From 30f36c5dfc57215a9ba95d0b3508156c0016510e Mon Sep 17 00:00:00 2001 From: Austin Barrington Date: Thu, 22 Oct 2026 23:25:40 +0100 Subject: [PATCH 1/2] Stop trusting the compromised eMudhra CA; patch rustls, h2, quinn-proto CVE-2026-111943: eight eMudhra intermediates under emSign ECC Root CA - G3 have trivially recoverable keys, so anyone can forge a certificate those clients accept. - webpki-roots 1.0.9 -> 1.0.10 and rustls-webpki 0.103.13 -> 0.103.16: the server, proxy and CLI trust webpki-roots (reqwest `rustls-tls`), not the OS store. The CLI, which connects over HTTPS to any endpoint, was the exposed one. Also in the Rust client's lockfile. - Images: Debian ca-certificates 20250419~deb12u2 drops the root. Every runtime stage now fails the build if the bundle still holds it, which also stops the release build's layer cache from reusing an older bundle (0.9.2-beta ships ~deb12u1, with the root). cargo audit also flagged, fixed by compatible updates: - rustls 0.23.43 -> 0.23.46 (RUSTSEC-2026-0285, -0346, -0348, -0349) - h2 0.4.15 -> 0.4.20 (RUSTSEC-2026-0258) - quinn-proto 0.11.16 -> 0.11.19 (RUSTSEC-2026-0338 to -0342) Left: h2 0.3.27, only in chdb-rust's build script (it downloads libchdb at compile time; fixed there), and rkyv 0.7.46, locked but not compiled. --- Cargo.lock | 58 ++++++++++++++++++------------------ Dockerfile | 5 ++++ Dockerfile.proxy-runtime | 5 ++++ Dockerfile.runtime | 5 ++++ clients/rust/Cargo.lock | 8 ++--- hyperbytedb-proxy/Dockerfile | 5 ++++ 6 files changed, 53 insertions(+), 33 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index fe166c3..2c79755 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -447,9 +447,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-rs" -version = "1.17.3" +version = "1.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1" +checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13" dependencies = [ "aws-lc-sys", "zeroize", @@ -457,9 +457,9 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.43.0" +version = "0.46.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c" +checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc" dependencies = [ "cc", "cmake", @@ -952,7 +952,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] @@ -1236,7 +1236,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1331,7 +1331,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1662,9 +1662,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.15" +version = "0.4.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155" +checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118" dependencies = [ "atomic-waker", "bytes", @@ -1878,7 +1878,7 @@ dependencies = [ "bytes", "futures-channel", "futures-core", - "h2 0.4.15", + "h2 0.4.20", "http 1.5.0", "http-body 1.1.0", "httparse", @@ -1937,7 +1937,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.5", + "socket2 0.5.10", "tokio", "tower-service", "tracing", @@ -2246,7 +2246,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -2650,7 +2650,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -3154,7 +3154,7 @@ dependencies = [ "quinn-udp", "rustc-hash 2.1.3", "rustls", - "socket2 0.6.5", + "socket2 0.5.10", "thiserror 2.0.19", "tokio", "tracing", @@ -3163,9 +3163,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.16" +version = "0.11.