Repository navigation
chore(deps): bump libz-sys 1.1.28 -> 1.1.31 (RUSTSEC-2026-0418) - #243
Merged
Merged
Conversation
The libz-sys build script logs its zlib probe command, and with cc 1.6.0 or later that command carries the whole build environment, which cargo stores under target/. Our lockfile pins cc 1.2.62, so no build here leaked anything; this clears the advisory that now fails the scheduled cargo-deny scan.
clintcan
added a commit
that referenced
this pull request
Oct 29, 2026
Same lockfile bump as #243 on main, so the pin bump's cargo-deny scan stays green until the next rebase picks it up from main.
antonmos
added a commit
to antonmos/macrdp
that referenced
this pull request
Oct 30, 2026
…ps-switch-cf7eef * origin/main: (21 commits) chore(deps): bump libz-sys 1.1.28 -> 1.1.31 (RUSTSEC-2026-0418) (clintcan#243) test(auth_guard): serialize the audit-capturing tests with the ones that emit audit events (clintcan#239) docs(readme): explain controller setup and connecting after a reboot (clintcan#238) fix(stats): count shipped EGFX frames and clear them when the client leaves (clintcan#218) fix(clipboard): keep polling the pasteboard while a format list awaits its answer (clintcan#217) fix(input): close the app switcher when stale modifiers are cleared (clintcan#234) fix(auth_guard): don't count failures after authentication toward lockout (clintcan#233) fix(keyboard_layout): serialize TIS calls so concurrent callers can't abort the process (clintcan#227) chore(deps): bump zstd-safe to 8.2 in the vendored ironrdp-server (clintcan#224) fix(server): read input while a write blocks, and disable Nagle (clintcan#222) fix(capture): apply --max-client-size to the connect-time size too (clintcan#216) feat: read the password from a file with --password-file (clintcan#212) fix(input): drop the scroll backlog the 5-line cap leaves behind (clintcan#210) fix(input): post each modifier change once (clintcan#208) docs: fold hard-won dev lessons into CLAUDE.md and the topic docs (clintcan#202) fix(capture): mirror the main display on a multi-monitor Mac (clintcan#215) docs(readme): add the Homebrew cask install (clintcan#214) feat(input): add --alt-space-spotlight (clintcan#209) perf(capture): retain the flush frame's pixel buffer instead of copying it (clintcan#203) test(input): pure resync_plan + tests for the connection-edge reset (clintcan#192) ... # Conflicts: # README.md # docs/configuration.md # docs/features.md # packaging/config.env.example # src/input.rs # src/main.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scheduled security scan fails on RUSTSEC-2026-0418: the
libz-sysbuild script logs its zlib probe command, and withcc1.6.0 or later that command carries the whole build environment, which cargo stores undertarget/.This is a lockfile-only bump (
cargo update -p libz-sys).libz-syscomes in throughflate2(viaimage/pngand IronRDP'ssspi/winscard).Exposure: none. The lockfile pins
cc1.2.62, below the version that triggers the leak, so no CI cache needs clearing.Checked locally with cargo-deny 0.19.9 (the version CI uses): both
security.ymlscans (root tree andvendor/ironrdp-rdpeudp) pass,licensespasses, andcargo checkbuilds.