fix(deps): bump nostr for RUSTSEC-2026-0225/0226/0227 - #95
Conversation
Three advisories published against nostr 0.44.6 after 2026-07-30 turn the Security job red on main and therefore on every open PR: - RUSTSEC-2026-0225: derived Debug on NIP-46/NIP-60 types exposes connection secrets, private keys, and Cashu bearer proofs in logs and tracing spans. - RUSTSEC-2026-0226: wallet event parsers accept unauthenticated events. - RUSTSEC-2026-0227: NIP-44 v2 decryption permits resource exhaustion. Lockfile-only patch bump, same shape as f4b0cbc for RUSTSEC-2026-0216: nostr 0.44.6 -> 0.44.7, nostr-relay-pool 0.44.1 -> 0.44.3. 0225 is the one that matters most here: Hive's managed identity path logs diagnostics around key handling, and #78 requires that private-key material never reach logs, analytics, or evidence.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ead2e68874
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [[package]] | ||
| name = "nostr" | ||
| version = "0.44.6" | ||
| version = "0.44.7" |
There was a problem hiding this comment.
When the Tauri desktop is built, it uses the independent desktop/src-tauri/Cargo.lock, which still pins nostr to 0.44.6 while its manifest enables the affected nip44 feature. Consequently, desktop builds and releases remain on the vulnerable version even after the root security check becomes green; refresh the desktop lockfile as part of this upgrade.
AGENTS.md reference: AGENTS.md:L427-L427
Useful? React with 👍 / 👎.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Fable sign-off: merged. Lockfile-only RUSTSEC bump, CI green — security-patch class, no posture question. |
1 participant
mainis red and every open PR inherits it. Three advisories were published againstnostr0.44.6 after 2026-07-30, socargo-deny check(theSecurityjob) now fails onmain— see run 30819842406. Nothing in the tree changed; the advisory database did.Debugon NIP-46/NIP-60 types exposes connection secrets, request parameters, NIP-60 private keys, and Cashu bearer proofs whenever the value is formatted into a log or tracing spanChange
Lockfile only — the same shape as
f4b0cbc("fix(deps): bump nostr for RUSTSEC-2026-0216"):nostr0.44.6 → 0.44.7 (the fixed version named by all three advisories)nostr-relay-pool0.44.1 → 0.44.319 insertions, 19 deletions in
Cargo.lock. No manifest, source, or API changes.Why this one is not just CI hygiene
RUSTSEC-2026-0225 is directly relevant to #78: the managed identity path emits diagnostics around key handling, and #78's stop conditions require that private-key material never reach logs, analytics, or evidence. A derived
Debugthat prints secrets is exactly that failure mode arriving through a dependency rather than through our code.Verification
cargo test --features evaos-teams-managed evaos_teams→ 63 passed, 0 failed (63 rather than 66 because this branch is offmainand does not include PR #91's three new tests).cargo-denyis not installed locally, so theSecurityjob is the real gate here.Should merge before #94 and #91 so their CI runs are clean.