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" +checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" dependencies = [ "bytes", "getrandom 0.4.3", @@ -3192,9 +3192,9 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.5", + "socket2 0.5.10", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -3494,7 +3494,7 @@ dependencies = [ "bytes", "futures-core", "futures-util", - "h2 0.4.15", + "h2 0.4.20", "http 1.5.0", "http-body 1.1.0", "http-body-util", @@ -3704,14 +3704,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell", @@ -3764,9 +3764,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -4272,10 +4272,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4931,9 +4931,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -4960,7 +4960,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] diff --git a/Dockerfile b/Dockerfile index a6461c3..5015ae9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -103,8 +103,13 @@ COPY --from=builder /usr/local/lib/libchdb.so /libchdb.so # --------------------------------------------------------------------------- FROM debian:bookworm-slim +# CVE-2026-111943: fail the build if the CA bundle still trusts the +# compromised eMudhra emSign ECC Root CA - G3 (dropped in Debian +# ca-certificates 20250419~deb12u2). Changing this step also keeps a cached +# layer from carrying an older bundle into the image. RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates libstdc++6 curl \ + && test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem \ && rm -rf /var/lib/apt/lists/* COPY --from=builder /usr/local/lib/libchdb.so /usr/local/lib/libchdb.so diff --git a/Dockerfile.proxy-runtime b/Dockerfile.proxy-runtime index a3ca501..73ecd48 100644 --- a/Dockerfile.proxy-runtime +++ b/Dockerfile.proxy-runtime @@ -12,8 +12,13 @@ FROM debian:bookworm-slim ARG TARGETARCH +# CVE-2026-111943: fail the build if the CA bundle still trusts the +# compromised eMudhra emSign ECC Root CA - G3 (dropped in Debian +# ca-certificates 20250419~deb12u2). Changing this step also keeps a cached +# layer from carrying an older bundle into the image. RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates \ + && test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem \ && rm -rf /var/lib/apt/lists/* COPY ${TARGETARCH}/hyperbytedb-proxy /usr/local/bin/hyperbytedb-proxy diff --git a/Dockerfile.runtime b/Dockerfile.runtime index 269ab66..af822ed 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -20,8 +20,13 @@ FROM debian:bookworm-slim # which staging subdirectory to copy from. ARG TARGETARCH +# CVE-2026-111943: fail the build if the CA bundle still trusts the +# compromised eMudhra emSign ECC Root CA - G3 (dropped in Debian +# ca-certificates 20250419~deb12u2). Changing this step also keeps a cached +# layer from carrying an older bundle into the image. RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates libstdc++6 curl \ + && test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem \ && rm -rf /var/lib/apt/lists/* COPY ${TARGETARCH}/libchdb.so /usr/local/lib/libchdb.so diff --git a/clients/rust/Cargo.lock b/clients/rust/Cargo.lock index 8690198..bbaa274 100644 --- a/clients/rust/Cargo.lock +++ b/clients/rust/Cargo.lock @@ -818,9 +818,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -1267,9 +1267,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/hyperbytedb-proxy/Dockerfile b/hyperbytedb-proxy/Dockerfile index 9cca76a..90a4437 100644 --- a/hyperbytedb-proxy/Dockerfile +++ b/hyperbytedb-proxy/Dockerfile @@ -62,8 +62,13 @@ RUN --mount=type=cache,target=/root/.cargo/registry \ # --------------------------------------------------------------------------- FROM debian:bookworm-slim +# CVE-2026-111943: fail the build if the CA bundle still trusts the +# compromised eMudhra emSign ECC Root CA - G3 (dropped in Debian +# ca-certificates 20250419~deb12u2). Changing this step also keeps a cached +# layer from carrying an older bundle into the image. RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates \ + && test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem \ && rm -rf /var/lib/apt/lists/* COPY --from=builder /artifacts/hyperbytedb-proxy /usr/local/bin/hyperbytedb-proxy From 8ca0027882a6832c38c727c9693dd6f30a91aeb3 Mon Sep 17 00:00:00 2001 From: Austin Barrington Date: Thu, 22 Oct 2026 23:28:55 +0100 Subject: [PATCH 2/2] Lockfile: chdb-rust builds without