Update rust and libseccomp dependencies#6029
Merged
zulinx86 merged 5 commits intoJul 15, 2026
Merged
Conversation
libseccomp v2.6.1 [1] includes several security fixes. Firecracker's runtime and bundled default filters are not affected by any of the addressed issues because runtime loads precompiled BPF filters and the default policies do not meet their trigger conditions. Update the dev container dependency to incorporate the fixes and harden seccompiler-bin when compiling unusually large custom profiles. [1]: https://github.com/seccomp/libseccomp/releases/tag/v2.6.1 Signed-off-by: Takahiro Itazuri <zulinx86@gmail.com>
Rust 1.97.0 [1] does not announce a CVE or security advisory. It does fix an unsound coercion in the `pin!` macro [2][3] that can let safe Rust code trigger undefined behavior. Firecracker's source does not use the affected `pin!` macro, so this issue does not affect Firecracker. Update the repository toolchain pin and development container to this release. [1]: https://github.com/rust-lang/rust/releases/tag/1.97.0 [2]: rust-lang/rust#153438 [3]: rust-lang/rust#153457 Signed-off-by: Takahiro Itazuri <zulinx86@gmail.com>
zulinx86
force-pushed
the
20260710-1316-update-rust-and-libseccomp-dependencies
branch
3 times, most recently
from
July 14, 2026 12:11
7f4273d to
5762667
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6029 +/- ##
=======================================
Coverage 82.82% 82.82%
=======================================
Files 277 277
Lines 30444 30444
=======================================
Hits 25216 25216
Misses 5228 5228
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
zulinx86
force-pushed
the
20260710-1316-update-rust-and-libseccomp-dependencies
branch
from
July 14, 2026 12:21
5762667 to
1030128
Compare
Rust 1.97.0's Clippy reports redundant references passed to `format!` and direct map iteration when only the values are used. Remove the redundant formatting references in the cgroup and jailer code, and iterate over the MMIO device map with `HashMap::values`. These are lint-only changes and do not alter runtime behavior. Signed-off-by: Takahiro Itazuri <zulinx86@gmail.com>
The new devctr image contains Rust 1.97.0 and libseccomp v2.6.1. Signed-off-by: Takahiro Itazuri <zulinx86@gmail.com>
zulinx86
force-pushed
the
20260710-1316-update-rust-and-libseccomp-dependencies
branch
from
July 14, 2026 12:23
1030128 to
d858077
Compare
When a Rust toolchain update is tested, the devctr contains the new
toolchain but not the old toolchain required by the A (before) checkout.
Running cargo in that checkout invokes the rustup proxy, which installs
the old toolchain before starting Cargo and writes informational lines
to cargo-deny's stderr, for example:
info: syncing channel updates for 1.96.0-x86_64-unknown-linux-gnu
info: downloading 5 components
The audit test parses each stderr line as JSON, so these lines cause a
JSONDecodeError before the A and B results can be compared.
Set RUSTUP_LOG=warn only for cargo deny. This suppresses rustup info
output while preserving warnings and errors, and keeps the JSON parser
strict.
Signed-off-by: Takahiro Itazuri <zulinx86@gmail.com>
zulinx86
force-pushed
the
20260710-1316-update-rust-and-libseccomp-dependencies
branch
from
July 14, 2026 13:00
9caa2ff to
8c0eaec
Compare
JamesC1305
approved these changes
Jul 14, 2026
zulinx86
added
the
Status: Awaiting review
zulinx86
enabled auto-merge
July 14, 2026 13:45
Manciukic
approved these changes
Jul 15, 2026
Merged
via the queue into
firecracker-microvm:main
with commit Jul 15, 2026
295f547
7 of 8 checks passed
zulinx86
deleted the
20260710-1316-update-rust-and-libseccomp-dependencies
branch
July 15, 2026 11:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Reason
Closes #6012
Closes #6027
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.PR Checklist
tools/devtool checkbuild --allto verify that the PR passesbuild checks on all supported architectures.
tools/devtool checkstyleto verify that the PR passes theautomated style checks.
how they are solving the problem in a clear and encompassing way.
in the PR.
CHANGELOG.md.Runbook for Firecracker API changes.
integration tests.
TODO.rust-vmm.