[jatmn]

Summary

Moves aws-smithy-json to 0.62.7, the first release patched for GHSA-8ffr-xgwf-xj56 / CVE-2026-18140, a high-severity flaw: unbounded recursion when skipping unknown keys in deeply nested JSON exhausts the stack. Before this change, Cargo.lock resolved two vulnerable versions, 0.61.9 and 0.62.5.

Motivation & context

Resolves Dependabot alert #16. No GitHub issue is filed for it. cargo audit doesn't catch this one because RustSec has no advisory for it, so Dependabot is the only check that flags it.

Where the two vulnerable versions came from:

• aws-sdk-s3 1.119.0 required aws-smithy-json ^0.61.9. No 0.61.x release has the fix.
• aws-config 1.8.15 and the sso/ssooidc/sts clients required ^0.62.5, locked at 0.62.5.

Kind of change

• Bug fix
• Feature
• Security fix
• Docs
• Tests / CI
• Refactor (no behavior change)
• Breaking or protocol change (issue required first)

What changed

• Cargo.lock: 0.62.7 requires aws-smithy-runtime-api ^1.12.3, so the AWS SDK moves together. Each crate goes to its newest release that still builds on our 1.91 MSRV; those declare rust-version = 1.91.1, which the MSRV job's 1.91 toolchain is, and later releases need 1.94.1:
  • aws-config 1.8.15 → 1.8.18
  • aws-sdk-s3 1.119.0 → 1.137.0, which itself requires aws-smithy-json ^0.62.7
  • aws-sdk-sso 1.97.0 → 1.102.0, aws-sdk-ssooidc 1.99.0 → 1.104.0, aws-sdk-sts 1.101.0 → 1.107.0
  • aws-sigv4 1.4.2 → 1.4.5, aws-runtime 1.7.2 → 1.7.5, aws-types 1.3.14 → 1.3.16
  • aws-smithy-runtime 1.10.3 → 1.11.3, -runtime-api 1.11.6 → 1.12.3, -types 1.4.7 → 1.5.0, -checksums 0.63.12 → 0.64.8, -eventstream 0.60.20 → 0.60.21. New: aws-smithy-schema 0.1.0 and aws-smithy-runtime-api-macros 1.0.0. aws-smithy-http 0.62.6 is no longer needed.
  • Transitive changes:
    • p256 0.11 → 0.13, through aws-sigv4. This drops crypto-bigint 0.4.9 and the elliptic-curve 0.12 stack.
    • New for aws-smithy-checksums: the digest 0.11 hash crates (sha1, sha2, md-5, hmac) and crc-fast 1.10.
    • lru 0.12.5 is no longer needed.
• .cargo/audit.toml: two comment lines in the RUSTSEC-2026-0387 entry corrected, because crypto-bigint 0.4.9 and the p256 0.11 path are gone. The ignore is still needed for crypto-bigint 0.5.5, through alloy and aws-sigv4.

No manifest or source changes. Crate affected: gitlawb-node, through its aws-sdk-s3/aws-config dependencies (Tigris storage client).

How a reviewer can verify

grep -A1 'name = "aws-smithy-json"' Cargo.lock    # only 0.62.7
cargo +1.91 check --locked --workspace --all-targets
cargo clippy --locked --workspace --all-targets -- -D warnings
cargo audit
DATABASE_URL=... cargo test --locked --workspace

All local results are on 6954f4c, the PR head:

• cargo fmt --all -- --check: pass.
• MSRV, cargo +1.91 check --locked --workspace --all-targets (rustc 1.91.1): pass.
• cargo clippy --locked --workspace --all-targets -- -D warnings: pass.
• cargo audit (0.22.2): exit 0, no vulnerabilities, 10 allowed warnings (down from 12).
• scripts/check-gitlawb-core-deps.sh: OK.
• cargo build --locked --release --workspace: pass.
• cargo test --locked --workspace against a local Postgres 17: 1692 passed, 0 failed, 4 ignored.
• docker build . plus a --version smoke run: pass (gitlawb-node 0.7.1).

Limitation: I didn't test against a real S3/Tigris endpoint. The S3 path (git/tigris.rs: head/put/get object and aws_config::load_defaults) is covered only by compilation and the existing workspace tests.

How the lockfile was produced, for anyone redoing it:

1. Temporarily set the workspace rust-version to 1.91.1.
2. Run CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS=fallback cargo update -p aws-sdk-s3 -p aws-config.
3. Revert Cargo.toml.
4. That resolver also switched hyper-util/quinn/quinn-udp from socket2 0.5.10 to 0.6.3, which has nothing to do with this fix. I restored those three edges, and cargo metadata --locked accepts the lockfile without changing it.

Before you request review

• Scope is one logical change; no unrelated churn
• cargo test --workspace passes locally
• New behavior is covered by tests (required for fixes): N/A, dependency-only change with no behavior change in our code
• cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings are clean
• Commit titles use Conventional Commits (feat(...), fix(...), docs(...))
• Docs / .env.example updated if behavior or config changed (or N/A)
• Checked existing PRs so this isn't a duplicate

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated the security advisory notes to reflect the revised affected-version and dependency-path information. No changes to application behavior are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The crypto-bigint advisory comment now identifies version 0.5.5 and updates the SigV4a dependency path. The advisory ignore and remaining risk description are unchanged.

