deps(#193): quick-xml >= 0.41 via atom_syndication/rss forks (clear RUSTSEC-2026-0194/0195)#200
Merged
Merged
Conversation
Record the resolved design for clearing RUSTSEC-2026-0194/0195: no upstream release path exists (atom_syndication 0.12.8 / rss 2.0.13 hard-pin quick-xml ^0.39, no 0.39.x backport), so fork both onto quick-xml 0.41 and wire via a git [patch.crates-io] with hermetic crane vendoring, rather than a permanent advisory ignore. ADR-0042 (0041 reserved by #192, per ADR-0036 collision policy). Refs #193
Move the whole tree onto quick-xml 0.41 (the fix for RUSTSEC-2026-0194/0195): - [patch.crates-io] points atom_syndication and rss at jaunder-org forks pinned to the revs that raise their quick-xml requirement to 0.41 (upstream's latest releases hard-pin ^0.39 with no 0.39.x backport, so a direct quick-xml [patch] is impossible). - common's direct quick-xml dep bumped 0.39 -> 0.41. Cargo.lock now resolves a single quick-xml 0.41.0 (no 0.39.x). - flake.nix: vendor the git [patch] hermetically for crane. The forks are added as pinned flake inputs and fed to vendorCargoDeps via overrideVendorGitCheckout, wrapping each single-crate repo in crane's expected <name>-<version>/ layout with a git-source .cargo-checksum.json. Wired into commonArgs (app/coverage builds) and the deny check so cargo metadata resolves offline. - deny.toml: allow jaunder-org as a git source org. The temporary advisory ignore stays until the final task removes it. Verified: host cargo xtask check green + hermetic nix deny/coverage builds compile the vendored forks. ADR-0042. Refs #193
The tree now resolves a single quick-xml 0.41.0 via the atom_syndication/rss forks, so both advisories genuinely no longer apply. Remove the temporary scaffold ignore added in #194 — the end state carries no advisory ignore, per ADR-0042. Verified: cargo deny check advisories passes with no ignore. Refs #193
Move the completed spec and plan into docs/archive/ (all plan tasks ticked). ADR-0042 remains in docs/adr/. Refs #193
#160 (emacs org->atom mapping) merged to main first and took ADR-0042, so per the ADR-0036 identifier-collision policy this cycle's ADR moves to 0043. Renames the ADR file and updates every reference (Cargo.toml, flake.nix, deny.toml, archived spec/plan, README table). No behavioural change. Refs #193
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / why
Clears RUSTSEC-2026-0194 and RUSTSEC-2026-0195 (DoS advisories against
quick-xml
< 0.41) by moving the whole tree onto quick-xml 0.41 — the real fixbehind the temporary
deny.tomlignore landed in #194.No upstream release path exists:
atom_syndication0.12.8 /rss2.0.13 are thelatest releases and both hard-pin quick-xml
^0.39, with no 0.39.x backport — so adirect quick-xml
[patch]is impossible. Instead we fork the two crates onto quick-xml0.41 and wire them in via a git
[patch.crates-io], vendored hermetically for the Nixbuild. Full rationale in ADR-0043.
Closes #193.
Changes
[patch.crates-io]→jaunder-org/atomandjaunder-org/rssforks, pinned torevs that raise each fork's quick-xml requirement to 0.41 (the touched quick-xml API
is unchanged across 0.39→0.41; each fork's full test suite passes).
commondirect quick-xml dep0.39→0.41.Cargo.locknow resolves a singlequick-xml 0.41.0— no 0.39.x remains.flake.nix— vendor the git[patch]hermetically for crane: the forks are addedas pinned flake inputs and fed to
vendorCargoDepsviaoverrideVendorGitCheckout,wrapping each single-crate repo in crane's expected
<name>-<version>/layout with agit-source
.cargo-checksum.json. Wired intocommonArgs(app/coverage) and thedenycheck socargo metadata/cargo denyresolve offline.deny.toml— allowjaunder-orgas a git-source org; remove the temporaryRUSTSEC-2026-0194/0195 ignore (end state carries no advisory ignore).
ADR-0036 collision policy).
Verification
cargo xtask check+cargo xtask validate --no-e2egreen (host).denyandnix-coveragebuild/compile the vendored forks; the elisplive-integration nixosTest (AtomPub wire round-trip) passes — no serialize/parse
regression.
validateincl. the e2e matrix as the backstop.Temporary by design — cleanup tracked
The forks +
[patch]are a bridge until upstream ships releases on quick-xml ≥ 0.41.Upstream PRs are open (rust-syndication/atom#96, rust-syndication/rss#190), and #199
tracks removing the whole apparatus once they land.