Conversation
…ve dep Cargo.lock carried rkyv 0.7.46 (via byte-unit -> rust_decimal -> rkyv), flagged by RUSTSEC-2026-0235: insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc. rust_decimal 1.42.1 pinned `rkyv = "^0.7.46"` exactly, so rkyv couldn't be bumped on its own. rust_decimal 1.43.0 moved to `rkyv ^0.8.13` (well past the 0.8.17 fix) and, in this workspace, doesn't pull rkyv in as a dependency at all anymore -- `cargo update -p rust_decimal --precise 1.43.0` removes rkyv, bytecheck, ptr_meta and their supporting crates from the lockfile entirely. `byte-unit`'s `^1` requirement on rust_decimal already allows 1.43.0, so this is a lockfile-only change. Verified locally: `cargo test --workspace --lib --bins` passes (55 tests), after also installing the `wasm32-unknown-unknown` target this workspace's build.rs needs for a canister crate (unrelated to this fix, just missing in my environment). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Author
|
Hi, checking in on this one. The fix removes a vulnerable rkyv 0.7 dependency (out of bounds read) by bumping rust_decimal instead of touching rkyv directly, since that pulled rkyv out of the graph entirely. I ran the full workspace test suite locally and 55 tests passed. It has been quiet for about a week, so wanted to see if you had a chance to look at it yet, or if there is anything I should change. Thanks in advance. |
lwshang
previously approved these changes
Sep 18, 2026
lwshang
enabled auto-merge (squash)
September 18, 2026 07:33
marc0olo
disabled auto-merge
September 18, 2026 07:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Cargo.lockcarriedrkyv 0.7.46(viabyte-unit→rust_decimal→rkyv), flagged by RUSTSEC-2026-0235: insufficient archive validation can cause out-of-boundsreads in archives containing
Rc/Arc.rust_decimal 1.42.1pinnedrkyv = "^0.7.46"exactly, sorkyvcouldn'tbe bumped on its own (
cargo update -p rkyvfails to resolve).rust_decimal 1.43.0moved torkyv ^0.8.13(well past the 0.8.17 fix) and, in thisworkspace, doesn't pull
rkyvin as a dependency at all anymore —cargo update -p rust_decimal --precise 1.43.0removesrkyv,bytecheck,ptr_meta, and their supporting crates from the lockfile entirely.byte-unit's^1requirement onrust_decimalalready allows1.43.0, sothis is a lockfile-only change.
Verified locally
cargo test --workspace --lib --bins→ 55 tests passed, 0 failed.(Also had to install the
wasm32-unknown-unknowntarget this workspace'sbuild.rsneeds for a canister crate — unrelated to this fix, just missingin my environment.)
🤖 Generated with Claude Code