Repository navigation
Bump tokio to 1.53.3 for RUSTSEC-2026-0386 - #1581
Merged
Merged
Conversation
cargo-deny now rejects tokio 1.53.1: its safe AsyncFd constructors accept file descriptors without proof of ownership. 1.53.3 deprecates them in favour of unsafe constructors. Only tokio's lockfile entry changes. Co-authored-by: Oliver <e78152627ea32fbacb070e5047afcfb8e409fa3343d9e618227baacca5b5e607@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: John Tennant <jtennant@block.xyz>
johnmatthewtennant
marked this pull request as ready for review
October 23, 2026 15:08
loganj
approved these changes
Oct 23, 2026
johnmatthewtennant
added a commit
that referenced
this pull request
Oct 23, 2026
…e-skip-archived-channels * origin/main: Bump tokio to 1.53.3 for RUSTSEC-2026-0386 (#1581) Unify attachment cards with neutral icon tiles (#1548) Polish edit context, channel join and profile actions (#1545) fix(claude-code): keep context across channel threads (#1516) fix(builderlab): let Create agent cancel a pending browser sign-in (#1526) test(sidebar-filters): start the focus journey on General (#1555) Add opt-in native MCP for macOS tests (#1528) Show unreads for channels after access changes (#1550) Deliver artifact changes through shared live routes (#1480) condense photo and video attachments into a compact grid (#1549) Signed-off-by: John Tennant <jtennant@block.xyz>
delkc
pushed a commit
that referenced
this pull request
Oct 23, 2026
Signed-off-by: John Tennant <jtennant@block.xyz> Co-authored-by: Oliver <e78152627ea32fbacb070e5047afcfb8e409fa3343d9e618227baacca5b5e607@buzz.block.builderlab.xyz> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 6fc1d18) Signed-off-by: Clay Delk <clay.delk@gmail.com> Co-authored-by: Goose <goose@aaif.io>
morgmart
added a commit
that referenced
this pull request
Oct 23, 2026
Signed-off-by: morgmart <98432065+morgmart@users.noreply.github.com> Co-authored-by: Carl <c217fe6b9d958f41c3a5e030dccc7f626775a923089cb6491305eade75ea1f1b@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * origin/main: (24 commits) Unify chat and channel access, tidy the Solo chat menu (#1446) fix(todos): render nested TODOs with collapsible hierarchy and Markdown (#1483) fix(agents): Allow agents to propose updates to agents (#1478) fix(composer): prevent plugins from updating the recipient on a WIP draft message (#1497) fix(agents): can't delete an agent belonging to an archived channel (#1560) Bump tokio to 1.53.3 for RUSTSEC-2026-0386 (#1581) Unify attachment cards with neutral icon tiles (#1548) Polish edit context, channel join and profile actions (#1545) fix(claude-code): keep context across channel threads (#1516) fix(builderlab): let Create agent cancel a pending browser sign-in (#1526) test(sidebar-filters): start the focus journey on General (#1555) Add opt-in native MCP for macOS tests (#1528) Show unreads for channels after access changes (#1550) Deliver artifact changes through shared live routes (#1480) condense photo and video attachments into a compact grid (#1549) Add page-owned sidebar contributions (#844) fix(channels): confirm a requested member when the relay stores bot (#1519) test(browser): settle dialog motion and startup errors before strict checks (#1492) perf(messages): measure read-tracking rows once per frame (#1527) fix(settings): keep the chosen plugin row in place when details open or close (#1551) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
cargo-denyadvisory check in "Rust and tool integration" now fails on every PR. RUSTSEC-2026-0386, published today, marks tokio 1.53.1 unsound:AsyncFd's safe constructors accept anyAsRawFdwithout proof of ownership, violating I/O safety.Solution
Bump tokio to 1.53.3, the patched release in the same minor line (it deprecates those constructors in favour of
unsafeones). Only tokio's version and checksum change inCargo.lock;cargo update -p tokioon the workstation also re-resolved unrelatedwindows-sysandsynedges, so I kept the change to tokio alone.Testing
./bin/cargo-deny --locked check: advisories, bans, licenses and sources all ok (failed on main before the bump).cargo metadata --lockedaccepts the lockfile, andcargo check --locked -p tokiobuilds 1.53.3. A full workspace check couldn't run on the Linux workstation because it lacks GTK system libraries; CI covers the Rust build and tests.🤖 Generated with Claude Code