[jatmn]

Summary

Moves aws-smithy-json to 0.62.7, the first release patched for GHSA-8ffr-xgwf-xj56 / CVE-2026-18140, a high-severity flaw: unbounded recursion when skipping unknown keys in deeply nested JSON exhausts the stack. Before this change, Cargo.lock resolved two vulnerable versions, 0.61.9 and 0.62.5.

Motivation & context

Re-opened from an upstream branch in place of #515 (same commit, 6954f4c), which was opened from a fork and stayed blocked on the code quality rule.

Resolves Dependabot alert #16. No GitHub issue is filed for it. cargo audit doesn't catch this one because RustSec has no advisory for it, so Dependabot is the only check that flags it.

Where the two vulnerable versions came from:

• aws-sdk-s3 1.119.0 required aws-smithy-json ^0.61.9. No 0.61.x release has the fix.
• aws-config 1.8.15 and the sso/ssooidc/sts clients required ^0.62.5, locked at 0.62.5.

Kind of change

• Bug fix
• Feature
• Security fix
• Docs
• Tests / CI
• Refactor (no behavior change)
• Breaking or protocol change (issue required first)

What changed

• Cargo.lock: 0.62.7 requires aws-smithy-runtime-api ^1.12.3, so the AWS SDK moves together. Each crate goes to its newest release that still builds on our 1.91 MSRV; those declare rust-version = 1.91.1, which the MSRV job's 1.91 toolchain is, and later releases need 1.94.1:
  • aws-config 1.8.15 → 1.8.18
  • aws-sdk-s3 1.119.0 → 1.137.0, which itself requires aws-smithy-json ^0.62.7
  • aws-sdk-sso 1.97.0 → 1.102.0, aws-sdk-ssooidc 1.99.0 → 1.104.0, aws-sdk-sts 1.101.0 → 1.107.0
  • aws-sigv4 1.4.2 → 1.4.5, aws-runtime 1.7.2 → 1.7.5, aws-types 1.3.14 → 1.3.16
  • aws-smithy-runtime 1.10.3 → 1.11.3, -runtime-api 1.11.6 → 1.12.3, -types 1.4.7 → 1.5.0, -checksums 0.63.12 → 0.64.8, -eventstream 0.60.20 → 0.60.21. New: aws-smithy-schema 0.1.0 and aws-smithy-runtime-api-macros 1.0.0. aws-smithy-http 0.62.6 is no longer needed.
  • Transitive changes:
    • p256 0.11 → 0.13, through aws-sigv4. This drops crypto-bigint 0.4.9 and the elliptic-curve 0.12 stack.
    • New for aws-smithy-checksums: the digest 0.11 hash crates (sha1, sha2, md-5, hmac) and crc-fast 1.10.
    • lru 0.12.5 is no longer needed.
• .cargo/audit.toml: two comment lines in the RUSTSEC-2026-0387 entry corrected, because crypto-bigint 0.4.9 and the p256 0.11 path are gone. The ignore is still needed for crypto-bigint 0.5.5, through alloy and aws-sigv4.

No manifest or source changes. Crate affected: gitlawb-node, through its aws-sdk-s3/aws-config dependencies (Tigris storage client).

How a reviewer can verify

grep -A1 'name = "aws-smithy-json"' Cargo.lock    # only 0.62.7
cargo +1.91 check --locked --workspace --all-targets
cargo clippy --locked --workspace --all-targets -- -D warnings
cargo audit
DATABASE_URL=... cargo test --locked --workspace

All local results are on 6954f4c, the PR head:

• cargo fmt --all -- --check: pass.
• MSRV, cargo +1.91 check --locked --workspace --all-targets (rustc 1.91.1): pass.
• cargo clippy --locked --workspace --all-targets -- -D warnings: pass.
• cargo audit (0.22.2): exit 0, no vulnerabilities, 10 allowed warnings (down from 12).
• scripts/check-gitlawb-core-deps.sh: OK.
• cargo build --locked --release --workspace: pass.
• cargo test --locked --workspace against a local Postgres 17: 1692 passed, 0 failed, 4 ignored.
• docker build . plus a --version smoke run: pass (gitlawb-node 0.7.1).

Limitation: I didn't test against a real S3/Tigris endpoint. The S3 path (git/tigris.rs: head/put/get object and aws_config::load_defaults) is covered only by compilation and the existing workspace tests.

How the lockfile was produced, for anyone redoing it:

1. Temporarily set the workspace rust-version to 1.91.1.
2. Run CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS=fallback cargo update -p aws-sdk-s3 -p aws-config.
3. Revert Cargo.toml.
4. That resolver also switched hyper-util/quinn/quinn-udp from socket2 0.5.10 to 0.6.3, which has nothing to do with this fix. I restored those three edges, and cargo metadata --locked accepts the lockfile without changing it.

