mirror of https://github.com/synctv-org/synctv
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ca36865152
## Dependency updates (exact pins) - **http-acl 0.13.1 → 0.14.0**: security hardening — IPv4-embedded IPv6 ranges (IPv4-compatible `::/96`, translated `::ffff:0:0:0/96`, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`) are now denied by default; previously `::7f00:1` or `64:ff9b::7f00:1` could reach loopback through the SSRF guard. Also fixes the reqwest resolver dropping every getaddrinfo answer carrying port 0 - lru 0.19.0 (iterator Send/Sync bounds), ammonia 4.2.4, opendal 0.59.5, oxc 0.155.0, rustls 0.23.46, rusty_aac 1.1.1, rusty_h264 0.16.1, webpki-roots 1.0.10, zstd 0.14.3, tokio-util 0.7.20 and other transitives ## http-acl 0.14 adaptation (synctv-common SSRF guard) 0.14 refuses adding non-global ranges via `add_denied_ip_range` at build time. Our `DEFAULT_EXTRA_DENIED_RANGES` contained `2002::/16`, so `try_build` failed and the guard silently degraded to the **deny-all fallback** (every IP and hostname blocked). Fix: - `2002::/16` moved to `DEFAULT_NON_GLOBAL_DENIED_RANGES` (the SsrfPolicy-side list used by `is_ip_blocked`), together with the other embedded ranges: `::/96`, `::ffff:0:0:0/96`, `64:ff9b:1::/48` - new `test_ipv4_embedded_ipv6_blocked` covers all embedded probe forms (including the NAT64 metadata address) and a global IPv6 control ## tokio 1.53.2 → 1.54.0 1.54.0 starts accepted sockets as readable and writable, so the raw-TCP mocks in `error_handling_tests` could flush the response before the client had written its request; hyper rejects such a connection with `UnexpectedMessage` inside `reqwest::get`. The mocks now drain the request head before answering (normal HTTP ordering, matches a real server) and the suite passes on 1.54.0. ## Kept on purpose - bincode 2.0.1 (3.0.0 placeholder), dashmap 7.0.0-rc2, opaque-ke 4.1.0-pre.2, webauthn-rs 0.6.1-dev, serde_yaml, testcontainers 0.27 (modules 0.15 still requires ^0.27) ## Toolchain / CI - nightly-2026-10-13 → **nightly-2026-10-20** (rust-toolchain.toml + all workflows) - actions already float on latest major tags (checkout v7, cache v6, …) — no changes needed ## Validation - `make check`, `make check-all-targets`, `make clippy-check -D warnings`, `make fmt-check` clean - `cargo nextest run --workspace --run-ignored all`: **6970/6970 passed** (incl. docker-backed e2e) - `cargo deny check`: advisories/bans/licenses/sources all ok |
7 days ago | |
|---|---|---|
| .. | ||
| src | 7 days ago | |
| Cargo.toml | ||