From ceeb9c5903848eeeaf02cddc23734b4776c627d8 Mon Sep 17 00:00:00 2001 From: Pal Lakatos-Toth Date: Mon, 31 Aug 2026 14:23:37 +0200 Subject: [PATCH] chore(deps): consolidate compatible dependency updates Update compatible Rust patches and verified GitHub Actions together. Keep base64 0.23 on its safe scalar backend by disabling the new default-on unsafe SIMD feature, and update the full CodeQL action family atomically. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee78c86b-0001-4d24-b829-7c75b59c9316 --- .github/workflows/ci.yml | 4 +- .github/workflows/codeql.yml | 6 +- .github/workflows/release-internal.yml | 2 +- .github/workflows/release-public-interim.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanning.yml | 2 +- Cargo.lock | 58 +++++++++++--------- Cargo.toml | 3 +- inference-router/Cargo.toml | 3 +- 9 files changed, 45 insertions(+), 37 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index db099c000..68cef146d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -422,7 +422,7 @@ jobs: output: "trivy-results.sarif" - name: Upload Trivy scan results - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 if: always() with: sarif_file: "trivy-results.sarif" @@ -464,7 +464,7 @@ jobs: skip-dirs: "vendor,node_modules,target,dist,build,.turbo" - name: Upload scan results - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 if: always() && hashFiles('container-results.sarif') != '' with: sarif_file: "container-results.sarif" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 22238866a..cb082299d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,16 +32,16 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} config-file: ./.github/codeql-config.yml queries: security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/release-internal.yml b/.github/workflows/release-internal.yml index 09ff15e2f..0a9fa882e 100644 --- a/.github/workflows/release-internal.yml +++ b/.github/workflows/release-internal.yml @@ -216,7 +216,7 @@ jobs: - name: Set up QEMU (for cross-arch buildx) if: matrix.image.platforms != 'linux/amd64' - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 diff --git a/.github/workflows/release-public-interim.yml b/.github/workflows/release-public-interim.yml index b14b06045..767eb348e 100644 --- a/.github/workflows/release-public-interim.yml +++ b/.github/workflows/release-public-interim.yml @@ -154,7 +154,7 @@ jobs: - name: Set up QEMU (for cross-arch buildx) if: matrix.image.platforms != 'linux/amd64' - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6b591043b..1548f4b1e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -39,6 +39,6 @@ jobs: publish_results: true - name: Upload Results - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: results.sarif diff --git a/.github/workflows/secret-scanning.yml b/.github/workflows/secret-scanning.yml index d9564ab02..608387dbc 100644 --- a/.github/workflows/secret-scanning.yml +++ b/.github/workflows/secret-scanning.yml @@ -19,6 +19,6 @@ jobs: fetch-depth: 0 - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6 + uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b # v3.97.1 with: extra_args: --only-verified diff --git a/Cargo.lock b/Cargo.lock index 44e7cfddf..9f064420e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -198,9 +198,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.103" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "ar_archive_writer" @@ -439,6 +439,12 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "base64" +version = "0.23.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" + [[package]] name = "base64ct" version = "1.8.3" @@ -1412,7 +1418,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.52.0", ] [[package]] @@ -2393,7 +2399,7 @@ checksum = "51b326f5219dd55872a72c1b6ddd1b830b8334996c667449c29391d657d78d5e" dependencies = [ "base64 0.22.1", "jiff", - "schemars 1.2.1", + "schemars 1.2.2", "serde", "serde_json", ] @@ -2402,7 +2408,7 @@ dependencies = [ name = "kars-a2a-core" version = "0.1.0" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "ed25519-dalek", "serde", "serde_json", @@ -2415,7 +2421,7 @@ version = "0.1.0" dependencies = [ "anyhow", "axum", - "base64 0.22.1", + "base64 0.23.1", "ed25519-dalek", "hyper", "hyper-util", @@ -2486,7 +2492,7 @@ dependencies = [ "anyhow", "async-trait", "axum", - "base64 0.22.1", + "base64 0.23.1", "bs58", "chrono", "criterion", @@ -2504,7 +2510,7 @@ dependencies = [ "regex", "reqwest 0.12.28", "rustls", - "schemars 1.2.1", + "schemars 1.2.2", "serde", "serde_json", "serde_yaml", @@ -2537,7 +2543,7 @@ dependencies = [ "anyhow", "async-trait", "axum", - "base64 0.22.1", + "base64 0.23.1", "bytes", "chrono", "criterion", @@ -2675,7 +2681,7 @@ dependencies = [ "jiff", "json-patch", "k8s-openapi", - "schemars 1.2.1", + "schemars 1.2.2", "serde", "serde-value", "serde_json", @@ -3113,7 +3119,7 @@ version = "5.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d" dependencies = [ - "base64 0.21.7", + "base64 0.22.1", "chrono", "getrandom 0.2.17", "http", @@ -4269,7 +4275,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.60.2", + "windows-sys 0.52.0", ] [[package]] @@ -4337,7 +4343,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.60.2", + "windows-sys 0.52.0", ] [[package]] @@ -4439,9 +4445,9 @@ dependencies = [ [[package]] name = "schemars" -version = "1.2.1" +version = "1.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc" +checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a" dependencies = [ "dyn-clone", "ref-cast", @@ -4452,14 +4458,14 @@ dependencies = [ [[package]] name = "schemars_derive" -version = "1.2.1" +version = "1.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f" +checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba" dependencies = [ "proc-macro2", "quote", "serde_derive_internals", - "syn 2.0.117", + "syn 3.0.4", ] [[package]] @@ -4586,13 +4592,13 @@ dependencies = [ [[package]] name = "serde_derive_internals" -version = "0.29.1" +version = "0.30.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711" +checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd" dependencies = [ "proc-macro2", "quote", - "syn 2.0.117", + "syn 3.0.4", ] [[package]] @@ -4676,7 +4682,7 @@ dependencies = [ "indexmap 1.9.3", "indexmap 2.14.0", "schemars 0.9.0", - "schemars 1.2.1", + "schemars 1.2.2", "serde_core", "serde_json", "serde_with_macros", @@ -5091,7 +5097,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.60.2", + "windows-sys 0.52.0", ] [[package]] @@ -5279,9 +5285,9 @@ dependencies = [ [[package]] name = "tokio-stream" -version = "0.1.18" +version = "0.1.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70" +checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b" dependencies = [ "futures-core", "pin-project-lite", @@ -5982,7 +5988,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 6e451a538..eb8e80aef 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -78,7 +78,8 @@ ed25519-dalek = { version = "2", features = ["rand_core"] } rand = "0.9" sha2 = "0.10" bs58 = "0.5" -base64 = "0.22" +# Keep JWS and protocol encoding paths off base64's default-on unsafe SIMD backend. +base64 = { version = "0.23", default-features = false, features = ["std"] } hex = "0.4" # WebSocket (relay connection) diff --git a/inference-router/Cargo.toml b/inference-router/Cargo.toml index d0bf4fb65..4c3e199e3 100644 --- a/inference-router/Cargo.toml +++ b/inference-router/Cargo.toml @@ -67,7 +67,8 @@ aes-gcm = "0.10" hkdf = "0.12" sha2 = "0.10" rand = "0.9" -base64 = "0.22" +# Keep credential and handoff encoding paths off the default-on unsafe SIMD backend. +base64 = { version = "0.23", default-features = false, features = ["std"] } flate2 = "1" # Ed25519 sign/verify for A2A 1.0.0 AgentCard signatures (a2a::card_signing). # Public-key crypto only — private key material flows through `SigningProvider`