From f9f28d1812fc45562e2ab63e8db53c08eb75ee3b Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Mon, 3 Aug 2026 02:46:49 -0400 Subject: [PATCH 1/2] fix(deps): clear the outstanding RUSTSEC advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit osv-scanner has been failing the security job with four unpatched advisories. Three lift cleanly with `cargo update`, and a fourth (event-listener) has been published since the last run: anyhow 1.0.102 -> 1.0.104 RUSTSEC-2026-0190 crossbeam-epoch 0.9.18 -> 0.9.20 RUSTSEC-2026-0204 memmap2 0.9.10 -> 0.9.11 RUSTSEC-2026-0186 event-listener 5.4.1 -> 5.4.2 RUSTSEC-2026-0221 memmap2 also resolves a second time at 0.5.10, reached only through the vendored solana-program-test dev-dependency. That chain pins the 0.5.x line, so it cannot be lifted without an upstream Solana bump — filtered with a rationale, matching how the other unfixable transitive advisories are handled. The first-order 0.9.x path is genuinely fixed, not filtered. Also drop a duplicate RUSTSEC-2026-0173 block. osv-scanner was warning "multiple ignores ... only the first will be used" and reporting the second as an unused ignore; the two rationales disagreed about the dependency path, and the retained one matches what the scanner actually reports. --- Cargo.lock | 32 +++++++++++--------------------- osv-scanner.toml | 17 +++++++++++------ 2 files changed, 22 insertions(+), 27 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 4a04a55..65ccb2d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -555,9 +555,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "anza-quinn" @@ -1389,15 +1389,6 @@ version = "0.4.31" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d" -[[package]] -name = "concurrent-queue" -version = "2.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" -dependencies = [ - "crossbeam-utils", -] - [[package]] name = "console" version = "0.16.3" @@ -1496,9 +1487,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] @@ -2044,11 +2035,10 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ] @@ -3218,9 +3208,9 @@ dependencies = [ [[package]] name = "memmap2" -version = "0.9.10" +version = "0.9.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3" +checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0" dependencies = [ "libc", ] @@ -4906,7 +4896,7 @@ dependencies = [ "itertools 0.12.1", "log", "lz4", - "memmap2 0.9.10", + "memmap2 0.9.11", "modular-bitfield", "num_cpus", "num_enum", @@ -5203,7 +5193,7 @@ dependencies = [ "bv", "bytemuck", "bytemuck_derive", - "memmap2 0.9.10", + "memmap2 0.9.11", "modular-bitfield", "num_enum", "rand 0.8.6", @@ -6633,7 +6623,7 @@ dependencies = [ "libc", "log", "lz4", - "memmap2 0.9.10", + "memmap2 0.9.11", "mockall", "modular-bitfield", "num-derive", diff --git a/osv-scanner.toml b/osv-scanner.toml index b65c288..e20ec30 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -70,9 +70,14 @@ reason = "rand 0.7.3 transitive via solana-* deps; fixed versions (0.8.6, 0.9.3) # vendor/solana-invoke and vendor/solana-keypair, which ship no lockfile. [[IgnoredVulns]] -id = "RUSTSEC-2026-0173" -# proc-macro-error2 2.0.1 is a build-time proc-macro helper pulled in transitively -# via anchor-lang's derive macros. It runs only at compile time and is not part of -# the on-chain BPF runtime. osv reports no fixed version (FIXED VERSION: --), so this -# can only be filtered until anchor-lang migrates off proc-macro-error2. -reason = "proc-macro-error2 2.0.1 transitive via anchor-lang derive macros; build-time proc-macro only, not in on-chain BPF runtime; no upstream fix available" +id = "RUSTSEC-2026-0186" +# memmap2 0.5.10, reached only through the vendored solana-program-test +# dev-dependency: solana-genesis-config 3.0.0 -> agave-snapshots -> +# solana-runtime -> solana-banks-server -> solana-program-test. That chain +# pins the 0.5.x line, so `cargo update` cannot lift it to 0.9.11 