Skip to content

chore: Upgrade nix dependencies #8328

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cdecker
Copy link
Member

@cdecker cdecker commented Jun 7, 2025

  • flake: Address two small warnings about outdated versions

Changelog-None

@cdecker cdecker force-pushed the 202506-nix-upgrade branch from 115ca95 to 6960e6d Compare June 7, 2025 08:48
@cdecker cdecker changed the title 202506 nix upgrade chore: Upgrade nix dependencies Jun 7, 2025
@cdecker cdecker requested a review from nepet June 7, 2025 09:14
@cdecker
Copy link
Member Author

cdecker commented Jun 7, 2025

Paging our resident nix expert @nepet to help out address the nix flake check failure. It is complaining about a vulnerable ring version being used:

Crate:     ring
Version:   0.17.8
Title:     Some AES functions may panic when overflow checking is enabled.
Date:      2025-03-06
ID:        RUSTSEC-2025-0009
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0009
Solution:  Upgrade to >=0.17.12
Dependency tree:
ring 0.17.8
├── x509-parser 0.16.0
│   └── rcgen 0.13.2
│       ├── clnrest 0.2.0
│       └── cln-grpc-plugin 0.4.0
├── sct 0.7.1
│   └── rustls 0.21.12
│       ├── tokio-rustls 0.24.1
│       │   └── axum-server 0.6.0
│       │       └── clnrest 0.2.0
│       └── axum-server 0.6.0
├── rustls-webpki 0.102.8
│   └── rustls 0.22.4
│       └── tokio-rustls 0.25.0
│           └── tonic 0.11.0
│               ├── cln-grpc-plugin 0.4.0
│               └── cln-grpc 0.4.1
│                   ├── cln-plugin 0.4.0
│                   │   ├── clnrest 0.2.0
│                   │   ├── cln-lsps 0.1.0
│                   │   └── cln-grpc-plugin 0.4.0
│                   └── cln-grpc-plugin 0.4.0
├── rustls-webpki 0.101.7
│   └── rustls 0.21.12
├── rustls 0.22.4
├── rustls 0.21.12
└── rcgen 0.13.2

Do you know how to pin an older, non-vulnerable, version?

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant