Fix unic RustSec advisory via patched piet

jsturtevant · jsturtevant · commit 9c107f20a1df · 2026-06-08T17:27:31.000-07:00
Patch piet to the upstream commit that replaces the unmaintained unic-bidi dependency with icu_properties. Bump Rust toolchain references to 1.92 because the upstream piet fix requires it, and refresh Cargo.lock so the unic advisory crates are removed.\n\nCo-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;

Signed-off-by: James Sturtevant &lt;jsturtevant@gmail.com&gt;
diff --git a/.github/workflows/CargoAudit.yml b/.github/workflows/CargoAudit.yml
@@ -19,7 +19,7 @@ jobs:
       # TODO: Once the runner image is updated to include the necessary tools (without downloading), we can switch to the common workflow.
       - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1.16.1
         with:
-          toolchain: "1.89"
+          toolchain: "1.92"
 
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998  # v2.0.0
         with:
diff --git a/.github/workflows/CargoPublish.yml b/.github/workflows/CargoPublish.yml
@@ -35,7 +35,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
 
       - name: Check crate versions
         shell: bash
diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
@@ -39,7 +39,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/CreateDevcontainerImage.yml b/.github/workflows/CreateDevcontainerImage.yml
@@ -16,7 +16,7 @@ env:
   USER: vscode
   GROUP: vscode
   LLVM_VERSION: 18
-  RUST_TOOLCHAIN_DEFAULT: 1.89
+  RUST_TOOLCHAIN_DEFAULT: 1.92
   RUST_TOOLCHAIN_FILE: rust-toolchain.toml
 
 # There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
diff --git a/.github/workflows/CreateRelease.yml b/.github/workflows/CreateRelease.yml
@@ -32,7 +32,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -53,7 +53,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -123,7 +123,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
diff --git a/.github/workflows/PrimeCaches.yml b/.github/workflows/PrimeCaches.yml
@@ -81,7 +81,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RustNightly.yml b/.github/workflows/RustNightly.yml
@@ -46,7 +46,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
@@ -31,6 +31,6 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89" 
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dep_benchmarks.yml b/.github/workflows/dep_benchmarks.yml
@@ -85,7 +85,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_build_guests.yml b/.github/workflows/dep_build_guests.yml
@@ -35,7 +35,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_build_test.yml b/.github/workflows/dep_build_test.yml
@@ -52,7 +52,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
@@ -32,7 +32,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89" 
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -104,7 +104,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89" 
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_fuzzing.yml b/.github/workflows/dep_fuzzing.yml
@@ -33,7 +33,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_run_examples.yml b/.github/workflows/dep_run_examples.yml
@@ -52,7 +52,7 @@ jobs:
 
       - uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_update_guest_locks.yml b/.github/workflows/dep_update_guest_locks.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Setup Rust toolchain
         uses: hyperlight-dev/ci-setup-workflow@f6bd9cc86d0737976d2128c8b8ced8edc017cbb4  # v1.9.0
         with:
-          rust-toolchain: "1.89"
+          rust-toolchain: "1.92"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -29,7 +29,7 @@ exclude = [
 [workspace.package]
 version = "0.15.0"
 edition = "2024"
-rust-version = "1.89"
+rust-version = "1.92"
 license = "Apache-2.0"
 homepage = "https://github.com/hyperlight-dev/hyperlight"
 repository = "https://github.com/hyperlight-dev/hyperlight"
@@ -47,6 +47,11 @@ hyperlight-libc = { path = "src/hyperlight_libc", version = "0.15.0", default-fe
 hyperlight-component-util = { path = "src/hyperlight_component_util", version = "0.15.0", default-features = false }
 hyperlight-component-macro = { path = "src/hyperlight_component_macro", version = "0.15.0", default-features = false }
 
+[patch.crates-io]
+# Fixes #1490, #1494, and #1495 by using upstream piet commit 618083f,
+# which replaces the unmaintained unic-bidi dependency with icu_properties.
+piet = { git = "https://github.com/linebender/piet", rev = "618083f8a6671c7ab8c198724487348d2ccf9a8f" }
+
 [workspace.lints.rust]
 unsafe_op_in_unsafe_fn = "deny"
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
@@ -1,5 +1,5 @@
 [toolchain]
-channel = "1.89"
+channel = "1.92"
 # Target used for guest binaries. This is an additive list of targets in addition to host platform.
 # Will install the target if not already installed when building guest binaries.
 targets = ["x86_64-unknown-none", "x86_64-unknown-linux-musl"]