Before you request review

• Scope is one logical change; no unrelated churn
• cargo test --workspace passes locally
• New behavior is covered by tests (required for fixes): N/A, dependency-only change with no behavior change in our code
• cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings are clean
• Commit titles use Conventional Commits (feat(...), fix(...), docs(...))
• Docs / .env.example updated if behavior or config changed (or N/A)
• Checked existing PRs so this isn't a duplicate

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Clarified the documented crypto-bigint version paths associated with the aws-sigv4 SigV4a flow, including the direct path and the path through p256.
  • Updated the listed p256 and crypto-bigint versions. No audit configuration values changed.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The advisory comments in .cargo/audit.toml now identify crypto-bigint 0.5.5 and describe the SigV4a path through p256 0.13 and directly to version 0.5. Audit configuration values did not change.

Changes: Advisory comments

Layer / File(s)	Summary
Update SigV4a version path .cargo/audit.toml	The comments identify crypto-bigint 0.5.5 and replace the path through p256 0.11 and crypto-bigint 0.4 with the path through p256 0.13 and directly to version 0.5.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• Twigpine/node#515: This PR updates the same advisory comments and also changes AWS crate entries in Cargo.lock.
• Twigpine/node#514: This PR adds the advisory ignore and explanatory comments that this PR revises.

Suggested reviewers: beardthelion

Merge Risk: Minimal · up to 6954f

No actionable merge risk remains in this comment-only update.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: bumping aws-smithy-json to 0.62.7 to fix GHSA-8ffr-xgwf-xj56. The changeset is a Cargo.lock update that moves aws-smithy-json to 0.62.7 as part of the AWS SDK bump. Th…
Description check		The description follows the template closely. It has a Summary, Motivation & context with a Dependabot reference, Kind of change with Security fix checked, a detailed What changed section naming the a…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: bumping aws-smithy-json to 0.62.7 to fix GHSA-8ffr-xgwf-xj56. The changeset is a Cargo.lock update that moves aws-smithy-json to 0.62.7 as part of the AWS SDK bump. The title is specific and accurate, and it follows Conventional Commits.

Full details: Description check

Explanation

The description follows the template closely. It has a Summary, Motivation & context with a Dependabot reference, Kind of change with Security fix checked, a detailed What changed section naming the affected crates and the .cargo/audit.toml edit, a How a reviewer can verify section with commands and results, and a completed Before you request review checklist. The Protocol & signing impact block was removed, which the template allows when the change does not touch the protocol. The 'Closes #' issue line was replaced with an explanation that no GitHub issue exists, and the template's Notes for reviewers section is absent. Both are minor gaps.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: 2e93a49e-281e-4f56-817f-1746cb1332b1

Commits

Reviewing files that changed from the base of the PR and between 4d024e0 and 6954f4c.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• .cargo/audit.toml

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[Copilot]

🟢 Approval recommended

No active review issues are blocking the AWS dependency update.

No open issues 🎉

What changed in this PR

Updates the AWS dependency stack used by gitlawb-node’s S3/Tigris storage client to resolve the JSON stack-exhaustion vulnerability GHSA-8ffr-xgwf-xj56.

Changes:

• Replaces both vulnerable aws-smithy-json versions with 0.62.7 and updates the related AWS SDK and transitive dependencies.
• Corrects audit comments to reflect the remaining crypto-bigint dependency paths; advisory ignores are unchanged.

File	Description
Cargo.lock	Updates AWS dependencies to use patched JSON parsing and removes obsolete transitive versions.
.cargo/​audit.toml	Updates comments describing the remaining accepted crypto-bigint risk.

_{Review effort: Balanced}

[beardthelion]

Approving at 6954f4c. The lock now resolves a single aws-smithy-json, 0.62.7; main has both 0.61.9 and 0.62.5. cargo metadata --locked accepts it and cargo audit exits 0.

crypto-bigint resolves only to 0.5.5, through aws-sigv4 and elliptic-curve 0.13, so the RUSTSEC-2026-0387 ignore is still needed and the corrected audit.toml comment matches the lock. The lock diff adds only registry crates with checksums, and the lines that look like downgrades (hybrid-array 0.4.10, ctutils 0.4.8) are new packages. MSRV and the tigris tests are green in CI on this head. The real S3/Tigris path is untested, as the description says.

Non-blocking, for a follow-up: audit-schedule.yml has a drift guard for the hickory ignores but none for the crypto-bigint one.