nginx/unit

Can't update rustls for OTEL

Closed this issue · 1 comments

ac000 commented

For some reason we can't update the version of rustls to fix a vulnerability.

dependabot tried and failed.

Trying myself (with version 0.23.19) I get the following error

cargo build --release --manifest-path src/otel/Cargo.toml
    Updating crates.io index
error: failed to select a version for `rustls-pki-types`.
    ... required by package `rustls v0.23.19`
    ... which satisfies dependency `rustls = "^0.23.4"` (locked to 0.23.19) of package `reqwest v0.12.8`
    ... which satisfies dependency `reqwest = "^0.12.7"` (locked to 0.12.8) of package `otel v0.1.0 (/home/andrew/src/unit/src/otel)`
versions that meet the requirements `^1.10` are: 1.10.0

all possible versions conflict with previously selected packages.

  previously selected package `rustls-pki-types v1.9.0`
    ... which satisfies dependency `rustls-pki-types = "^1.1.0"` (locked to 1.9.0) of package `reqwest v0.12.8`
    ... which satisfies dependency `reqwest = "^0.12.7"` (locked to 0.12.8) of package `otel v0.1.0 (/home/andrew/src/unit/src/otel)`

failed to select a version for `rustls-pki-types` which could resolve this conflict
make: *** [build/Makefile:2168: src/otel/target/release/libotel.a] Error 101

@avahahn Any idea?

Cc: @callahad

ac000 commented

As @callahad suggested, bumping the version of rustls-pki-types fixes things

diff --git ./src/otel/Cargo.lock ./src/otel/Cargo.lock
index c1a0e439..464bf44a 100644
--- ./src/otel/Cargo.lock
+++ ./src/otel/Cargo.lock
@@ -1387,9 +1387,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.13"
+version = "0.23.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2dabaac7466917e566adb06783a81ca48944c6898a1b08b9374106dd671f4c8"
+checksum = "934b404430bb06b3fae2cba809eb45a1ab1aecd64491213d7c3301b88393f8d1"
 dependencies = [
  "once_cell",
  "ring",
@@ -1423,9 +1423,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e696e35370c65c9c541198af4543ccd580cf17fc25d8e05c5a242b202488c55"
+checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
 
 [[package]]
 name = "rustls-webpki"