security(deps): upgrade oauth2 to 5.0 and reqwest to 0.12 - #30
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
thinkutils | 11e1a0e | Jul 20 2026, 02:52 AM |
Clears all three rustls-webpki advisories -- RUSTSEC-2026-0099, -0098 and -0104, the last being a reachable panic in CRL parsing. Verified: cargo audit passes with only the rmcp exemption, and that one is cleared separately by the rmcp 2 upgrade. The two had to move together. oauth2 4.4 pins reqwest 0.11, which pins rustls 0.21, which pins the vulnerable rustls-webpki. Upgrading either alone changes nothing. API changes in oauth2 5.0: The four-argument BasicClient::new is replaced by a builder, and which endpoints are configured is now encoded in the type -- hence the EndpointSet/EndpointNotSet parameters on create_oauth_client's return type. request_async no longer takes the crate's own async_http_client; the caller supplies a reqwest client. That is a security-relevant change rather than a mechanical one: 4.x disabled redirects internally, and 5.x hands the decision over. oauth_http_client() sets redirect::Policy::none() explicitly, because following redirects on a token endpoint opens the client to SSRF -- the oauth2 docs call this out, and silently inheriting reqwest's default of following up to 10 would have been a real regression. Both exemptions removed from ci.yml rather than left in place. Only the unmaintained gtk-rs GTK3 warnings remain, and those come from Tauri's own dependency tree. Not exercised at runtime: Google sync needs credentials this build does not have, since the OAuth client was deleted. Build, clippy and the full suite pass; the flow gets its first real run when sync is restored with a new PKCE client.
vietanhdev
force-pushed
the
deps/oauth2-reqwest-upgrade
branch
from
July 19, 2026 16:19
54e6490 to
59a6d24
Compare
The guard grepped ci.yml for '--ignore RUSTSEC' to catch undocumented advisory exemptions, but its own command line contains that literal, so it matched itself and failed unconditionally. It was also redundant. A bare 'cargo audit' with zero exemptions already IS the property the guard was checking, and adding an --ignore is a visible diff to this file. Folded the reasoning into a comment above the step and removed the stale block that still claimed two clusters were ignored -- they were cleared by rmcp 2 and oauth2 5 / reqwest 0.12. Verified: cargo audit exits 0 with no exemptions (17 unmaintained/unsound gtk-rs warnings remain, which it does not fail on).
husky v9 prints a deprecation warning on every commit for the shebang and the husky.sh source line, and says outright they WILL FAIL in v10. The runner supplies both now, so the hook only needs its own body. Also replaced the $? check with 'if ! npx lint-staged', which is the same test without depending on $? surviving the intervening lines.
oauth2 4.x disabled redirects inside its own async_http_client; 5.x hands that decision to the caller, so the SSRF guard now lives in our code and nothing enforces it. Swapping oauth_http_client() back to reqwest::Client::new() compiles cleanly and silently reopens the hole. Asserts the behaviour instead of the construction: a local server returns 302, and the test requires it to arrive as a 302 with the redirect target never requested. Verified by mutation -- removing .redirect(Policy::none()) fails the test with 200 != 302.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all three
rustls-webpkiadvisories — RUSTSEC-2026-0099, -0098 and -0104, the last being a reachable panic in CRL parsing.Verified:
cargo auditpasses with only the rmcp exemption, and that one is cleared separately by #29.Why both at once
oauth24.4 pinsreqwest0.11 →rustls0.21 → the vulnerablerustls-webpki. Upgrading either alone changes nothing.One API change worth calling out
request_asyncno longer takes the crate's ownasync_http_client; the caller supplies areqwestclient. That's security-relevant, not mechanical: 4.x disabled redirects internally, and 5.x hands the decision over.oauth_http_client()setsredirect::Policy::none()explicitly. Following redirects on a token endpoint opens the client to SSRF — the oauth2 docs call this out — and silently inheriting reqwest's default of following up to 10 would have been a real regression introduced by an otherwise routine upgrade.The other change is mechanical: the four-argument
BasicClient::newbecame a builder, and which endpoints are configured is now encoded in the type.Exemptions removed
Both taken out of
ci.ymlrather than left in place. Only the unmaintained gtk-rs GTK3 warnings remain, and those come from Tauri's own tree.Not exercised at runtime
Google sync needs credentials this build doesn't have, since the OAuth client was deleted. Build, clippy and the full suite pass; the flow gets its first real run when sync is restored with a new PKCE client.