audit: Fix deps #7130
audit: Fix deps #7130
Conversation
📝 Walkthrough""" WalkthroughThe changes update Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Tip ⚡️ Faster reviews with caching
Enjoy the performance boost—your workflow just got faster. 📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
There was a problem hiding this comment.
Pull Request Overview
This pull request updates dependency configurations to address security advisories and improve dependency management.
- Updated comments in Cargo.toml to clarify dependency behavior (e.g., forced dependency 'ring' is ignored in audit).
- Added new vulnerability IDs to the ignore list in .cargo/audit.toml to address known security advisories.
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Cargo.toml | Adjusted comments for dependencies to clarify dependency handling. |
| .cargo/audit.toml | Added new vulnerability IDs and updated comments with status tags. |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.cargo/audit.toml (1)
7-11: Add annotation for ring-related advisories for consistency
The entries forRUSTSEC-2025-0009andRUSTSEC-2025-0010currently lack a bracketed note (e.g.,[unmaintained]or[unfixed]) explaining why they're ignored. To align with the style used for other advisories and improve future clarity, append an annotation to those lines.Apply this diff:
-"RUSTSEC-2025-0009", # 'ring' dependency in 'ethers-rs' -"RUSTSEC-2025-0010", # 'ring' dependency in 'ethers-rs' +"RUSTSEC-2025-0009", # 'ring' dependency in 'ethers-rs' [unmaintained] +"RUSTSEC-2025-0010", # 'ring' dependency in 'ethers-rs' [unmaintained]
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.cargo/audit.toml(1 hunks)Cargo.toml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (9)
- GitHub Check: hopli / docker
- GitHub Check: hoprd / docker
- GitHub Check: Docs / Rust docs
- GitHub Check: Add PR labels
- GitHub Check: tests-smoke (websocket_api)
- GitHub Check: tests-unit
- GitHub Check: tests-unit-nightly
- GitHub Check: Linter
- GitHub Check: zizmor
🔇 Additional comments (2)
Cargo.toml (2)
91-91: Clarify audit rationale in dependency comment
The comment on theethersdependency clearly explains why its forcedringdependency is ignored in the audit. This aligns with the ignore list in.cargo/audit.toml.
102-102: Approve renovate‐ignore note
The updated comment forhickory-resolversuccinctly notes that it’s ignored in Renovate untillibp2p-dnsis updated. No further changes needed here.
This pull request introduces several changes, primarily focused on replacing the
http-typesdependency with thehttpcrate across multiple files, updating dependencies, and improving serialization handling. Below is a categorized summary of the most important changes:Dependency Updates and Configuration:
.cargo/audit.tomlto remove older advisories and add new ones, includingRUSTSEC-2024-0436for thepastedependency andRUSTSEC-2025-0009/RUSTSEC-2025-0010for theringdependency.Cargo.tomlto replacehttp-typeswithhttpand addedserde_withfor enhanced serialization support. Also added comments to clarify dependency audit status. [1] [2]Migration from
http-typestohttp:http-typeswith thehttpcrate inchain/rpc/src/client.rs, updating all references toMethodandStatusCodeto usehttpequivalents. This includes changes in function signatures, method implementations, and test cases. [1] [2] [3] [4] [5]HttpRequestErrorinchain/rpc/src/errors.rsto usehttp::StatusCodeinstead ofhttp_types::StatusCode.Serialization Enhancements:
serde_withfor better serialization handling inSimpleJsonRpcRetryPolicy. Added annotations like#[serde_as]and#[serde_as(as = "Vec<serde_with::TryFromInto<u16>>")]to improve type safety and maintainability. [1] [2]Code Simplification:
chain/rpc/src/lib.rsby removing unused imports fromhttp-typesand consolidatingserdeimports. UpdatedHttpRequestortrait methods to usehttp::Methodinstead ofhttp_types::Method. [1] [2]Minor Improvements:
chain/rpc/src/client.rsto align with the migration tohttpby usinghttp::StatusCode::TOO_MANY_REQUESTSand related constants. [1] [2]These changes collectively improve dependency management, enhance serialization capabilities, and align the codebase with modern libraries for better maintainability.