security: fix all open Dependabot alerts and pin third-party Actions#650
Merged
Conversation
Resolves the four open Dependabot alerts and the unpinned third-party GitHub Actions security finding (Aikido, see #578). Dependency fixes - Bump `jsonwebtoken` 9.3.1 -> 10.1.0 (Cargo.lock pulls 10.3.0). Fixes GHSA-h395-gr6q-cpjc (alert #20). Public API used in `src/tracer/src/utils/jwt_utils/clerk.rs` (`decode`, `decode_header`, `Validation`, `DecodingKey::from_jwk`, `Algorithm::RS256`) is unchanged in 10.x; default `aws_lc_rs` crypto backend is preserved. - Drop the legacy `rustls` feature on `aws-sdk-{ec2,pricing,s3, secretsmanager}` and rely on `default-https-client` (rustls 0.23 + aws-lc-rs). Fully removes `rustls 0.21.12`, `rustls-webpki 0.101.7`, `hyper-rustls 0.24`, `tokio-rustls 0.24`, `hyper 0.14`, `h2 0.3`, and `sct 0.7` from the dependency graph. Fixes: - GHSA-82j2-j2ch-gfr8 (alert #40, high) - GHSA-xgp8-3hg3-c2mh (alert #37, low) - GHSA-965h-392x-2mh5 (alert #36, low) - Refresh `Cargo.lock` (cargo update): `rustls 0.23.39 -> 0.23.40`, `aws-sdk-s3 -> 1.132.0`, `aws-sdk-ec2 -> 1.224.0`, `tokio -> 1.52.2`, `wasm-bindgen -> 0.2.120`, `tower-http -> 0.6.10`, etc. GitHub Actions hardening (supersedes #578) Pin every third-party action to a commit SHA, with a tracking comment: - `actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1` - `prefix-dev/setup-pixi@14c8aabd75893f83f4ab30c03e7cf853c8208961 # v0.8.10` - `aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4` Verification - `cargo audit` -> 0 vulnerabilities (was 4). - `cargo check --all-targets` succeeds. - `cargo test --lib` -> 110 passed, 0 failed. - Pre-existing clippy warnings (`assert!(true)`, `module_inception`) on `main` are not addressed here; out of scope for this security PR. Co-authored-by: Cursor <cursoragent@cursor.com>
Deploying tracer-client with
|
| Latest commit: |
3fb95f3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://deed48cc.tracer-client.pages.dev |
| Branch Preview URL: | https://fix-security-comprehensive.tracer-client.pages.dev |
4 tasks
davincios
added a commit
that referenced
this pull request
May 6, 2026
…est builds (#651) `cargo clippy --all-targets -- -D warnings` was failing on `main` due to a handful of pre-existing lints in test code. CI's `cargo clippy -- -D warnings` hid these because it does not lint test targets, but anyone running clippy locally with `--all-targets` (or doing a `cargo test`-time clippy) hit them. Changes: - `clippy::assertions_on_constants` (6 occurrences) — replace placeholder `assert!(true)` bodies in `cli/handlers/update/{tests,updater}.rs`. Three mock-shaped tests that genuinely had nothing to assert are now empty bodies marked `#[ignore = "placeholder: ..."]` so they show up under `cargo test -- --ignored` but no longer pollute the default run. Trivial "did construction succeed" tests drop the redundant `assert!(true)` since reaching the line already proves the test passed. - `clippy::module_inception` — `cloud_providers/aws/pricing/tests.rs` previously wrapped its contents in an inner `mod tests { ... }`, producing the path `pricing::tests::tests`. Removed the wrapper; the file is itself the `tests` module. - `cloud_providers/aws/pricing/mod.rs` declared the `tests` submodule with `pub mod tests;`, which compiled the test code in non-test builds and re-exported it. Switched to `#[cfg(test)] mod tests;` so test code is test-only and private. Verification (post-PR #650 main): - `cargo clippy --all-targets -- -D warnings` -> clean (was 6 warnings → -D warnings made them errors). - `cargo clippy -- -D warnings` (CI's exact command) -> clean. - `cargo fmt --all -- --check` -> clean. - `cargo test --features test-bins` -> all suites pass; 106 lib tests pass with 5 ignored (3 newly-marked placeholders + 2 pre-existing). - `cargo audit` -> 0 vulnerabilities. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the four open Dependabot security alerts and the Aikido SAST finding for unpinned third-party GitHub Actions in one focused PR.
After this PR
cargo auditreports 0 vulnerabilities (down from 4) and there are no@vNfloating tags on third-party Actions.jsonwebtokenrustls-webpkirustls-webpkirustls-webpkiWhat changed
jsonwebtoken9.3.1 → 10.xThe fix for the type-confusion advisory is only available in
10.x. The crate's public API used insrc/tracer/src/utils/jwt_utils/clerk.rs(decode,decode_header,DecodingKey::from_jwk,Validation::new(Algorithm::RS256)) is unchanged in 10.x. The defaultaws_lc_rscrypto backend is preserved, so no feature-flag changes are required.aws-sdk-*feature surgeryThe three
rustls-webpkiadvisories all stem from this transitive chain:The
rustlsfeature on eachaws-sdk-*crate is just an alias for the legacy chain above and is redundant withdefault-https-client, which already provides modernrustls 0.23+aws-lc-rs. Disabling default features and re-enabling everything exceptrustlsremoves the vulnerable chain entirely while leaving runtime behavior identical.cargo updateafter the change removes the following fromCargo.lock:rustls 0.21.12rustls-webpki 0.101.7hyper-rustls 0.24.2tokio-rustls 0.24.1hyper 0.14.32h2 0.3.27sct 0.7.1Third-party Actions pinned by SHA
Extends #578 to cover every third-party Action used across
.github/workflows/:actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1prefix-dev/setup-pixi@14c8aabd75893f83f4ab30c03e7cf853c8208961 # v0.8.10aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4(4 call-sites)First-party
actions/*(checkout, cache, setup-python, upload-artifact, download-artifact) are left on their version tags per common practice.Test plan
cargo audit→0 vulnerabilities(verified locally withcargo-audit 0.22.1)cargo check --all-targets→ succeedscargo test --lib→ 110 passed, 0 failed, 2 ignoredcargo fmt --all -- --check→ cleanRust Cargo Auditworkflow stays greenRust Cargo TestandRust Cargo Clippystay green (note: pre-existingassert!(true)andmodule_inceptionclippy warnings onmainare out of scope for this security PR)Development release for client & installer to s3builds successfully on all matrix legs (validates the SHA-pinnedactions-rs/toolchainandaws-actions/configure-aws-credentials)Supersedes / closes
jsonwebtokenonly; this PR does that and more)Made with Cursor