From ec19129a675cb83355e7e57c637d99be9dca2a82 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Tue, 18 Aug 2026 14:22:24 +1000 Subject: [PATCH 1/3] fix(deps): bump cipherstash-client, cts-common, stack-auth, and stack-profile to 0.42.2 stack-auth 0.42.2 moves jsonwebtoken from 9.3.1 to 10.4.0. The other three crates release in lockstep with stack-auth from the same monorepo, so their exact pins move together to stay in sync. Signed-off-by: Toby Hede --- packages/protect-ffi/Cargo.lock | 46 ++++++++++++------- .../protect-ffi/crates/protect-ffi/Cargo.toml | 8 ++-- 2 files changed, 33 insertions(+), 21 deletions(-) diff --git a/packages/protect-ffi/Cargo.lock b/packages/protect-ffi/Cargo.lock index 0f3132109..369191800 100644 --- a/packages/protect-ffi/Cargo.lock +++ b/packages/protect-ffi/Cargo.lock @@ -516,9 +516,9 @@ dependencies = [ [[package]] name = "cipherstash-client" -version = "0.42.0" +version = "0.42.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c8714a2997ab5a8cc2c871f01dcae9ff7c6b342ed51c5c0d7c8edd4d954c9d1" +checksum = "59857c1279c8799ce67edde5f300b5decae5d0075b4c8f53d864a0a7ec8a5d01" dependencies = [ "aes-gcm-siv", "anyhow", @@ -577,9 +577,9 @@ dependencies = [ [[package]] name = "cipherstash-config" -version = "0.42.0" +version = "0.42.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "56cde3aaa5e2916a40530932f142c37ad6202835a6d221ce6c46fc14bfec8fc5" +checksum = "b94efb31c4b6cc951f2ed2c2a953393ba34136c37c5ddd022a8da732f174e532" dependencies = [ "bitflags", "serde", @@ -589,9 +589,9 @@ dependencies = [ [[package]] name = "cipherstash-core" -version = "0.42.0" +version = "0.42.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1946988e0b7f9de259d85b10c9c1fd7e1327751103b808c2c6e930b9a87c25c9" +checksum = "bef863de8a96e98320a2cd49b36f8235cfcc5f2fc40fdb2c05e31dddf598512f" dependencies = [ "getrandom 0.2.17", "hmac", @@ -818,9 +818,9 @@ dependencies = [ [[package]] name = "cts-common" -version = "0.42.0" +version = "0.42.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe2acdda527057d48061433ace5378d8452f10d6787f78e0e69b1cddacc57082" +checksum = "576c82618990e693abe4dfbd06dada0bcb45884a4514405851eec6d82818f52c" dependencies = [ "arrayvec", "base32", @@ -1906,17 +1906,20 @@ dependencies = [ [[package]] name = "jsonwebtoken" -version = "9.3.1" +version = "10.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde" +checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc" dependencies = [ + "aws-lc-rs", "base64", + "getrandom 0.2.17", "js-sys", "pem", - "ring", "serde", "serde_json", + "signature", "simple_asn1", + "zeroize", ] [[package]] @@ -3296,6 +3299,15 @@ dependencies = [ "libc", ] +[[package]] +name = "signature" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" +dependencies = [ + "rand_core 0.6.4", +] + [[package]] name = "simd-adler32" version = "0.3.8" @@ -3370,9 +3382,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" [[package]] name = "stack-auth" -version = "0.42.0" +version = "0.42.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6d1c9c640571eba8fa5a705ccebe5c5e50aa27d4d51f4ec1614ffd1841b8a13a" +checksum = "f1a9ac43060af7605899754daa3de2e26302c2ab4d9249a8bc16157bc53dad65" dependencies = [ "aquamarine", "base64", @@ -3398,9 +3410,9 @@ dependencies = [ [[package]] name = "stack-profile" -version = "0.42.0" +version = "0.42.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "192a90bfa46efe194c2b8beae5523f6214714574c7e8a210c78021259f100e79" +checksum = "90ce7ca95d8e688a35e86e0682293a2085d9b1f26e7ca5b489009c6ee0c6967a" dependencies = [ "dirs", "gethostname", @@ -4972,9 +4984,9 @@ dependencies = [ [[package]] name = "zerokms-protocol" -version = "0.12.26" +version = "0.12.