From 064ddf6ad9db79d17873e1d49ecc4d890161df0f Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 09:23:55 -0500 Subject: [PATCH] chore(deps): bump smoltcp to 0.14.0 across all three dependency graphs This repository carries three independent lockfiles -- root, crates/thumos, and fuzz -- and declares smoltcp in two manifests, so a version bump is not one edit. Dependabot opened it as three PRs (#923, #924, #925), each regenerating exactly one lockfile and leaving the other two stale against a shared root Cargo.toml change. Every one of them failed the repo's own drift gates, and none could have passed alone: merging any single PR would have left the others' graphs disagreeing with the manifest they resolve from. Consolidated here. Both manifests move to 0.14, all three lockfiles are regenerated, and crates/aither needs no change because it inherits through workspace = true. Also drops the RUSTSEC-2026-0173 suppression from deny.toml, .cargo/audit.toml and osv-scanner.toml. That advisory covers proc-macro-error2, which reached these graphs only through smoltcp's optional defmt feature; 0.14 drops that edge and the crate is now absent from all three lockfiles. Its stated reason had already gone stale -- it described "smoltcp 0.12" while the manifests were on 0.13 -- and a suppression asserting the presence of a crate no longer in any graph is a false claim the next reader has to disprove before they can act. Verified before pushing: all three graphs resolve under --locked, which is the failure that killed all three original PRs; check-pin-parity and check-lockfile-manifest both pass, which are the two gates they tripped; and check-external-lockfile-versions passes against each lockfile individually. --- .cargo/audit.toml | 2 -- Cargo.lock | 4 ++-- Cargo.toml | 2 +- crates/thumos/Cargo.lock | 15 +++------------ crates/thumos/Cargo.toml | 2 +- deny.toml | 4 ---- fuzz/Cargo.lock | 4 ++-- osv-scanner.toml | 4 ---- 8 files changed, 9 insertions(+), 28 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 8c97d8ef..9d252c3f 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -16,6 +16,4 @@ ignore = [ "RUSTSEC-2021-0006", # atomic-polyfill unmaintained — transitive via heapless 0.7.17 → postcard 1.1.3 → sema/krypta. heapless 0.8+ drops atomic-polyfill in favor of portable-atomic, but postcard 1.x has not yet bumped its heapless pin past 0.7. Track postcard upstream for the heapless bump. "RUSTSEC-2023-0089", - # proc-macro-error2 unmaintained — lockfile-only presence in the kernel graph via smoltcp 0.12's optional defmt feature (defmt-macros → defmt). The kernel enables smoltcp with default-features = false and no defmt feature, so the crate is never compiled. No safe upgrade until defmt migrates off proc-macro-error2. Surfaced by the #547 multi-graph scan. - "RUSTSEC-2026-0173", ] diff --git a/Cargo.lock b/Cargo.lock index 85175e41..f40491b7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1636,9 +1636,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" [[package]] name = "smoltcp" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f73d40463bba65efc9adc6370b56df76d563cc46e2482bba58351b4afb7535e" +checksum = "b6f8b28ad56c6e35524a37dd492af5d1a47e31e1a4d175cd12f89c075f01980f" dependencies = [ "bitflags 1.3.2", "byteorder", diff --git a/Cargo.toml b/Cargo.toml index bce31c55..e2cfc855 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -118,7 +118,7 @@ sha2 = "0.11" x25519-dalek = { version = "3", features = ["static_secrets", "zeroize"] } # Networking -smoltcp = { version = "0.13", default-features = false, features = [ +smoltcp = { version = "0.14", default-features = false, features = [ "medium-ethernet", "proto-ipv4", "proto-ipv6", diff --git a/crates/thumos/Cargo.lock