reqwest 0.11 chdb-rust's build script moved to reqwest 0.12 with rustls (its fix/emudhra-ca), which drops h2 0.3.27 (RUSTSEC-2026-0258) and OpenSSL from the build. Merge after that chdb-rust change: release images build with --locked against chdb-rust main. --- Cargo.lock | 355 +++++++---------------------------------------------- 1 file changed, 44 insertions(+), 311 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 2c79755..f4a143f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -479,10 +479,10 @@ dependencies = [ "bytes", "form_urlencoded", "futures-util", - "http 1.5.0", - "http-body 1.1.0", + "http", + "http-body", "http-body-util", - "hyper 1.11.0", + "hyper", "hyper-util", "itoa", "matchit", @@ -494,7 +494,7 @@ dependencies = [ "serde_json", "serde_path_to_error", "serde_urlencoded", - "sync_wrapper 1.0.2", + "sync_wrapper", "tokio", "tower", "tower-layer", @@ -510,12 +510,12 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1" dependencies = [ "bytes", "futures-core", - "http 1.5.0", - "http-body 1.1.0", + "http", + "http-body", "http-body-util", "mime", "pin-project-lite", - "sync_wrapper 1.0.2", + "sync_wrapper", "tower-layer", "tower-service", "tracing", @@ -541,13 +541,13 @@ dependencies = [ "arc-swap", "bytes", "fs-err", - "http 1.5.0", - "http-body 1.1.0", - "hyper 1.11.0", + "http", + "http-body", + "hyper", "hyper-util", "pin-project-lite", "rustls", - "rustls-pemfile 2.2.0", + "rustls-pemfile", "rustls-pki-types", "tokio", "tokio-rustls", @@ -569,12 +569,6 @@ dependencies = [ "windows-link", ] -[[package]] -name = "base64" -version = "0.21.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" - [[package]] name = "base64" version = "0.22.1" @@ -825,7 +819,7 @@ dependencies = [ "arrow", "bindgen 0.70.1", "flate2", - "reqwest 0.11.27", + "reqwest 0.12.28", "tar", "thiserror 1.0.69", ] @@ -1003,16 +997,6 @@ dependencies = [ "tiny-keccak", ] -[[package]] -name = "core-foundation" -version = "0.9.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" -dependencies = [ - "core-foundation-sys", - "libc", -] - [[package]] name = "core-foundation" version = "0.10.1" @@ -1283,15 +1267,6 @@ version = "1.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d" -[[package]] -name = "encoding_rs" -version = "0.8.35" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3" -dependencies = [ - "cfg-if", -] - [[package]] name = "endian-type" version = "0.1.2" @@ -1446,21 +1421,6 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" -[[package]] -name = "foreign-types" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1" -dependencies = [ - "foreign-types-shared", -] - -[[package]] -name = "foreign-types-shared" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b" - [[package]] name = "form_urlencoded" version = "1.2.2" @@ -1641,25 +1601,6 @@ version = "0.3.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b" -[[package]] -name = "h2" -version = "0.3.27" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d" -dependencies = [ - "bytes", - "fnv", - "futures-core", - "futures-sink", - "futures-util", - "http 0.2.12", - "indexmap", - "slab", - "tokio", - "tokio-util", - "tracing", -] - [[package]] name = "h2" version = "0.4.20" @@ -1671,7 +1612,7 @@ dependencies = [ "fnv", "futures-core", "futures-sink", - "http 1.5.0", + "http", "indexmap", "slab", "tokio", @@ -1771,17 +1712,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "http" -version = "0.2.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1" -dependencies = [ - "bytes", - "fnv", - "itoa", -] - [[package]] name = "http" version = "1.5.0" @@ -1792,17 +1722,6 @@ dependencies = [ "itoa", ] -[[package]] -name = "http-body" -version = "0.4.