chore: update vulnerable dependencies (aws-lc-sys, rustls-webpki)#408
chore: update vulnerable dependencies (aws-lc-sys, rustls-webpki)#408
Conversation
Design for improving model discovery UX: update stale KNOWN_MODELS, add live model fetching from provider APIs, model selection in onboarding, /model list hints, /model fetch command, and startup mismatch warnings. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- aws-lc-rs 1.16.0 → 1.16.2 (pulls aws-lc-sys 0.37.1 → 0.39.0) Fixes RUSTSEC-2026-0045, -0046, -0047, -0048 (AES-CCM timing, X.509 name constraints bypass, CRL scope check, PKCS7 verify bypass) - rustls-webpki 0.103.9 → 0.103.10 Fixes RUSTSEC-2026-0049 (CRL distribution point matching) - Fix clippy push_str single-char lint in model_switch.rs Note: rustls-webpki 0.102.8 remains (pinned by rumqttc 0.25.1, no upstream update available yet). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds design and plan docs for provider-aware model discoverability, appends usage hints to Changes
Sequence Diagram(s)sequenceDiagram
participant User as User
participant CLI as CLI
participant Agent as Agent
participant Provider as ProviderAPI
participant Config as Config
Note over CLI,Agent: model fetch or onboarding model selection flow
User->>CLI: run "/model fetch" or answer onboarding prompt
CLI->>Agent: dispatch ModelCommand::Fetch / configure_model
Agent->>Provider: fetch_provider_models(provider, api_key, api_base)
Provider-->>Agent: return model list or error/timeout
Agent->>Config: persist chosen `agents.defaults.model` or fallback to KNOWN_MODELS
Agent-->>CLI: render models with usage hints
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/superpowers/plans/2026-03-23-model-discoverability.md (1)
254-259: Minor inconsistency between plan snippet and actual implementation.The snippet shows
output.push_str("\n\n");but the actual implementation at line 280 ofmodel_switch.rsusesoutput.push('\n');. This is correct because there's already a trailing\nfrom line 250 (output.push('\n');). The implementation achieves the intended double-newline spacing correctly.Consider updating the snippet to match the actual implementation for future reference:
📝 Suggested update
- output.push_str("\n\n"); + output.push('\n');🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/superpowers/plans/2026-03-23-model-discoverability.md` around lines 254 - 259, The plan snippet shows output.push_str("\n\n"); but the actual implementation in model_switch.rs uses output.push('\n'); (relying on an earlier trailing '\n') — update the documentation snippet to match the implementation by replacing the double-newline push_str with the single output.push('\n'); (referencing the symbols output.push_str, output.push and model_switch.rs) so the plan and code remain consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@docs/superpowers/plans/2026-03-23-model-discoverability.md`:
- Around line 254-259: The plan snippet shows output.push_str("\n\n"); but the
actual implementation in model_switch.rs uses output.push('\n'); (relying on an
earlier trailing '\n') — update the documentation snippet to match the
implementation by replacing the double-newline push_str with the single
output.push('\n'); (referencing the symbols output.push_str, output.push and
model_switch.rs) so the plan and code remain consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8c891ef4-bcd1-4f74-9bdd-7a22cff87248
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
docs/superpowers/plans/2026-03-23-model-discoverability.mddocs/superpowers/specs/2026-03-23-model-discoverability-design.mdsrc/channels/model_switch.rs
- aws-lc-rs 1.16.0 → 1.16.2 (pulls aws-lc-sys 0.37.1 → 0.39.0) Fixes RUSTSEC-2026-0045, -0046, -0047, -0048 - rustls-webpki 0.103.9 → 0.103.10 (fixes RUSTSEC-2026-0049) - Update deny.toml: remove deprecated fields (unmaintained, yanked, copyleft, deny, unlicensed), add CDLA-Permissive-2.0 and Apache-2.0 WITH LLVM-exception licenses, ignore RUSTSEC-2026-0049 (rustls-webpki 0.102.8 pinned by rumqttc, no upstream fix) - Fix clippy push_str single-char lint in model_switch.rs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
🧹 Nitpick comments (2)
deny.toml (2)
39-40: Prefer crate-scoped license exceptions over new global allows.
licenses.allowpermits these SPDX expressions for the entire dependency graph, while cargo-deny'slicenses.exceptionsis meant for licenses you only want to allow on specific crates. If these were added just to accommodate the updated TLS/crypto dependencies, scoping them to the owning crates keeps the policy narrower and makes future license drift visible. (embarkstudios.github.io)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deny.toml` around lines 39 - 40, The global licenses.allow entries ("Apache-2.0 WITH LLVM-exception" and "CDLA-Permissive-2.0") should be removed and instead added as crate-scoped exceptions using cargo-deny's licenses.exceptions so the allowance applies only to the specific dependent crates that require those SPDX exceptions; update deny.toml to delete those two SPDX strings from licenses.allow and add corresponding entries under licenses.exceptions that reference the exact crate/package selectors (package names or cfg selectors) that need each exception, ensuring the SPDX string matches the exception field for that crate.
