Skip to content

fix: upgrade dependencies to resolve cargo-audit security vulnerabilities#331

Open
ruokun-niu wants to merge 1 commit intodrasi-project:mainfrom
ruokun-niu:test-container-vuln-fix
Open

fix: upgrade dependencies to resolve cargo-audit security vulnerabilities#331
ruokun-niu wants to merge 1 commit intodrasi-project:mainfrom
ruokun-niu:test-container-vuln-fix

Conversation

@ruokun-niu
Copy link
Contributor

@ruokun-niu ruokun-niu commented Mar 11, 2026

Description

Upgrade dependencies to resolve cargo-audit security vulnerabilities.

  • Upgrade testcontainers 0.23 → 0.26 to eliminate tokio-tar 0.3.1 transitive dependency (RUSTSEC-2025-0111 / CVE-2025-62518, critical file smuggling vulnerability)
  • Upgrade testcontainers-modules 0.11 → 0.14
  • Upgrade mysql_async 0.34 → 0.36 in storedproc-mysql to mitigate lru unsoundness warning (RUSTSEC-2026-0002)

fixes: #281

Type of change

  • This pull request fixes a bug in Drasi and has an approved issue (issue link required).
  • This pull request adds or changes features of Drasi and has an approved issue (issue link required).
  • This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Drasi (issue link optional).

Fixes: #issue_number

Signed-off-by: ruokun-niu <ruokunniu@gmail.com>
@github-actions github-actions bot added the need-2nd-review Has one approval, needs a second review label Mar 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

need-2nd-review Has one approval, needs a second review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: tokio-tar file smuggling vulnerability via testcontainers (RUSTSEC-2025-0111 / CVE-2025-62518)

2 participants