Skip to content

Commit

Permalink
Update version of the object and ruzstd crates to address vulnerabili…
Browse files Browse the repository at this point in the history
…ty RUSTSEC-2024-0400

Summary:
The crate `ruzstd-0.7.2` has vulnerability [RUSTSEC-2024-0400](https://osv.dev/vulnerability/RUSTSEC-2024-0400). This is from an indirect reference
```
addr2line-0.24.2 => object-0.36.5 => ruzstd-0.7.2
```
To fix, updated the following versions
 ```
object-0.32.1  to  object-0.32.2
object-0.36.5  to  object-0.36.7
object-0.30.3  to  object-0.30.4
ruzstd-0.4.0   to  ruzstd-0.5.0
ruzstd-0.7.2   to  ruzstd-0.7.3
delete thiserror-core and thiserror-core-impl (was only used by ruzstd-0.4.0)
```

All the real changes are in the file `third-party/rust/Cargo.lock`, and I had to add `third-party/rust/fixups/object/fixups.toml` file to workaround a build script introduced in `object-0.36.7` with some rustc versioning check that is unnecessary for Meta repo.

Unfortunately I had to manually edit `third-party/rust/Cargo.lock` which is supposed to be a generated file. But I verified the change is stable (running `fbcode/common/rust/tools/reindeer/vendor` on top of this resulted in no changes). I did try to use the `fbcode/common/rust/tools/reindeer/version-bump` command, but it tried to boil the ocean and updated everything which not only resulted in many build errors but also is a bad idea to do in one go. All the version changes above was cherry-picked from the `version-bump` script though.

Reviewed By: capickett

Differential Revision: D69505277

fbshipit-source-id: e88dbca60245b4ae715f49195cde1ccf06c1bf98
  • Loading branch information
jinsongyu-meta authored and facebook-github-bot committed Feb 12, 2025
1 parent 302bd18 commit 9447438
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions hphp/hack/src/Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 9447438

Please sign in to comment.