Repository navigation
fix(deps): hickory-resolver 0.26 and patched lockfiles - #139
Merged
Merged
Conversation
…le entries Clears hickory-proto RUSTSEC-2026-0118/0119 and brings fuzz/Cargo.lock (gix, quinn-proto, rustls, serde_with, tar, hickory) to patched versions. Port dns.rs to the 0.26 API (TokioRuntimeProvider, fallible build, Lookup answers) and skip non-TXT answers explicitly, with unit tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019xLzrkRPPytfYRYLUBwAwJ
hickory 0.26 derives an empty ResolverConfig::default() (0.25 returned Google), so every dns+txt:// lookup failed with "no connections available". Build the config explicitly via ResolverConfig::udp_and_tcp (GOOGLE) in a small fn with a non-network test. Add insert_txt_answers tests killing four mutants (TXT filter dropped, rsplit_once, first-answer-only, continue->return). Drop the stale RUSTSEC-2026-0118/0119 ignores from deny.toml; cargo deny reports them as not detected after the 0.26 upgrade. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019xLzrkRPPytfYRYLUBwAwJ
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019xLzrkRPPytfYRYLUBwAwJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hickory-resolver0.25.2 -> 0.26.2 (lock 0.26.3), clearing hickory-proto GHSA-3v94/RUSTSEC-2026-0118/0119 and hickory-resolver GHSA-5j98/GHSA-6f2x;Cargo.lockandfuzz/Cargo.lockrefreshed so tar, serde_with, gix*, quinn-proto and rustls reach their patched versions.lib/src/contexts/variable_include/dns.rs. Regression caught in review and fixed: 0.26ResolverConfig::default()has 0 name servers (0.25 defaulted to Google), so everydns+txt://lookup failed with "no connections available". NowResolverConfig::udp_and_tcp(&GOOGLE), matching 0.25 exactly; TXT answers filtered from the 0.26 genericLookup.deny.toml: removed the now-stale RUSTSEC-2026-0118/0119 ignores (verified: on main they fire without the ignores).Test Plan
make test: nextest 1145 passed, pytest 77 passed;cargo deny checkok;cargo audit10 -> 8 findings (rsa RUSTSEC-2023-0071 pre-existing).=, CNAME before TXT,k=v=w, two TXT records); host-missing URL is an error. Every one proven against a mutant.txt_record_values: google.com 17 answers (main gives the same keys); NXDOMAIN stillErr.Spec alignment
Part of ai-config spec 2026-10-20-fleet-dependabot-remediation (R1, R2).
🤖 Generated with Claude Code
https://claude.ai/code/session_019xLzrkRPPytfYRYLUBwAwJ