Repository navigation
chore(security): v3 — track upstream-blocked rand 0.8.6 transitive dependency #144
Description
Summary
Tracks transitive Rust dependency vulnerabilities in v3 that cannot be resolved at the project level without upstream releases.
Status (2026-05-14): The rustls-webpki / AWS SDK portion of this issue has been resolved upstream. The rand 0.8.6 portion remains tracked here.
rustls-webpki 0.101.7 (Dependabot alerts #19, #20) — ✅ RESOLVED
CVEs: webpki name constraint issues (fixed in 0.103.12+)
Original root cause: AWS SDK shipped rustls 0.21 support via hyper-rustls 0.24.2 for hyper 0.14 backward compat, which pulled rustls-webpki 0.101.7.
Resolution: The AWS SDK has since dropped the rustls 0.21 compat path.
Current v3/Cargo.lock carries:
-
hyper-rustls 0.27.9(was 0.24.2) -
rustls-webpki 0.103.13only (the 0.101.7 instance is no longer present) -
Re-check once AWS SDK releases a version that drops
hyper 0.14/rustls 0.21compat — done; resolved in v3 dependency tree
rand 0.8.6 (transitive only — no separate Dependabot alert) — ⏳ STILL BLOCKED
CVE: Unsoundness with custom logger using rand::rng() (affects 0.9.x / 0.10.x series; 0.8.x is a separate semver series)
Root cause: Several upstream crates still depend on rand 0.8:
| Crate | Version | Status |
|---|---|---|
age |
0.11.3 | No 0.12 release yet upgrading to rand 0.9+ |
tera |
1.20.1 | Latest 1.x still uses rand 0.8 |
phf_generator |
0.11.3 | Latest 0.11 still uses rand 0.8 |
The rand 0.9.x and 0.10.x instances have been updated to 0.9.4 and 0.10.1 respectively (resolving alerts #16 and #17). The 0.8.6 presence is collateral from these upstream crates.
Workaround: None. Monitor upstream for new major versions of age, tera, and/or phf.
Action needed
- Re-check once
age,tera, and/orphfrelease versions usingrand 0.9+
Activity
fix(security): address open Dependabot and code-scan alerts
[-]chore(security): track upstream-blocked transitive dependency vulnerabilities[/-][+]chore(security): v3 — track upstream-blocked transitive dependency vulnerabilities[/+]pacphi commentedon Apr 30, 2026
Re-homing this issue to scope: it covers v3 only (Rustls-webpki 0.101.7 + rand 0.8.6 in
v3/Cargo.lock).The
rand 0.8.6portion also affects v4 via the same upstream crates (age,tera,phf_generator). v4 already hasrustls-webpki 0.103.13only, so the rustls-webpki concern is v3-only.Sibling issue for v4: #281
[-]chore(security): v3 — track upstream-blocked transitive dependency vulnerabilities[/-][+]chore(security): v3 — track upstream-blocked rand 0.8.6 transitive dependency[/+]pacphi commentedon May 14, 2026
Parent epic: #317 — epic(v3): v3 maintenance & security tracking
pacphi commentedon May 30, 2026
rand 0.8.6 advisory — v3 status check (2026-05-30)
Still blocked. No PR opened.
Findings
age"0.8"❌age-coreteraphf_generatorfastrand 2.1✅What changed
age 0.11.3shipped April 22 (newer than the 0.11.2 baseline), but itsCargo.tomlstill containsrand = "0.8". The v3 workspaceCargo.lockconfirmsrand v0.8.6is pulled in viaage 0.11.3andage-core 0.11.0.phf_generator 0.13.1no longer usesrandat all (switched tofastrand), but it isn't present in the v3 dependency tree — so this doesn't affect v3.terahasn't moved; not a factor here either.Next watch point
ageis the sole remaining blocker for v3. Watch the str4d/rage repo for a release that bumpsrandto>= 0.9. The relevant tracking issue is str4d/rage#558 (rand 0.9 migration).Generated by Claude Code