Repository navigation
fix(deps): resolve RUSTSEC-2026-0433 in the root lockfile - #460
Merged
Merged
Conversation
Both cargo-audit jobs (`Dependency audit`, `rust-ci / Cargo audit`) are red on main and on #458 for RUSTSEC-2026-0433: pulldown-cmark 0.13.5, quadratic parsing of nested image wikilinks (CVSS 7.5, 2026-10-28). `cargo update -p pulldown-cmark --precise 0.13.6` changes only that package's version and checksum. It is a build dependency of echidna-grpc (via prost-build / tonic-prost-build). The fuzz workspace has no pulldown-cmark entry. Same shape as #457 (RUSTSEC-2026-0414). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KUZiEB43T3E9fJAXqwbSDm
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Owner
Author
|
Generated by Claude Code |
8 tasks done
hyperpolymath
added a commit
that referenced
this pull request
Nov 5, 2026
## Summary standards moved from `hyperpolymath` to `metadatastician`. GitHub does not follow that rename for reusable workflows, so every job here that calls `hyperpolymath/standards/...` fails before it starts. Example: governance run [40463073589](https://github.com/hyperpolymath/echidna/actions/runs/40463073589): > error parsing called workflow ".github/workflows/governance.yml" -> "hyperpolymath/standards/.github/workflows/governance-reusable.yml@3c00687…" : workflow was not found. This PR points those six calls at the canonical owner, repins them to standards main, and rekeys `actions.lock` to match. It is echidna's part of option 1 in metadatastician/standards#1390. **Live result on `5ab6c13`.** Every called standards job ran and passed: | Caller | Run | Result | |---|---|---| | governance | [41944160807](https://github.com/hyperpolymath/echidna/actions/runs/41944160807) | all jobs green, including Allowlist Preflight, Actions lockfile verify, Workflow security linter and Validate Hypatia Baseline | | hypatia-scan | [41944160860](https://github.com/hyperpolymath/echidna/actions/runs/41944160860) | green | | spark-theatre-gate | [41944160674](https://github.com/hyperpolymath/echidna/actions/runs/41944160674) | green | | secret-scanner | [41944160453](https://github.com/hyperpolymath/echidna/actions/runs/41944160453) | shell-secrets and rust-secrets green; gitleaks red, not this PR's (see below) | scorecard and mirror do not run on `pull_request`, so they take effect on their next scheduled or push run after merge. This PR is therefore a working caller canary for the standards playbook (§4 of `docs/compliance/repo-transfer-to-enterprise-playbook.adoc`). ## Changes - **Coordinates.** Six job-level `uses:` move from `hyperpolymath/standards/…` to `metadatastician/standards/…`: governance, hypatia-scan, mirror, scorecard, secret-scanner and spark-theatre-gate. - **Pin.** `3c00687` → `087f6bf` (standards main, 2026-11-04). - The old pin's governance reusable checks callers against its own tree allow-list, which predates the transfer pattern. Its `Allowlist Preflight` failed on all six calls (run 41925934029). - `087f6bf` passes `scripts/lock-selfcheck.sh` (SELF-CONSISTENT), the selection step in standards#1391's rollout guard. - The call-site comments name the new pin and the hypatia-ref default it vets (`adb2f41d`). - **Lock.** `actions.lock` was rekeyed by standards' `scripts/relock-standards-pin.sh` (standards#1391), not by hand: - workflow entries and the standards record now sit under `metadatastician/standards@087f6bf…`; - `owner_id` is 297579217, and `repo_id` (1116521501) is unchanged; - `actions/download-artifact@9000827` (v8.0.2) is added, because the reusables use it at the new pin. - **A040 audit (`contractile.just`).** `adjust-shas-stale` now matches either owner, so the pin-staleness audit sees the repointed callers instead of going silent. This was Codex's finding; the fix is `5ab6c13`. ## RSR Quality Checklist ### Required - [x] Tests pass: `rust-ci / Cargo test` green; no code changes - [x] Code is formatted: one scalar and its comment per workflow file - [x] Linter is clean: actionlint 1.7.7 reports 0 findings on all six workflows; lint-workflows green - [x] No banned language patterns - [x] No `unsafe` blocks: not applicable - [x] No banned functions: not applicable - [x] SPDX license headers present: unchanged - [x] No secrets, credentials, or `.env` files included ### As Applicable Nothing in this list applies: no state, ecosystem, architecture, docs or dependency change. ## Testing All local checks use standards' tools at `087f6bf`, run on this branch: | Check | Result | |---|---| | `check-lock-sync.sh` | in sync | | `close-lock.sh --check` | closed, no dangling edges | | `check-workflow-coordinates.sh` | no former-owner coordinates in 35 workflows | | `check-allowed-actions.sh` with standards main's tree canon | 0 of 27 refs uncovered (6 at the old pin) | | `check-lock-pin-contract.sh` | 18 findings, the identical set to main's lock; none added (noted on #401) | | `lock-selfcheck.sh 087f6bf` | SELF-CONSISTENT | | `just -f contractile.just adjust-shas-stale` | lists the repointed callers (none before `5ab6c13`) | **Remaining reds, none of them this PR's.** Each is explained in a PR comment: - `T1 Guix manifest check`: the runner image has no `guix` package. - `scan / gitleaks`: it flags commit `791cca0`, which exists only on `arena/4853aec5-echidna`. The two cargo-audit checks are green since #460 (RUSTSEC-2026-0433) was merged in. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency auditandrust-ci / Cargo audit (security)are red onmainand on #458 for RUSTSEC-2026-0433: pulldown-cmark 0.13.5, quadratic parsing of nested image wikilinks (CVSS 7.5, published 2026-10-28). This PR is the separatefix(deps)change proposed in #458's comment, in the same shape as #457 (RUSTSEC-2026-0414).Changes
Cargo.lock:pulldown-cmark0.13.5 → 0.13.6, viacargo update -p pulldown-cmark --precise 0.13.6. Only that package'sversionandchecksumchange; no other package moves.pulldown-cmarkis a build dependency only:echidna-grpc→tonic-prost-build→prost-build(andpulldown-cmark-to-cmark). Thefuzz/workspace has nopulldown-cmarkentry, so its lock is untouched.RSR Quality Checklist
Required
echidna-grpc(the only dependent) builds with--lockedunsafeblocks: not applicable.envfiles includedAs Applicable
Testing
cargo audit -f <main's Cargo.lock>(cargo-audit 0.22.2)RUSTSEC-2026-0433, 1 vulnerability found, which reproduces CIcargo audit -f Cargo.lock(this branch)cargo tree --locked --workspace --all-features --target all -i pulldown-cmarkprost-buildandpulldown-cmark-to-cmark, both underechidna-grpc's build dependenciescargo check --locked -p echidna-grpc(rustc 1.99.0, protoc 3.21.12)git diff --text Cargo.lockAfter this merges, #458's two audit failures should clear once its branch is updated; its other two reds (Guix runner package, gitleaks on another branch's commit) are explained there and are unrelated.
Generated by Claude Code