without an +# upstream Solana bump. +# +# The first-order path is NOT ignored — memmap2 0.9.10 was updated to the +# fixed 0.9.11 in this same change. This entry exists solely to cover the +# dev-dep-only 0.5.x pin. Drop it as soon as Solana moves off memmap2 0.5. +reason = "memmap2 0.5.10 transitive via vendored solana-program-test (dev-dep only); 0.9.x path already updated to the fixed 0.9.11; 0.5.x pin requires upstream Solana bump" From 4ebcd237a430a371f088394d80d009e2a457b28b Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Mon, 3 Aug 2026 04:02:52 -0400 Subject: [PATCH 2/2] fix(deps): scope the memmap2 exception to the affected version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses review feedback on the RUSTSEC-2026-0186 entry. IgnoredVulns matches by advisory ID alone, so the previous block suppressed the advisory across the whole scan. A future regression onto an affected memmap2 version — including on a non-dev path — would have been silently swallowed, which is not what the rationale claimed the exception covered. Switch to a version-scoped PackageOverrides pinned to memmap2 0.5.10, the only copy that cannot be lifted (dev-dep-only, via vendored solana-program-test). Verified: the scan still reports "No issues found", and the filter line now reads "Package crates.io/memmap2/0.5.10 has been filtered out" rather than naming the advisory. Repointing the override at an absent version makes RUSTSEC-2026-0186 fire on 0.5.10 again, confirming the scoping is real. --- osv-scanner.toml | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index e20ec30..042b02b 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -69,15 +69,25 @@ reason = "rand 0.7.3 transitive via solana-* deps; fixed versions (0.8.6, 0.9.3) # osv-scanner.toml) were removed, matching the sibling vendored crates # vendor/solana-invoke and vendor/solana-keypair, which ship no lockfile. -[[IgnoredVulns]] -id = "RUSTSEC-2026-0186" -# memmap2 0.5.10, reached only through the vendored solana-program-test -# dev-dependency: solana-genesis-config 3.0.0 -> agave-snapshots -> -# solana-runtime -> solana-banks-server -> solana-program-test. That chain -# pins the 0.5.x line, so `cargo update` cannot lift it to 0.9.11 without an -# upstream Solana bump. +# ── Version-scoped package exceptions ─────────────────────────────────────── +# +# Prefer PackageOverrides over IgnoredVulns when only ONE version of a package +# is unfixable. IgnoredVulns matches by advisory ID alone, so it would suppress +# the advisory across the whole scan — including a future regression on a +# non-dev path. This form pins the exception to the exact version. + +[[PackageOverrides]] +name = "memmap2" +version = "0.5.10" +ecosystem = "crates.io" +ignore = true +# Reached only through the vendored solana-program-test dev-dependency: +# solana-genesis-config 3.0.0 -> agave-snapshots -> solana-runtime -> +# solana-banks-server -> solana-program-test. That chain pins the 0.5.x line, +# so `cargo update` cannot lift it to 0.9.11 without an upstream Solana bump. # -# The first-order path is NOT ignored — memmap2 0.9.10 was updated to the -# fixed 0.9.11 in this same change. This entry exists solely to cover the -# dev-dep-only 0.5.x pin. Drop it as soon as Solana moves off memmap2 0.5. -reason = "memmap2 0.5.10 transitive via vendored solana-program-test (dev-dep only); 0.9.x path already updated to the fixed 0.9.11; 0.5.x pin requires upstream Solana bump" +# The first-order path is NOT excepted — memmap2 0.9.10 was updated to the +# fixed 0.9.11 in this same change, and because this override is version-scoped +# RUSTSEC-2026-0186 still fires on any other memmap2 version. Drop this block +# as soon as Solana moves off memmap2 0.5. +reason = "memmap2 0.5.10 only, transitive via vendored solana-program-test (dev-dep); 0.9.x path already updated to the fixed 0.9.11; 0.5.x pin requires upstream Solana bump"