Uh oh!
There was an error while loading. Please reload this page.
build(deps): clear all 8 open dependabot alerts - #867
Open
moonming wants to merge 1 commit into
Open
Conversation
Four distinct advisories behind the 8 alerts, all fixed by upgrade — nothing dismissed: - jsonwebtoken 9.3.1 -> 10.4.0 (3 moderate: CVE-2026-25537 type confusion with exp/nbf when not required). Direct runtime dep of aisix-proxy (inbound OIDC/JWT auth) and aisix-provider-vertex (SA token minting). v10 requires choosing a crypto backend explicitly; `aws_lc_rs` reuses the aws-lc-rs already in the tree from rustls — no new crypto stack. The 9.x API we use (encode / decode / Validation / JwkSet / ErrorKind) is source-compatible. - rustls-webpki 0.103.12 -> 0.103.13 (1 high: GHSA-82j2-j2ch-gfr8, panic on malformed CRL BIT STRING), and the parallel 0.101.7 copy eliminated entirely (2 low: GHSA-xgp8-3hg3-c2mh / GHSA-965h-392x-2mh5 wildcard/URI name-constraint bypasses, unpatched in the 0.101 line). 0.101.7 came via the retired hyper 0.14 + rustls 0.21 connector that aws-sdk-bedrockruntime's legacy `rustls` feature drags in; every Bedrock client is built on `upstream_tls::aws_http_client()` (rustls 0.23 / aws-lc), so the legacy connector was compiled in but never used. Swapped the feature to `default-https-client` on aws-config + aws-sdk-bedrockruntime; rustls 0.21 and webpki 0.101 are gone from Cargo.lock. - testcontainers 0.23 -> 0.27 (1 high: CVE-2025-62518 tokio-tar PAX header desync, no patched tokio-tar release). Dev-dependency of aisix-admin only — never in the shipped binary. testcontainers >= 0.25 replaced tokio-tar with the patched astral-tokio-tar fork; the API surface we use is unchanged. - rand 0.8.5 -> 0.8.7 (1 low: GHSA-cq8v-f236-94qc unsoundness with a custom logger). Lock-only bump within semver. Verified: cargo build/test --workspace --all-features green (1,300+ tests, 0 failed), clippy --all-targets clean, fmt clean. The one Docker-gated #[ignore] etcd roundtrip test compiles against testcontainers 0.27; running it locally failed only at image pull (local network cannot reach Docker Hub), before any testcontainers code path under test.
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe pull request updates AWS Bedrock HTTP client features, upgrades the testcontainers dependency, and changes jsonwebtoken to version 10 with aws_lc_rs in two crates. ChangesDependency updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
membphis added a commit
that referenced
this pull request
Aug 12, 2026
Supersedes the conflicted #867; its analysis was re-verified against current main and re-landed: - jsonwebtoken 9.3.1 -> 10.4.0 on the aws_lc_rs backend in aisix-proxy (inbound OIDC/JWT auth) and aisix-provider-vertex (SA token minting). Fixes the exp/nbf type-confusion advisory; the API surface in use is source-compatible, zero code changes. - aws-config / aws-sdk-bedrockruntime: swap the legacy rustls feature for default-https-client, removing the retired hyper 0.14 + rustls 0.21 connector (and rustls-webpki 0.101.7) from the tree. Every Bedrock client is built on upstream_tls::aws_http_client(), enforced by an existing guard test, so the connector was dead code. - testcontainers 0.23 -> 0.28 (dev-only): replaces the unpatched tokio-tar with the fixed astral-tokio-tar fork. - Cargo.lock: rustls-webpki 0.103.12 -> 0.103.13 (CRL panic fix), rand 0.8.5 -> 0.8.7 (custom-logger unsoundness fix). Independent audit: 0 HIGH / 0 MEDIUM / 4 LOW, all dispositioned on the PR. CI 12/12 green including both e2e serving modes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears all 8 open dependabot alerts (2 high / 3 moderate / 3 low) on the default branch. They collapse into 4 distinct advisories; every one is fixed by upgrade — nothing is dismissed.
exp/nbfwhen not requiredaws_lc_rsbackendKey decisions
jsonwebtoken 10 backend choice. v10 made the crypto backend an explicit feature.
aws_lc_rsreuses the aws-lc-rs 1.16 already in the tree (process-wide rustls provider installed inmain()), so this adds no second crypto stack. Our 9.x API usage (encode/decode/Validation/JwkSet/ErrorKind) is source-compatible with 10.4 — zero code changes; all JWT-auth unit tests (signature tampering, alg confusion, kid selection, claim enforcement) pass unchanged. Not 11.0.0: it landed 10 days ago with breaking API churn (non_exhaustiveenums,Header.extrasrework) and no security content beyond 10.3.0.Legacy AWS connector removal (the real fix for the webpki 0.101 alerts). rustls-webpki 0.101.7 cannot be patched in place — the fixes only exist in 0.103. It entered via aws-sdk-bedrockruntime's legacy
rustlsfeature →aws-smithy-runtime/tls-rustls→ hyper 0.14 + rustls 0.21 connector. That connector is dead code here: every Bedrock client is built onupstream_tls::aws_http_client()(aws-smithy-http-client, rustls 0.23 / aws-lc), andupstream_http.rscarries a guard enforcing exactly that. Swapping the feature todefault-https-clienton aws-config + aws-sdk-bedrockruntime removes rustls 0.21, rustls-webpki 0.101.7, and hyper 0.14's TLS path fromCargo.lockentirely. On aws-config 1.8 the oldrustlsfeature is already just an alias for the modern client, so that half is a no-op rename.testcontainers is dev-only. tokio-tar never ships in the gateway binary (
[dev-dependencies]of aisix-admin). Upgraded rather than dismissed because the patched fork is a drop-in via testcontainers ≥ 0.25.Verification
cargo build --workspace --all-features— cleancargo test --workspace --all-features— 1,300+ tests, 0 failedcargo clippy --workspace --all-targets --all-features— no warnings;cargo fmt --checkcleanCargo.lockafter: single rustls (0.23.38), single rustls-webpki (0.103.13), no tokio-tar, jsonwebtoken 10.4.0, testcontainers 0.27.3, rand 0.8.7#[ignore]etcd roundtrip test compiles against 0.27; a local run failed only atdocker pull(this machine currently can't reach Docker Hub) — before any testcontainers code path under test. CI ignores it by design.After merge, the 8 alerts should auto-resolve on the next dependabot scan of
main.🤖 Generated with Claude Code
Summary by CodeRabbit