5ee02de5df
* fix: Migrate to astral-tokio-tar to address CVE-2025-62518 Migrates from the abandoned tokio-tar library to the actively maintained astral-tokio-tar to address CVE-2025-62518 (TARmageddon), a high-severity RCE vulnerability (CVSS 8.1). The vulnerability involves a boundary-parsing bug in PAX/ustar header handling that enables file smuggling attacks via malicious TAR archives. This is a drop-in replacement requiring only dependency updates in Cargo.toml files. The astral-tokio-tar library uses the same tokio_tar module name, so no source code changes are needed. All references to the vulnerable tokio-tar v0.3.1 have been removed from Cargo.lock and replaced with the patched astral-tokio-tar v0.5.6. Related to previous PR #6943 which was closed due to CLA issues. Security disclosure available at https://edera.dev/stories/tarmageddon and patch details at https://github.com/astral-sh/tokio-tar/releases/tag/v0.5.6 * update --------- Co-authored-by: Devdatta Talele <devtalele0@gmail.com> Co-authored-by: Devdatta Talele <50290838+devdattatalele@users.noreply.github.com>
36 lines
756 B
TOML
36 lines
756 B
TOML
[package]
|
|
name = "windmill-indexer"
|
|
version.workspace = true
|
|
authors.workspace = true
|
|
edition.workspace = true
|
|
|
|
[lib]
|
|
name = "windmill_indexer"
|
|
path = "src/lib.rs"
|
|
|
|
[features]
|
|
default = []
|
|
parquet = ["dep:object_store"]
|
|
private = []
|
|
enterprise = []
|
|
|
|
[dependencies]
|
|
windmill-common.workspace = true
|
|
tantivy.workspace = true
|
|
tokio.workspace = true
|
|
sqlx.workspace = true
|
|
anyhow.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tracing.workspace = true
|
|
chrono.workspace = true
|
|
uuid.workspace = true
|
|
futures.workspace = true
|
|
tempfile.workspace = true
|
|
bytes.workspace = true
|
|
object_store = { workspace = true, optional = true}
|
|
astral-tokio-tar.workspace = true
|
|
lazy_static.workspace = true
|
|
const_format.workspace = true
|
|
flume.workspace = true
|