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2" -dependencies = [ - "bytes", - "http 0.2.12", - "pin-project-lite", -] - [[package]] name = "http-body" version = "1.1.0" @@ -1810,7 +1729,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c" dependencies = [ "bytes", - "http 1.5.0", + "http", ] [[package]] @@ -1821,8 +1740,8 @@ checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2" dependencies = [ "bytes", "futures-core", - "http 1.5.0", - "http-body 1.1.0", + "http", + "http-body", "pin-project-lite", ] @@ -1844,30 +1763,6 @@ version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15" -[[package]] -name = "hyper" -version = "0.14.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7" -dependencies = [ - "bytes", - "futures-channel", - "futures-core", - "futures-util", - "h2 0.3.27", - "http 0.2.12", - "http-body 0.4.6", - "httparse", - "httpdate", - "itoa", - "pin-project-lite", - "socket2 0.5.10", - "tokio", - "tower-service", - "tracing", - "want", -] - [[package]] name = "hyper" version = "1.11.0" @@ -1878,9 +1773,9 @@ dependencies = [ "bytes", "futures-channel", "futures-core", - "h2 0.4.20", - "http 1.5.0", - "http-body 1.1.0", + "h2", + "http", + "http-body", "httparse", "httpdate", "itoa", @@ -1896,8 +1791,8 @@ version = "0.27.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f" dependencies = [ - "http 1.5.0", - "hyper 1.11.0", + "http", + "hyper", "hyper-util", "rustls", "rustls-native-certs", @@ -1907,19 +1802,6 @@ dependencies = [ "webpki-roots", ] -[[package]] -name = "hyper-tls" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905" -dependencies = [ - "bytes", - "hyper 0.14.32", - "native-tls", - "tokio", - "tokio-native-tls", -] - [[package]] name = "hyper-util" version = "0.1.20" @@ -1930,9 +1812,9 @@ dependencies = [ "bytes", "futures-channel", "futures-util", - "http 1.5.0", - "http-body 1.1.0", - "hyper 1.11.0", + "http", + "http-body", + "hyper", "ipnet", "libc", "percent-encoding", @@ -2017,7 +1899,7 @@ dependencies = [ "dirs", "flate2", "http-body-util", - "hyper 1.11.0", + "hyper", "hyper-util", "hyperbytedb", "hyperlocal", @@ -2046,7 +1928,7 @@ dependencies = [ "bytes", "criterion", "futures", - "http 1.5.0", + "http", "http-body-util", "metrics", "metrics-exporter-prometheus", @@ -2069,7 +1951,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7" dependencies = [ "hex", "http-body-util", - "hyper 1.11.0", + "hyper", "hyper-util", "pin-project-lite", "tokio", @@ -2523,7 +2405,7 @@ checksum = "dd7399781913e5393588a8d8c6a2867bf85fb38eaf2502fdce465aad2dc6f034" dependencies = [ "base64 0.22.1", "http-body-util", - "hyper 1.11.0", + "hyper", "hyper-rustls", "hyper-util", "indexmap", @@ -2585,23 +2467,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "native-tls" -version = "0.2.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2" -dependencies = [ - "libc", - "log", - "openssl", - "openssl-probe", - "openssl-sys", - "schannel", - "security-framework", - "security-framework-sys", - "tempfile", -] - [[package]] name = "nibble_vec" version = "0.1.0" @@ -2754,49 +2619,12 @@ dependencies = [ "syn 2.0.119", ] -[[package]] -name = "openssl" -version = "0.10.81" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45" -dependencies = [ - "bitflags 2.13.1", - "cfg-if", - "foreign-types", - "libc", - "openssl-macros", - "openssl-sys", -] - -[[package]] -name = "openssl-macros" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.119", -] - [[package]] name = "openssl-probe" version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" -[[package]] -name = "openssl-sys" -version = "0.9.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" -dependencies = [ - "cc", - "libc", - "pkg-config", - "vcpkg", -] - [[package]] name = "opentelemetry" version = "0.33.0" @@ -2819,7 +2647,7 @@ checksum = "ee2c3625b8aa04209f7e01e513bc8044da9687fa38a9eacf59628ca5f3b87300" dependencies = [ "async-trait", "bytes", - "http 1.5.0", + "http", "opentelemetry", "reqwest 0.13.5", ] @@ -2830,7 +2658,7 @@ version = "0.