Repository navigation
fix(rust-roxmltree): upgrade to 0.21.2 to address CVEs - #19982
Kanishk Bansal (Kanishk-Bansal) wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the rust-roxmltree 0.21.2 update.
No open issues 🎉
What changed in this PR
Upgrades Azure Linux’s rust-roxmltree package from 0.21.1 to 0.21.2 to address the reported CVE-2026-92987.
Changes:
- Moves the component into a dedicated configuration pinned to a Fedora f43 commit.
- Refreshes the lock file and rendered spec for 0.21.2.
- Updates the crate source filename and SHA512 checksum.
| File | Description |
|---|---|
specs/r/rust-roxmltree/sources |
Updates the crate source and checksum to 0.21.2. |
specs/r/rust-roxmltree/rust-roxmltree.spec |
Updates the version and generated changelog. |
locks/rust-roxmltree.lock |
Records the new upstream commit and input hashes. |
base/comps/rust-roxmltree/rust-roxmltree.comp.toml |
Adds the dedicated Fedora f43 commit pin and rationale. |
base/comps/components.toml |
Removes the inline entry replaced by the dedicated configuration. |
Review effort: Balanced
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Kanishk Bansal (Kanishk-Bansal)
added
security
CVE-fixed-by-upgrade
Bump the Fedora f43 dist-git pin to rust-roxmltree-0.21.2: https://src.fedoraproject.org/rpms/rust-roxmltree/c/1063aa98bde67366d0b3d57f673dda5f54a634ff Addresses 1 CVE(s): CVE-2026-92987 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
dece391 to
580130a
Compare
Lynsey Rydberg (corvus-callidus)
left a comment
Lynsey Rydberg (corvus-callidus)
left a comment
There was a problem hiding this comment.
It appears that the version bump is not a complete fix for the CVE. See RazrFalcon/roxmltree#157
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
| %changelog | ||
| ## START: Generated by rpmautospec | ||
| * Thu Nov 05 2026 Kanishk Bansal <kanbansal@microsoft.com> - 0.21.2-2 | ||
| - fix(rust-roxmltree): upgrade to 0.21.2 to address CVEs |
There was a problem hiding this comment.
Do we need to put the changelog entries from our side, as we are not putting for many others and are taking directly from Fedora changelog.
There was a problem hiding this comment.
azldev will generate changelog entries when it can. There are certain components for which it is not doing that successfully, but the goal is that all generated specs have the upstream changelog, then the generated AZL changelog entries appended.
| [components.'rust-roff0.2'] | ||
| [components.rust-ron] | ||
| [components.'rust-ron0.7'] | ||
| [components.rust-roxmltree] |
There was a problem hiding this comment.
Not sure here, what is the reason for this removal? Is it duplicate or somewhere else it will be populated? Like the above addition of base component file will populate it.
Summary
Upgrade
rust-roxmltreefrom 0.21.1 → 0.21.2 by bumping the Fedora f43 dist-git pin to1063aa98bde6.CVEs addressed (1)
CVEs not addressed by this upgrade (0)
None — all open Astrolabe CVEs for this package are addressed.
Changes
base/comps/rust-roxmltree/rust-roxmltree.comp.toml: pinupstream-commit = 1063aa98bde6…(Fedora f43)locks/rust-roxmltree.lock: refreshed viaazldev comp update -p rust-roxmltreespecs/r/rust-roxmltree/: re-rendered (Version 0.21.1 → 0.21.2, Release %autorelease → %autorelease)Testing
azldev comp build -p rust-roxmltree(x86_64): success (4 RPMs)ldd: nonot found)azldev comp render/comp updateidempotent on the committed state; commit message passes commitizen