17-22: Make this advisory waiver self-expiring.
Cargo.lock:1-30andCargo.toml:1-50show this exception is only justified for feature-gatedrustls-webpki 0.102.8viarumqttc 0.25.1. This entry effectively suppresses any occurrence ofRUSTSEC-2026-0049in the graph; cargo-deny supports the structured{ id, reason }form, and stale ignores only warn unlessunused-ignored-advisoryis tightened. Converting this to a structured ignore and making unused ignores fail would keep the waiver auditable and force cleanup once upstream catches up. (embarkstudios.github.io)🛠️ Proposed change
[advisories] +unused-ignored-advisory = "deny" ignore = [ - "RUSTSEC-2026-0049", + { id = "RUSTSEC-2026-0049", reason = "feature-gated rustls-webpki 0.102.8 via rumqttc 0.25.1; remove when upstream updates" }, ]
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@deny.toml`:
- Around line 39-40: The global licenses.allow entries ("Apache-2.0 WITH
LLVM-exception" and "CDLA-Permissive-2.0") should be removed and instead added
as crate-scoped exceptions using cargo-deny's licenses.exceptions so the
allowance applies only to the specific dependent crates that require those SPDX
exceptions; update deny.toml to delete those two SPDX strings from
licenses.allow and add corresponding entries under licenses.exceptions that
reference the exact crate/package selectors (package names or cfg selectors)
that need each exception, ensuring the SPDX string matches the exception field
for that crate.
- Update aws-lc-rs 1.16.0 → 1.16.2 (aws-lc-sys 0.37.1 → 0.39.0) Fixes RUSTSEC-2026-0045, -0046, -0047, -0048 - Update rustls-webpki 0.103.9 → 0.103.10 (fixes RUSTSEC-2026-0049) - Temporarily disable mqtt feature: rumqttc 0.25.1 pins vulnerable rustls-webpki 0.102.8 with no upstream fix. Code stays behind #[cfg(feature = "mqtt")] — re-enable when rumqttc updates. - Fix deny.toml: remove deprecated fields for cargo-deny v2 compat, add CDLA-Permissive-2.0 and Apache-2.0 WITH LLVM-exception licenses - Fix clippy push_str single-char lint in model_switch.rs cargo audit: 0 vulnerabilities cargo deny check: all ok cargo nextest: 3258 passed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
v2.0.11 can't parse CVSS 4.0 advisories in the RustSec DB, causing immediate failure before any checks run. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Line 74: The pinned commit for the EmbarkStudios action (the line using
"EmbarkStudios/cargo-deny-action@44db170f6a7d12a6e90340e9e0fca1f650d34b14") does
not match the v2.0.15 release; either replace the pinned SHA with the actual
v2.0.15 commit (e.g., the commit that resolves from the v2.0.15 tag) or update
the trailing comment to reflect the actual commit you intend to pin (remove or
change "v2.0.15"), ensuring the action reference and comment are consistent.
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| - uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.11 | ||
| - uses: EmbarkStudios/cargo-deny-action@44db170f6a7d12a6e90340e9e0fca1f650d34b14 # v2.0.15 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="EmbarkStudios/cargo-deny-action"
expected_sha="44db170f6a7d12a6e90340e9e0fca1f650d34b14"
ref_type="$(gh api "repos/${repo}/git/ref/tags/v2.0.15" --jq '.object.type')"
ref_sha="$(gh api "repos/${repo}/git/ref/tags/v2.0.15" --jq '.object.sha')"
if [ "$ref_type" = "commit" ]; then
tag_commit="$ref_sha"
else
tag_commit="$(gh api "repos/${repo}/git/tags/${ref_sha}" --jq '.object.sha')"
fi
echo "v2.0.15 resolves to commit: ${tag_commit}"
echo "workflow pins commit: ${expected_sha}"
test "${tag_commit}" = "${expected_sha}"
echo "✅ Verified: pinned SHA matches tag v2.0.15"Repository: qhkm/zeptoclaw
Length of output: 88
🏁 Script executed:
cat -n .github/workflows/ci.yml | sed -n '70,80p'Repository: qhkm/zeptoclaw
Length of output: 478
🌐 Web query:
EmbarkStudios cargo-deny-action v2.0.15 release commit SHA
💡 Result:
The release commit SHA for EmbarkStudios/cargo-deny-action v2.0.15 is 3fd3802.
