crate from 3.11.0 to 3.11.1.

Notably this resolves RUSTSEC-2022-0078. which was previously flagged in CI by cargo audit.

cargo audit of main tip:


[nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD
e5075c6059d317629fc2844c9f1d6a853bb3490e

[nix-shell:~/Code/Rust/trust-dns]$ cargo audit --deny warnings
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 486 security advisories (from /home/daniel/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (231 crate dependencies)
Crate:     bumpalo
Version:   3.11.0
Warning:   unsound
Title:     Use-after-free due to a lifetime error in `Vec::into_iter()`
Date:      2022-01-14
ID:        RUSTSEC-2022-0078
URL:       https://rustsec.org/advisories/RUSTSEC-2022-0078
Dependency tree:
bumpalo 3.11.0
└── wasm-bindgen-backend 0.2.82
    └── wasm-bindgen-macro-support 0.2.82
        └── wasm-bindgen-macro 0.2.82
            └── wasm-bindgen 0.2.82
                ├── web-sys 0.3.59
                │   ├── wasm-bindgen-futures 0.4.32
                │   │   └── async-std 1.12.0
                │   │       └── async-std-resolver 0.22.0
                │   └── ring 0.16.20
                │       ├── webpki 0.22.0
                │       │   ├── webpki-roots 0.22.4
                │       │   │   ├── trust-dns-util 0.22.0
                │       │   │   ├── trust-dns-resolver 0.22.0
                │       │   │   │   ├── trust-dns-util 0.22.0
                │       │   │   │   ├── trust-dns-server 0.22.0
                │       │   │   │   │   ├── trust-dns-integration 0.22.0
                │       │   │   │   │   └── trust-dns 0.22.0
                │       │   │   │   ├── trust-dns-recursor 0.22.0
                │       │   │   │   │   ├── trust-dns-util 0.22.0
                │       │   │   │   │   ├── trust-dns-server 0.22.0
                │       │   │   │   │   └── trust-dns-integration 0.22.0
                │       │   │   │   ├── trust-dns-integration 0.22.0
                │       │   │   │   ├── trust-dns 0.22.0
                │       │   │   │   └── async-std-resolver 0.22.0
                │       │   │   ├── trust-dns-proto 0.22.0
                │       │   │   │   ├── trust-dns-util 0.22.0
                │       │   │   │   ├── trust-dns-server 0.22.0
                │       │   │   │   ├── trust-dns-resolver 0.22.0
                │       │   │   │   ├── trust-dns-recursor 0.22.0
                │       │   │   │   ├── trust-dns-integration 0.22.0
                │       │   │   │   ├── trust-dns-client 0.22.0
                │       │   │   │   │   ├── trust-dns-util 0.22.0
                │       │   │   │   │   ├── trust-dns-server 0.22.0
                │       │   │   │   │   ├── trust-dns-integration 0.22.0
                │       │   │   │   │   ├── trust-dns-compatibility 0.22.0
                │       │   │   │   │   └── trust-dns 0.22.0
                │       │   │   │   └── trust-dns 0.22.0
                │       │   │   ├── trust-dns-integration 0.22.0
                │       │   │   └── trust-dns 0.22.0
                │       │   ├── trust-dns-util 0.22.0
                │       │   ├── trust-dns-proto 0.22.0
                │       │   ├── trust-dns-client 0.22.0
                │       │   ├── tokio-rustls 0.23.4
                │       │   │   ├── trust-dns-server 0.22.0
                │       │   │   ├── trust-dns-resolver 0.22.0
                │       │   │   └── trust-dns-proto 0.22.0
                │       │   ├── rustls 0.20.6
                │       │   │   ├── trust-dns-util 0.22.0
                │       │   │   ├── trust-dns-server 0.22.0
                │       │   │   ├── trust-dns-resolver 0.22.0
                │       │   │   ├── trust-dns-proto 0.22.0
                │       │   │   ├── trust-dns-integration 0.22.0
                │       │   │   ├── trust-dns-client 0.22.0
                │       │   │   ├── trust-dns 0.22.0
                │       │   │   ├── tokio-rustls 0.23.4
                │       │   │   ├── quinn-proto 0.9.0
                │       │   │   │   ├── quinn-udp 0.3.0
                │       │   │   │   │   └── quinn 0.9.0
                │       │   │   │   │       └── trust-dns-proto 0.22.0
                │       │   │   │   └── quinn 0.9.0
                │       │   │   └── quinn 0.9.0
                │       │   ├── quinn-proto 0.9.0
                │       │   └── quinn 0.9.0
                │       ├── trust-dns-proto 0.22.0
                │       ├── trust-dns-client 0.22.0
                │       ├── sct 0.7.0
                │       │   └── rustls 0.20.6
                │       ├── rustls 0.20.6
                │       └── quinn-proto 0.9.0
                ├── wasm-bindgen-futures 0.4.32
                ├── trust-dns-proto 0.22.0
                ├── js-sys 0.3.59
                │   ├── web-sys 0.3.59
                │   ├── wasm-bindgen-futures 0.4.32
                │   ├── trust-dns-proto 0.22.0
                │   └── gloo-timers 0.2.4
                │       └── async-std 1.12.0
                └── gloo-timers 0.2.4

error: 1 denied warning found!