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "699a67345e21962a231955b9059a157e428b219fa5df8efe11f08346fb23a344" dependencies = [ - "http 1.5.0", + "http", "httpdate", "opentelemetry", "opentelemetry-http", @@ -3444,46 +3272,6 @@ dependencies = [ "bytecheck", ] -[[package]] -name = "reqwest" -version = "0.11.27" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62" -dependencies = [ - "base64 0.21.7", - "bytes", - "encoding_rs", - "futures-core", - "futures-util", - "h2 0.3.27", - "http 0.2.12", - "http-body 0.4.6", - "hyper 0.14.32", - "hyper-tls", - "ipnet", - "js-sys", - "log", - "mime", - "native-tls", - "once_cell", - "percent-encoding", - "pin-project-lite", - "rustls-pemfile 1.0.4", - "serde", - "serde_json", - "serde_urlencoded", - "sync_wrapper 0.1.2", - "system-configuration", - "tokio", - "tokio-native-tls", - "tower-service", - "url", - "wasm-bindgen", - "wasm-bindgen-futures", - "web-sys", - "winreg", -] - [[package]] name = "reqwest" version = "0.12.28" @@ -3492,13 +3280,14 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147" dependencies = [ "base64 0.22.1", "bytes", + "futures-channel", "futures-core", "futures-util", - "h2 0.4.20", - "http 1.5.0", - "http-body 1.1.0", + "h2", + "http", + "http-body", "http-body-util", - "hyper 1.11.0", + "hyper", "hyper-rustls", "hyper-util", "js-sys", @@ -3511,7 +3300,7 @@ dependencies = [ "serde", "serde_json", "serde_urlencoded", - "sync_wrapper 1.0.2", + "sync_wrapper", "tokio", "tokio-rustls", "tokio-util", @@ -3537,16 +3326,16 @@ dependencies = [ "futures-channel", "futures-core", "futures-util", - "http 1.5.0", - "http-body 1.1.0", + "http", + "http-body", "http-body-util", - "hyper 1.11.0", + "hyper", "hyper-util", "js-sys", "log", "percent-encoding", "pin-project-lite", - "sync_wrapper 1.0.2", + "sync_wrapper", "tokio", "tower", "tower-http", @@ -3734,15 +3523,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "rustls-pemfile" -version = "1.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c" -dependencies = [ - "base64 0.21.7", -] - [[package]] name = "rustls-pemfile" version = "2.2.0" @@ -3869,7 +3649,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" dependencies = [ "bitflags 2.13.1", - "core-foundation 0.10.1", + "core-foundation", "core-foundation-sys", "libc", "security-framework-sys", @@ -4201,12 +3981,6 @@ dependencies = [ "unicode-ident", ] -[[package]] -name = "sync_wrapper" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160" - [[package]] name = "sync_wrapper" version = "1.0.2" @@ -4227,27 +4001,6 @@ dependencies = [ "syn 2.0.119", ] -[[package]] -name = "system-configuration" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7" -dependencies = [ - "bitflags 1.3.2", - "core-foundation 0.9.4", - "system-configuration-sys", -] - -[[package]] -name = "system-configuration-sys" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9" -dependencies = [ - "core-foundation-sys", - "libc", -] - [[package]] name = "tap" version = "1.0.1" @@ -4418,16 +4171,6 @@ dependencies = [ "syn 3.0.3", ] -[[package]] -name = "tokio-native-tls" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2" -dependencies = [ - "native-tls", - "tokio", -] - [[package]] name = "tokio-rustls" version = "0.26.4" @@ -4532,7 +4275,7 @@ dependencies = [ "futures-core", "futures-util", "pin-project-lite", - "sync_wrapper 1.0.2", + "sync_wrapper", "tokio", "tower-layer", "tower-service", @@ -4550,8 +4293,8 @@ dependencies = [ "bytes", "futures-core", "futures-util", - "http 1.5.0", - "http-body 1.1.0", + "http", + "http-body", "http-body-util", "pin-project-lite", "tokio", @@ -5203,16 +4946,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "winreg" -version = "0.50.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1" -dependencies = [ - "cfg-if", - "windows-sys 0.48.0", -] - [[package]] name = "wit-bindgen" version = "0.57.1"