b/crates/thumos/Cargo.lock index 570cf1ee..9cf7709c 100644 --- a/crates/thumos/Cargo.lock +++ b/crates/thumos/Cargo.lock @@ -245,15 +245,6 @@ dependencies = [ "syn 2.0.119", ] -[[package]] -name = "defmt" -version = "0.3.100" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad" -dependencies = [ - "defmt 1.1.1", -] - [[package]] name = "defmt" version = "1.1.1" @@ -676,14 +667,14 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" [[package]] name = "smoltcp" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f73d40463bba65efc9adc6370b56df76d563cc46e2482bba58351b4afb7535e" +checksum = "b6f8b28ad56c6e35524a37dd492af5d1a47e31e1a4d175cd12f89c075f01980f" dependencies = [ "bitflags", "byteorder", "cfg-if", - "defmt 0.3.100", + "defmt", "heapless", "managed", ] diff --git a/crates/thumos/Cargo.toml b/crates/thumos/Cargo.toml index 8c6e4aa9..7adc0f14 100644 --- a/crates/thumos/Cargo.toml +++ b/crates/thumos/Cargo.toml @@ -186,7 +186,7 @@ serde = { version = "1", default-features = false, features = [ "derive", "alloc", ] } -smoltcp = { version = "0.13", default-features = false, features = [ +smoltcp = { version = "0.14", default-features = false, features = [ "medium-ethernet", "proto-ipv4", "socket-tcp", diff --git a/deny.toml b/deny.toml index 80a093ba..c4f467ef 100644 --- a/deny.toml +++ b/deny.toml @@ -41,10 +41,6 @@ reason = "False positive: same collision as RUSTSEC-2020-0128. The flagged `cach id = "RUSTSEC-2023-0089" reason = "atomic-polyfill unmaintained — transitive via heapless 0.7.17 → postcard 1.1.3 → sema/krypta. heapless 0.8+ drops atomic-polyfill in favor of portable-atomic, but postcard 1.x has not yet bumped its heapless pin past 0.7. Track postcard upstream for the heapless bump." -[[advisories.ignore]] -id = "RUSTSEC-2026-0173" -reason = "proc-macro-error2 unmaintained — lockfile-only presence in the kernel graph via smoltcp 0.12's optional defmt feature (defmt-macros → defmt). The kernel enables smoltcp with default-features = false and no defmt feature, so the crate is never compiled. No safe upgrade until defmt migrates off proc-macro-error2. Surfaced by the #547 multi-graph scan." - [licenses] # WHY: license allow list mirrors aletheia's deny.toml. Each addition over # kanon's original list is for a real transitive dep: diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock index 6e79b886..5a5b7431 100644 --- a/fuzz/Cargo.lock +++ b/fuzz/Cargo.lock @@ -369,9 +369,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" [[package]] name = "smoltcp" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f73d40463bba65efc9adc6370b56df76d563cc46e2482bba58351b4afb7535e" +checksum = "b6f8b28ad56c6e35524a37dd492af5d1a47e31e1a4d175cd12f89c075f01980f" dependencies = [ "bitflags 1.3.2", "byteorder", diff --git a/osv-scanner.toml b/osv-scanner.toml index 72cde3cc..1d9a5d72 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -21,7 +21,3 @@ reason = "False positive: same collision as RUSTSEC-2020-0128. The flagged `cach [[IgnoredVulns]] id = "RUSTSEC-2023-0089" reason = "atomic-polyfill unmaintained — transitive via heapless 0.7.17 → postcard 1.1.3 → sema/krypta. heapless 0.8+ drops atomic-polyfill in favor of portable-atomic, but postcard 1.x has not yet bumped its heapless pin past 0.7. Track postcard upstream for the heapless bump." - -[[IgnoredVulns]] -id = "RUSTSEC-2026-0173" -reason = "proc-macro-error2 unmaintained — lockfile-only presence in the kernel graph via smoltcp 0.12's optional defmt feature (defmt-macros → defmt). The kernel enables smoltcp with default-features = false and no defmt feature, so the crate is never compiled. No safe upgrade until defmt migrates off proc-macro-error2. Surfaced by the #547 multi-graph scan."