[staging-26.05] cargo: add patches for CVE-2026-5222 and CVE-2026-5223 - #524640
Merged
Conversation
Upstream pull request: rust-lang/cargo#17031 Fixes: CVE-2026-5222, https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ Fixes: CVE-2026-5223, https://blog.rust-lang.org/2026/05/25/cve-2026-5223/ Not-cherry-picked-because: master will get these fixes via the rust 1.96 upgrade on 2026-05-28
![nixpkgs-commit-check[bot]](https://avatars.githubusercontent.com/u/487568?s=60&v=4){kind=small}
There was a problem hiding this comment.
This report is automatically generated by the PR / Check / cherry-pick CI workflow.
Some of the commits in this PR require the author's and reviewer's attention.
If you need to merge this PR despite the warnings, please dismiss this review shortly before merging.
Important
5f1133b is not a cherry-pick, because: master will get these fixes via the rust 1.96 upgrade on 2026-05-28. Please review this commit manually.
Hint: The full diffs are also available in the runner logs with slightly better highlighting.
nixpkgs-ci
Bot
added
10.rebuild-linux: 501+
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
My understanding is that the release branches do not upgrade their Rust versions, so we should patch these issues on 26.05. There won't be another staging-next-25.11 cycle, and the issues don't seem of high enough severity to disrupt the current one, so I don't think we need to bother with this on 25.11.
Please let me know if there's a different/better place to apply this patch; I wasn't sure if I should do it in
rust/cargo.nix,rust/1_95.nix, or elsewhere.Upstream pull request: rust-lang/cargo#17031
Fixes: CVE-2026-5222, https://blog.rust-lang.org/2026/05/25/cve-2026-5222/
Fixes: CVE-2026-5223, https://blog.rust-lang.org/2026/05/25/cve-2026-5223/
Not-cherry-picked-because: master will get these fixes via the rust 1.96 upgrade on 2026-05-28
Things done
passthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.