Changes: Audit advisory documentation

Layer / File(s)	Summary
Update advisory comment .cargo/audit.toml	The comment replaces the listed versions with 0.5.5 and updates the SigV4a path to crypto-bigint 0.5 directly and through p256 0.13.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• Twigpine/node#514: Updates Cargo.lock and adds the crypto-bigint advisory ignore addressed by this comment.

Suggested reviewers: beardthelion

Merge Risk: Minimal · up to 6954f

The dependency and audit-comment updates present no actionable merge-blocking risk based on the supplied evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the primary change: updating aws-smithy-json to version 0.62.7 to address the cited security advisory.
Description check		The description is complete and focused. It explains the security issue, affected dependencies, lockfile changes, verification steps, test results, and the limitation that no real S3/Tigris endpoint w…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is complete and focused. It explains the security issue, affected dependencies, lockfile changes, verification steps, test results, and the limitation that no real S3/Tigris endpoint was tested.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: 1d04abdf-3b87-467e-a80b-c7bdb16a2d7f

Commits

Reviewing files that changed from the base of the PR and between 4d024e0 and 6954f4c.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• .cargo/audit.toml

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[jatmn]

🟢 Thanks for the contribution. I do not see any actionable issues from my review.

Reviewed head 6954f4c against merge base/current main 4d024e0.

Merge readiness

The branch is mergeable, with no target drift or conflicts. All 12 CI checks pass; CodeRabbit skipped this draft. The PR is draft and requires an approving review before proceeding through the repository's merge queue.

Findings

No actionable findings.

The lockfile contains only aws-smithy-json 0.62.7, the patched version identified by GHSA-8ffr-xgwf-xj56. Both affected resolutions are removed. The audit comment accurately describes the retained crypto-bigint 0.5.5 graph, without adding an ignore.

Scope and contract tracing

Surface	Producer, consumer and lifecycle	Mutation / ordering / sibling result
Cargo.lock JSON/AWS closure	Manifests → locked graph → build → SDK client	Both affected JSON copies replaced; all added/removed packages and changed dependency edges inspected.
Tigris operations affected through SDK	Config loader → client → HEAD/PUT/GET/DELETE → RepoStore acquisition/publication	Application code unchanged. In-memory PUT retains checksum header behavior; GET collection precedes extraction; write-guard upload precedes unlock. Client construction and all direct storage callers checked.
.cargo/audit.toml operator copy	Resolved signing graph → two comment corrections → audit readers	Both changed comment lines agree with the graph; parsed suppression settings unchanged. No other in-diff operator-copy surface.
Build/test/release consumers	Locked restore → CI/MSRV/Docker → packaged binaries	No changed routes, records, tests, persistence format, or CI selection. No new application malformed-input boundary or shared-field matrix applies.

Validation

Locally passed: locked full Cargo metadata, cargo +1.91 check --locked --offline --workspace --all-targets on Rust 1.91.1, formatting, and cargo audit 0.22.2 with a fresh advisory database and the repository configuration. Audit reports no unsuppressed vulnerabilities and 10 warnings. The dependency's 1.91.1 patch-level requirement already existed at the merge base.

A focused executable exercised the production JSON token skip API on a 64 KiB thread stack: nesting through 512 succeeds; 513 and 10,000 return the depth error without crashing. Inspected CI logs show stable and beta each passed 1,692 tests with four ignored; locked lint/MSRV/release checks and Docker version smoke pass.

No live S3/Tigris round trip was performed. Existing stalled-endpoint tests and upload counters do not establish provider interoperability; the SDK operation/default comparison and successful builds provide narrower evidence.

Primary review, two waves of two independent blind full-diff searches, a separate missing-contract search, candidate reconciliation, and intent/base/head/target attribution audit completed. Related dependency fixes #514/#455 are incorporated; overlapping storage PRs #285/#244 retain the vulnerable versions and do not supersede this change. There are no review threads or prior change requests on this PR; the relevant #514 audit-comment request is satisfied in current code.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the AWS dependency update targeting the stack-exhaustion vulnerability.

No open issues 🎉

What changed in this PR

Updates the AWS dependency stack used by gitlawb-node’s S3/Tigris storage client to address the stack-exhaustion vulnerability in GHSA-8ffr-xgwf-xj56.

Changes:

• Replaces both vulnerable aws-smithy-json versions with 0.62.7 and updates related AWS dependencies.
• Updates transitive cryptography and checksum dependencies, removing older dependency versions.
• Corrects audit-ignore comments to reflect the remaining crypto-bigint dependency paths; no source, manifest, or audit-policy changes.

File	Description
Cargo.lock	Locks the patched JSON library and accompanying AWS dependency updates.
.cargo/​audit.toml	Updates comments describing the retained crypto-bigint risk exception.

_{Review effort: Balanced}

[beardthelion]

Approving at 6954f4c. The lock now resolves a single aws-smithy-json, 0.62.7 (base had 0.61.9 and 0.62.5), cargo metadata --locked accepts it, and cargo audit exits 0.

crypto-bigint 0.5.5 is still reached through aws-sigv4 and elliptic-curve 0.13, so the RUSTSEC-2026-0387 ignore stays needed and the corrected comment matches the lock. The 1.91.1 rust-version on the new SDK crates is the same floor main already carried, and the MSRV job is green. The tigris test passes on this head. The real S3/Tigris path is untested, as the description says.

Non-blocking, for a follow-up: audit-schedule.yml has a drift guard for the hickory ignores but none for the crypto-bigint one.

[jatmn]

@kevincodex1 still blocked by code quality check. :(