From f6ae55127baedf60bec51c14e37640b232c5d16e Mon Sep 17 00:00:00 2001 From: Nic-dorman Date: Fri, 23 Oct 2026 19:14:14 +0100 Subject: [PATCH] fix(deps): bump tokio to 1.53.3 for RUSTSEC-2026-0386 RUSTSEC-2026-0386 (unsound): `AsyncFd::new` and related constructors violate I/O safety. Patched in tokio >=1.51.6,<1.52.0 and >=1.53.3; the locked 1.52.3 sits in the gap with no fix, so move to 1.53.3. Lockfile-only: only the tokio version and checksum change. `cargo update -p tokio --precise 1.53.3` with cargo 1.97 also rewrites unrelated windows-sys edges (0.61.2 -> 0.52.0), so the two lines were edited by hand to keep the diff minimal. tokio is a transitive dependency (via saorsa-core/saorsa-transport, reqwest/hyper, alloy); no Cargo.toml change. Closes V2-1737 (parent V2-1733). Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3e312d7..2101500 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5104,9 +5104,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.52.3" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "libc",