So I couldn't sleep (insomnia) and I thought I'd try running cargo-audit on this project, it found quite a few issues. 馃ズ
Figured I should try and do something about it, so I started updating dependencies and fixing API/migration drift. These are the audit results:
| Audit result | main |
audit-fix |
Reduction |
|---|---|---|---|
| Vulnerability findings (advisory/package-version matches) | 30 | 5 | 25 (83.3%) |
| Distinct vulnerability advisory IDs | 23 | 5 | 18 (78.3%) |
| Unmaintained warnings | 7 | 5 | 2 |
| Unsoundness warnings | 8 | 0 | 8 |
| Yanked-version warnings | 6 | 0 | 6 |
| Total warnings | 21 | 5 | 16 (76.2%) |
| Vulnerability findings plus warnings | 51 | 10 | 41 (80.4%) |
Keep in mind that I have very little experience with your codebase and I can't tell what dependency absolutely must stay the same version lest we'd run in to bugs or unintended behavior.
I did run as many tests as I could though and they seemed to do okay mostly.
all 1,425 tests passed, with 0 failures and 0 ignored, including all 250 PDS unit tests. subsequent workspace integration-test run completed with 838 passed, 135 failed, and 22 ignored across 120 test targets Observed failures included:
- HTTP 429 rate limits during account creation and other API operations.
- OAuth/PAR failures, including unexpected responses and missing response fields.
- Rootless Docker port collisions preventing MinIO or PostgreSQL startup.
- PostgreSQL pool timeouts and a Tokio runtime shutdown error.
- A file-descriptor leak assertion in
tranquil-store'sfd_lifecycletest: 14 descriptors before the test versus 17 after dropping the store.
I had a clanker help me with digesting the test results and report-writing and overall help navigating the codebase.
I saved everything in a branch available here: https://tangled.org/luna.pds.devcat.one/tranquil-pds/tree/audit-fix
I would not recommend merging this branch (but peek at how it could be done). Codeowners ideally should eventually update their dependencies and make their code compatible with the new versions if necessary.
In the end, I do believe it's important to eventually update the dependencies to reduce the number of known/possibly exploitable code and gain fixes to potentially other issues or bugs.
Hm maybe this isn't too helpful, I just thought I'd bring it up. Meow
--- 2am to 6am ramblings powered by brainfog
if nothing else this is useful to prompt us to look at this. even just regenerating the lockfile gives a decent reduction. im sure a decent few of these arent things our usage of these crates will run in to. but its still useful.
might make sense for us to have a CI job run cargo-audit tbh