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/1886 **Author:** [@cpu](https://github.com/cpu) **Created:** 1/17/2023 **Status:** ✅ Merged **Merged:** 1/18/2023 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `cpu-RUSTSEC-2022-0078` --- ### 📝 Commits (1) - [`9c25952`](https://github.com/hickory-dns/hickory-dns/commit/9c259521d0ee2d835adb035938d506dad694ea12) deps: upgrade bumpalo 3.11.0 -> 3.11.1 ### 📊 Changes **1 file changed** (+2 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+2 -2) </details> ### 📄 Description This commit updates the `Cargo.lock` file with the output produced by `cargo update -p bumpalo --precise 3.11.1`, updating a transitive dependency on the `bumpalo` crate from 3.11.0 to 3.11.1. Notably this resolves [RUSTSEC-2022-0078](https://rustsec.org/advisories/RUSTSEC-2022-0078). which was previously flagged in CI by `cargo audit`. <details> <summary>cargo audit of main tip:</summary> ``` [nix-shell:~/Code/Rust/trust-dns]$ git rev-parse HEAD e5075c6059d317629fc2844c9f1d6a853bb3490e [nix-shell:~/Code/Rust/trust-dns]$ cargo audit --deny warnings Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 486 security advisories (from /home/daniel/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabilities (231 crate dependencies) Crate: bumpalo Version: 3.11.0 Warning: unsound Title: Use-after-free due to a lifetime error in `Vec::into_iter()` Date: 2022-01-14 ID: RUSTSEC-2022-0078 URL: https://rustsec.org/advisories/RUSTSEC-2022-0078 Dependency tree: bumpalo 3.11.0 └── wasm-bindgen-backend 0.2.82 └── wasm-bindgen-macro-support 0.2.82 └── wasm-bindgen-macro 0.2.82 └── wasm-bindgen 0.2.82 ├── web-sys 0.3.59 │ ├── wasm-bindgen-futures 0.4.32 │ │ └── async-std 1.12.0 │ │ └── async-std-resolver 0.22.0 │ └── ring 0.16.20 │ ├── webpki 0.22.0 │ │ ├── webpki-roots 0.22.4 │ │ │ ├── trust-dns-util 0.22.0 │ │ │ ├── trust-dns-resolver 0.22.0 │ │ │ │ ├── trust-dns-util 0.22.0 │ │ │ │ ├── trust-dns-server 0.22.0 │ │ │ │ │ ├── trust-dns-integration 0.22.0 │ │ │ │ │ └── trust-dns 0.22.0 │ │ │ │ ├── trust-dns-recursor 0.22.0 │ │ │ │ │ ├── trust-dns-util 0.22.0 │ │ │ │ │ ├── trust-dns-server 0.22.0 │ │ │ │ │ └── trust-dns-integration 0.22.0 │ │ │ │ ├── trust-dns-integration 0.22.0 │ │ │ │ ├── trust-dns 0.22.0 │ │ │ │ └── async-std-resolver 0.22.0 │ │ │ ├── trust-dns-proto 0.22.0 │ │ │ │ ├── trust-dns-util 0.22.0 │ │ │ │ ├── trust-dns-server 0.22.0 │ │ │ │ ├── trust-dns-resolver 0.22.0 │ │ │ │ ├── trust-dns-recursor 0.22.0 │ │ │ │ ├── trust-dns-integration 0.22.0 │ │ │ │ ├── trust-dns-client 0.22.0 │ │ │ │ │ ├── trust-dns-util 0.22.0 │ │ │ │ │ ├── trust-dns-server 0.22.0 │ │ │ │ │ ├── trust-dns-integration 0.22.0 │ │ │ │ │ ├── trust-dns-compatibility 0.22.0 │ │ │ │ │ └── trust-dns 0.22.0 │ │ │ │ └── trust-dns 0.22.0 │ │ │ ├── trust-dns-integration 0.22.0 │ │ │ └── trust-dns 0.22.0 │ │ ├── trust-dns-util 0.22.0 │ │ ├── trust-dns-proto 0.22.0 │ │ ├── trust-dns-client 0.22.0 │ │ ├── tokio-rustls 0.23.4 │ │ │ ├── trust-dns-server 0.22.0 │ │ │ ├── trust-dns-resolver 0.22.0 │ │ │ └── trust-dns-proto 0.22.0 │ │ ├── rustls 0.20.6 │ │ │ ├── trust-dns-util 0.22.0 │ │ │ ├── trust-dns-server 0.22.0 │ │ │ ├── trust-dns-resolver 0.22.0 │ │ │ ├── trust-dns-proto 0.22.0 │ │ │ ├── trust-dns-integration 0.22.0 │ │ │ ├── trust-dns-client 0.22.0 │ │ │ ├── trust-dns 0.22.0 │ │ │ ├── tokio-rustls 0.23.4 │ │ │ ├── quinn-proto 0.9.0 │ │ │ │ ├── quinn-udp 0.3.0 │ │ │ │ │ └── quinn 0.9.0 │ │ │ │ │ └── trust-dns-proto 0.22.0 │ │ │ │ └── quinn 0.9.0 │ │ │ └── quinn 0.9.0 │ │ ├── quinn-proto 0.9.0 │ │ └── quinn 0.9.0 │ ├── trust-dns-proto 0.22.0 │ ├── trust-dns-client 0.22.0 │ ├── sct 0.7.0 │ │ └── rustls 0.20.6 │ ├── rustls 0.20.6 │ └── quinn-proto 0.9.0 ├── wasm-bindgen-futures 0.4.32 ├── trust-dns-proto 0.22.0 ├── js-sys 0.3.59 │ ├── web-sys 0.3.59 │ ├── wasm-bindgen-futures 0.4.32 │ ├── trust-dns-proto 0.22.0 │ └── gloo-timers 0.2.4 │ └── async-std 1.12.0 └── gloo-timers 0.2.4 error: 1 denied warning found! ``` </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>