From 10c7628f55dc4ffb7bda3e85b6a08b7529b3d89e Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sun, 6 Sep 2026 09:15:08 +0000 Subject: [PATCH] chore(deps): upgrade tabled to 0.22 and retire RUSTSEC-2026-0173 `tabled_derive` 0.12, pulled in by `tabled` 0.22, drops its dependency on the unmaintained `proc-macro-error2`. That was the recorded removal condition for the RUSTSEC-2026-0173 suppression, so the bench harness moves to 0.22 and the suppression goes away instead of rotting in place. `proc-macro-error2` and `proc-macro-error-attr2` are gone from Cargo.lock; the advisory ignore is dropped from deny.toml and from the suppressed advisories table in the threat model. Also bumps the cargo-vet exemptions for `tabled`/`tabled_derive` to the new versions -- `cargo vet --locked` fails without it. RUSTSEC-2023-0071 (`rsa`) and RUSTSEC-2023-0089 (`atomic-polyfill`) stay suppressed: neither removal condition is met. `heapless` is still pinned at 0.7, which requires `atomic-polyfill`, and no patched `rsa` exists. --- Cargo.lock | 31 ++++-------------------------- crates/bashkit-bench/Cargo.toml | 2 +- deny.toml | 4 ---- knowledge/security/threat-model.md | 10 ++++++++-- supply-chain/config.toml | 4 ++-- 5 files changed, 15 insertions(+), 36 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 2b48e17a9..16f14e6f2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3818,28 +3818,6 @@ dependencies = [ "wnaf", ] -[[package]] -name = "proc-macro-error-attr2" -version = "2.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5" -dependencies = [ - "proc-macro2", - "quote", -] - -[[package]] -name = "proc-macro-error2" -version = "2.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802" -dependencies = [ - "proc-macro-error-attr2", - "proc-macro2", - "quote", - "syn 2.0.119", -] - [[package]] name = "proc-macro-utils" version = "0.10.0" @@ -5235,9 +5213,9 @@ dependencies = [ [[package]] name = "tabled" -version = "0.21.0" +version = "0.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5dc662e6da844ad6e428ad16b57967c9d33c82e16bb1c258326c0c078605dff" +checksum = "2d2596a104db1900b943f97d793a6c99addca918c4525c999f751a0f17d472eb" dependencies = [ "papergrid", "tabled_derive", @@ -5246,12 +5224,11 @@ dependencies = [ [[package]] name = "tabled_derive" -version = "0.11.0" +version = "0.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ea5d1b13ca6cff1f9231ffd62f15eefd72543dab5e468735f1a456728a02846" +checksum = "7dca1937322a1e892b1a65f6a6736183bb0a29d3b4234d1d53bc436dff9beb76" dependencies = [ "heck", - "proc-macro-error2", "proc-macro2", "quote", "syn 2.0.119", diff --git a/crates/bashkit-bench/Cargo.toml b/crates/bashkit-bench/Cargo.toml index 2f1758754..c9cf3fdd2 100644 --- a/crates/bashkit-bench/Cargo.toml +++ b/crates/bashkit-bench/Cargo.toml @@ -25,4 +25,4 @@ tempfile.workspace = true # Terminal output colored = "3" -tabled = "0.21" +tabled = "0.22" diff --git a/deny.toml b/deny.toml index 3d3358341..554a6b5ce 100644 --- a/deny.toml +++ b/deny.toml @@ -50,10 +50,6 @@ ignore = [ # atomic-polyfill: transitive via monty -> postcard -> heapless # Unmaintained but no security vulnerability; upstream dep we can't control "RUSTSEC-2023-0089", - # proc-macro-error2: transitive via bashkit-bench -> tabled -> tabled_derive - # Unmaintained build-time proc-macro in the bench harness only (not shipped - # library code); no upgrade available (tabled 0.21 is latest) - "RUSTSEC-2026-0173", ] [bans] diff --git a/knowledge/security/threat-model.md b/knowledge/security/threat-model.md index 8b7b57835..fdd286f7d 100644 --- a/knowledge/security/threat-model.md +++ b/knowledge/security/threat-model.md @@ -1574,8 +1574,7 @@ the two lists in sync so a local `cargo deny check advisories` matches CI. | Advisory | Crate | Why suppressed | Remove when | |----------|-------|----------------|-------------| | RUSTSEC-2023-0071 | `rsa` | Marvin timing sidechannel (TM-CRY-002). No patched version exists; reachable only via the opt-in `ssh` feature | `rsa` ships a constant-time release | -| RUSTSEC-2023-0089 | `atomic-polyfill` | Unmaintained, no known vulnerability; transitive via `monty` → `postcard` → `heapless` | Upstream drops the dependency | -| RUSTSEC-2026-0173 | `proc-macro-error2` | Unmaintained build-time proc-macro, bench harness only (not shipped library code); transitive via `tabled` | `tabled` releases a version without it | +| RUSTSEC-2023-0089 | `atomic-polyfill` | Unmaintained, no known vulnerability; transitive via `monty` → `postcard` → `heapless` (pinned at 0.7, which still requires it) | Upstream drops the dependency | A suppression that stops matching is not evidence that it can be dropped. `cargo deny check advisories` currently warns `advisory-not-detected` for @@ -1586,6 +1585,13 @@ matching resumes as soon as `rsa` ships a stable release. Before removing any entry above, check the advisory's own `patched` list rather than the scanner's silence. +Retired: RUSTSEC-2026-0173 (`proc-macro-error2`, unmaintained). Its recorded +removal condition — "`tabled` releases a version without it" — was met by +`tabled` 0.22 / `tabled_derive` 0.12, which drops the dependency. The bench +harness was moved to 0.22 and the crate is gone from `Cargo.lock`, so the +suppression was deleted rather than left to rot. This is the shape a removal +should take: the dependency is actually gone, not merely unmatched. + ### Fuzzing Targets The following components are fuzz-tested for robustness: diff --git a/supply-chain/config.toml b/supply-chain/config.toml index f0ef72fd7..6533433b2 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -1937,11 +1937,11 @@ version = "1.0.2" criteria = "safe-to-deploy" [[exemptions.tabled]] -version = "0.21.0" +version = "0.22.0" criteria = "safe-to-deploy" [[exemptions.tabled_derive]] -version = "0.11.0" +version = "0.12.0" criteria = "safe-to-deploy" [[exemptions.tap]]