fix(deps): patch hickory-proto to 0.26.1

[tobyhede]

What

Bumps hickory-proto to 0.26.1, fixing GHSA-q2qq-hmj6-3wpp (O(n²) name compression in BinEncoder, CPU-exhaustion DoS via crafted messages — mirrors CVE-2024-8508). Closes CIP-3808.

Cargo.lock only — no Cargo.toml changes.

Why this wasn't a mechanical bump

hickory-proto is transitive: tests/sqlx → cipherstash-client = "=0.42.0" → reqwest ^0.13 → hickory-resolver ^0.25 → hickory-proto ^0.25.

A direct cargo update hickory-proto --precise 0.26.1 fails, because it only tries to move that one package while hickory-resolver 0.25.2 (locked) still requires hickory-proto ^0.25:

error: failed to select a version for the requirement `hickory-proto = "^0.25"`
candidate versions found which didn't match: 0.26.1
required by package `hickory-resolver v0.25.2`
    ... which satisfies dependency `hickory-resolver = "^0.25"` (locked to 0.25.2) of package `reqwest v0.13.3`
    ... which satisfies dependency `reqwest = "^0.13"` (locked to 0.13.3) of package `cipherstash-client v0.42.0`
    ... which satisfies dependency `cipherstash-client = "=0.42.0"` (locked to 0.42.0) of package `eql_tests v0.1.0`

I initially suspected the =0.42.0 exact pin on cipherstash-client (in tests/sqlx/Cargo.toml, deliberately pinned so its SteVec envelope format can't drift independently of the fixtures/bindings this repo tests against) was the real blocker, and that relaxing it to 0.42.2 would be required to move hickory-proto. That turned out not to be necessary:

• cipherstash-client's own reqwest requirement is ^0.13 in both 0.42.0 and 0.42.2 — unchanged, so relaxing the pin wouldn't have changed dependency resolution at all here.
• The real cause was simpler: reqwest 0.13.3 (the version locked in Cargo.lock) depends on hickory-resolver ^0.25, but reqwest 0.13.4 — already within cipherstash-client's allowed ^0.13 range, just never pulled in because nobody re-ran cargo update after it was published — depends on hickory-resolver ^0.26, which in turn requires hickory-proto ^0.26.

So the fix is cargo update -p reqwest --precise 0.13.4, which cascades correctly through the whole reqwest → hickory-resolver → hickory-proto chain in one coherent step:

Updating hickory-proto v0.25.2 -> v0.26.1
Updating hickory-resolver v0.25.2 -> v0.26.1
Updating reqwest v0.13.3 -> v0.13.4

cipherstash-client stays exactly pinned at 0.42.0 — untouched — so the SteVec envelope / fixture-compatibility concern behind that pin's comment doesn't apply here at all.

Verification

• cargo tree -i hickory-proto confirms a single resolved version, hickory-proto v0.26.1, matching the advisory's patched version.
• cargo check -p eql_tests --all-targets: all real dependency and workspace code compiles cleanly (hickory-proto, hickory-resolver, reqwest 0.13.4, stack-auth, cipherstash-client 0.42.0, eql_tests all pass). The only errors are 5 pre-existing "file not found" errors for one locally-missing, gitignored, generated fixture (v3_text_empty_bloom.sql, regenerated via mise run fixture:generate:all which needs ZeroKMS creds not present in this environment) — confirmed unrelated to this change by reproducing the same class of failure (worse — 21 errors across several missing fixtures) against a completely clean, unmodified main checkout with no dependency changes at all.
• The credential-free, DB-free catalog proptest suite (cargo test -p eql-domains --lib proptest_invariants), which exercises eql-domains catalog invariants, passes cleanly: 6/6 tests.
• Since cipherstash-client was never touched, the fixture-oracle / SteVec-payload-compatibility tests this PR would otherwise need to worry about (per the pin's comment in tests/sqlx/Cargo.toml) are not implicated — there is no cipherstash-client version change for them to catch.

Out of scope

CIP-3792 (a different hickory-proto advisory, GHSA-3v94-mw7p-v465, with no released fix at time of writing) is not addressed here.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 97eb7a96-b746-4b9e-88cb-202bf7aa9504

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}