Repository navigation
Scan Cargo.lock with OSV-Scanner; bump xxhash-rust to 0.8.16 - #451
Merged
Merged
Conversation
cargo-audit only reads the RustSec database, so advisories that crate maintainers publish as GitHub security advisories can go unnoticed: GHSA-6g2r-675j-hx59 in xxhash-rust 0.8.15 is not in RustSec. OSV covers both. Add an OSV-Scanner job to the security workflow, with the same triggers and the same report-parsing approach as the cargo-audit job. Bump xxhash-rust to 0.8.16, which fixes that advisory. dnp3 was not affected: the advisory is in the xxh3 custom-secret API, and dnp3 only enables the xxh64 feature.
This was referenced Oct 9, 2026
jadamcrain
added a commit
to stepfunc/rodbus
that referenced
this pull request
Oct 9, 2026
cargo-audit only reads the RustSec database, so advisories that crate maintainers publish as GitHub security advisories can go unnoticed. OSV covers both. Same job as dnp3's security workflow (stepfunc/dnp3#451).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The SBOMs from #450 are scanned by tools like Trivy and OSV-Scanner, which flagged GHSA-6g2r-675j-hx59 in
xxhash-rust0.8.15. The security workflow didn't, becausecargo auditonly reads the RustSec database and this advisory, published by the maintainer as a GitHub security advisory, isn't in RustSec.What
security-audit.yml: scansCargo.lockagainst OSV, which aggregates RustSec and GitHub advisories. Same triggers as thecargo auditjob (daily, push to main, PRs). Like that job, it takes the verdict from the JSON report, reports a run without a valid report as a tool failure rather than a finding, and uploads the report. The image is pinned by digest (ghcr.io/google/osv-scanner:v2.6.0).xxhash-rust0.8.15 → 0.8.16, which fixes the advisory. OnlyCargo.lockchanges; the license (BSL-1.0) is unchanged.dnp3 was not affected: the advisory concerns the xxh3 custom-secret API, and dnp3 enables only the
xxh64feature, so that code isn't compiled.Checked locally
main's lockfile reportsxxhash-rust 0.8.15: GHSA-6g2r-675j-hx59and the job fails; on this branch it passes.Note
.cargo/audit.tomlignores RUSTSEC-2025-0055 (tracing-subscriber), but the lockfile hastracing-subscriber0.3.23, which includes the fix, and OSV no longer reports it. That ignore entry looks stale; left unchanged here.