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16f731f2de99e66396928faef44b02b39288dc9a93f77a4a3e1dcdc33c1adad0" +checksum = "29486723fdd2bdb0c234174dc242051a46ac0c82935ccaa39e9781dbf7bcc6d2" dependencies = [ "base64", "cipherstash-config", diff --git a/packages/protect-ffi/crates/protect-ffi/Cargo.toml b/packages/protect-ffi/crates/protect-ffi/Cargo.toml index dc66143b6..681a0dd8a 100644 --- a/packages/protect-ffi/crates/protect-ffi/Cargo.toml +++ b/packages/protect-ffi/crates/protect-ffi/Cargo.toml @@ -20,10 +20,10 @@ crate-type = ["cdylib", "rlib"] [dependencies] base85 = "2.0.0" chrono = { version = "0.4.42", default-features = false, features = ["serde"] } -cipherstash-client = { version = "=0.42.0", features = ["tokio"] } -cts-common = { version = "=0.42.0", default-features = false } +cipherstash-client = { version = "=0.42.2", features = ["tokio"] } +cts-common = { version = "=0.42.2", default-features = false } eql-bindings = { version = "=3.0.2" } -stack-auth = { version = "=0.42.0" } +stack-auth = { version = "=0.42.2" } hex = "0.4.3" # Carries the error code across the FFI boundary (#146). `derive` is the only # feature wanted: `fancy` pulls in the terminal-size / colour-support crates the @@ -42,7 +42,7 @@ zeroize = { version = "1.8", features = ["derive"] } [target.'cfg(not(target_arch = "wasm32"))'.dependencies] neon = { version = "1", features = ["serde", "tokio"] } -stack-profile = { version = "=0.42.0" } +stack-profile = { version = "=0.42.2" } tokio = { version = "1", features = ["full"] } [target.'cfg(target_arch = "wasm32")'.dependencies] From 7dac14189d6ae23b02450867fb6088537c0999e3 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Tue, 18 Aug 2026 16:07:35 +1000 Subject: [PATCH 2/3] chore: add changeset for protect-ffi jsonwebtoken bump Patch-level changeset for @cipherstash/protect-ffi so the jsonwebtoken 9.3.1 -> 10.4.0 fix actually publishes through the fixed platform-package group instead of landing on main with nothing to release. Signed-off-by: Toby Hede --- .changeset/protect-ffi-jsonwebtoken-cve.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/protect-ffi-jsonwebtoken-cve.md diff --git a/.changeset/protect-ffi-jsonwebtoken-cve.md b/.changeset/protect-ffi-jsonwebtoken-cve.md new file mode 100644 index 000000000..8693f8e97 --- /dev/null +++ b/.changeset/protect-ffi-jsonwebtoken-cve.md @@ -0,0 +1,5 @@ +--- +'@cipherstash/protect-ffi': patch +--- + +Bump `cipherstash-client`, `cts-common`, `stack-auth`, and `stack-profile` to 0.42.2, which moves the transitive `jsonwebtoken` dependency from 9.3.1 to 10.4.0, resolving [CVE-2026-25537](https://github.com/advisories/GHSA-h395-gr6q-cpjc) (a JWT claim-validation type-confusion bug that could allow bypassing `nbf`/`exp` checks). No API changes. From 415ab2d43bddd7eb78517676788408041d6d1c73 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Tue, 18 Aug 2026 16:10:57 +1000 Subject: [PATCH 3/3] fix: defer protect-ffi changeset until the publishing cutover lint:ffi-changeset flagged this: npm trusted publishing for the seven protect-ffi packages is still pointed at cipherstash/protectjs-ffi during the absorption, not this repo. An active changeset here would bump all seven through the fixed group and misattribute the next stack release. Deferred per the check's own instructions -- the phase-4 cutover PR renames it back. Signed-off-by: Toby Hede --- ...onwebtoken-cve.md => protect-ffi-jsonwebtoken-cve.md.deferred} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .changeset/{protect-ffi-jsonwebtoken-cve.md => protect-ffi-jsonwebtoken-cve.md.deferred} (100%) diff --git a/.changeset/protect-ffi-jsonwebtoken-cve.md b/.changeset/protect-ffi-jsonwebtoken-cve.md.deferred similarity index 100% rename from .changeset/protect-ffi-jsonwebtoken-cve.md rename to .changeset/protect-ffi-jsonwebtoken-cve.md.deferred