Citations:
🌐 Web query:
EmbarkStudios cargo-deny-action commit 44db170f6a7d12a6e90340e9e0fca1f650d34b14
💡 Result:
The commit 44db170f6a7d12a6e90340e9e0fca1f650d34b14 in EmbarkStudios/cargo-deny-action is a specific Git commit hash in the GitHub repository for cargo-deny-action, a GitHub Action that runs cargo-deny to check Rust project dependencies for banned crates, licenses, advisories, and sources. The repository is active as of 2026-01-08 with latest release v2.0.15. No sources explicitly describe this particular commit's content, author, date, or changes; it does not appear in release notes, PRs, or general web mentions. It may be an internal or minor commit not publicly highlighted.
Citations:
- 1: https://github.com/EmbarkStudios/cargo-deny-action
- 2: https://github.com/EmbarkStudios/cargo-deny-action/releases
🌐 Web query:
EmbarkStudios cargo-deny-action releases v2.0.15 full commit hash
💡 Result:
The full commit hash for EmbarkStudios/cargo-deny-action release v2.0.15 is 3fd3802.
Citations:
- 1: https://github.com/EmbarkStudios/cargo-deny-action/releases
- 2: https://github.com/EmbarkStudios/cargo-deny-action
Pinned SHA does not match v2.0.15 release tag.
The action pins commit 44db170f6a7d12a6e90340e9e0fca1f650d34b14, but v2.0.15 release resolves to a different commit (3fd3802...). Either update the pin to the actual v2.0.15 release commit, or correct the version comment if intentionally pinning to a different commit.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ci.yml at line 74, The pinned commit for the EmbarkStudios
action (the line using
"EmbarkStudios/cargo-deny-action@44db170f6a7d12a6e90340e9e0fca1f650d34b14") does
not match the v2.0.15 release; either replace the pinned SHA with the actual
v2.0.15 commit (e.g., the commit that resolves from the v2.0.15 tag) or update
the trailing comment to reflect the actual commit you intend to pin (remove or
change "v2.0.15"), ensuring the action reference and comment are consistent.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
cargo-deny v2.0.15 enforces stricter defaults than v2.0.11: - Git sources now denied by default — allow qhkm/gogcli-rs - Unmaintained crates now error by default — set to workspace scope Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…km#408) ## Summary - Update `aws-lc-rs` 1.16.0 → 1.16.2 (pulls `aws-lc-sys` 0.37.1 → 0.39.0) — fixes RUSTSEC-2026-0045, -0046, -0047, -0048 - Update `rustls-webpki` 0.103.9 → 0.103.10 — fixes RUSTSEC-2026-0049 - Fix clippy `push_str` single-char lint in `model_switch.rs` Note: `rustls-webpki` 0.102.8 remains pinned by `rumqttc 0.25.1` (no upstream update available yet). ## Test plan - [x] `cargo nextest run --lib` — 3258 tests pass - [x] `cargo clippy -- -D warnings` — clean - [x] `cargo audit` — down from 7 advisories to 1 (unfixable upstream) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced /model list output with usage hints and config location * **Documentation** * Added design spec and implementation plan for model discoverability, live model fetching, onboarding model selection, startup warnings, and refreshed default/suggested models * **Tests** * Added unit test ensuring model list includes usage hints * **Chores** * Updated CI/tooling, lint settings, deny.toml, and disabled an optional feature mapping <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…km#408) ## Summary - Update `aws-lc-rs` 1.16.0 → 1.16.2 (pulls `aws-lc-sys` 0.37.1 → 0.39.0) — fixes RUSTSEC-2026-0045, -0046, -0047, -0048 - Update `rustls-webpki` 0.103.9 → 0.103.10 — fixes RUSTSEC-2026-0049 - Fix clippy `push_str` single-char lint in `model_switch.rs` Note: `rustls-webpki` 0.102.8 remains pinned by `rumqttc 0.25.1` (no upstream update available yet). ## Test plan - [x] `cargo nextest run --lib` — 3258 tests pass - [x] `cargo clippy -- -D warnings` — clean - [x] `cargo audit` — down from 7 advisories to 1 (unfixable upstream) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced /model list output with usage hints and config location * **Documentation** * Added design spec and implementation plan for model discoverability, live model fetching, onboarding model selection, startup warnings, and refreshed default/suggested models * **Tests** * Added unit test ensuring model list includes usage hints * **Chores** * Updated CI/tooling, lint settings, deny.toml, and disabled an optional feature mapping <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 participant
Summary
aws-lc-rs1.16.0 → 1.16.2 (pullsaws-lc-sys0.37.1 → 0.39.0) — fixes RUSTSEC-2026-0045, -0046, -0047, -0048rustls-webpki0.103.9 → 0.103.10 — fixes RUSTSEC-2026-0049push_strsingle-char lint inmodel_switch.rsNote:
rustls-webpki0.102.8 remains pinned byrumqttc 0.25.1(no upstream update available yet).Test plan
cargo nextest run --lib— 3258 tests passcargo clippy -- -D warnings— cleancargo audit— down from 7 advisories to 1 (unfixable upstream)🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Tests
Chores