Skip to content

Conversation

@unclesp1d3r
Copy link

@unclesp1d3r unclesp1d3r commented Sep 30, 2025

Summary

This PR updates dependencies to resolve cargo-audit findings in the 1.0.0 release, specifically addressing issues with ring (via rcgen) and tracing-subscriber.

Changes

Dependencies

  • Bumped rcgen from 0.11.3 → 0.14.5
    • Removes transitive ring 0.16.20 dependency (unmaintained / vulnerable)
    • Required minor changes in src/transport/tls.rs due to API updates
  • Bumped tracing-subscriber from 0.3.19 → 0.3.20
    • Resolves ANSI escape sequence injection issue

Code Updates

  • Adjusted TLS handling to match rcgen 0.14.x API:
    • generate_simple_self_signed() now returns CertifiedKey
    • Updated certificate and private key serialization calls

Verification

  • cargo audit passes cleanly
  • cargo check compiles successfully
  • cargo test --lib all tests pass
  • Dependency count reduced (190 → 178)

Notes

These upgrades should be backwards-compatible for users of this crate, while addressing security warnings and reducing dependencies.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant