viirya opened a new pull request, #48: URL: https://github.com/apache/spark-connect-gateway/pull/48
### What changes were proposed in this pull request? Pin the transitive `h2` dependency to 0.4.16 to pick up the fix for RUSTSEC-2026-0258. `h2` is not a direct dependency -- it appears nowhere in `Cargo.toml`, arriving via `hyper` and `tonic` 0.14.6 -- so this is a lockfile-only change: ``` cargo update -p h2 --precise 0.4.16 ``` The resolved package set is **431 crates before and after**, and `h2 0.4.15 -> 0.4.16` is the only version that moves. The diff also shows four `windows-sys 0.61.2 -> 0.52.0` lines inside other packages' dependency lists. **These are not a downgrade.** Both 0.52.0 and 0.61.2 are present in the graph before and after this change; cargo only re-pointed some dependents at the copy that was already there. They are Windows-only crates and CI is `ubuntu-latest` throughout, so they affect no build here. ### Why are the changes needed? `cargo audit` against `main` (131c830) reports three advisories. This addresses the one that is both server-side and has a fix available: ``` RUSTSEC-2026-0258 -- h2 unbounded empty DATA frames https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h affected: h2 0.4.15, patched: >= 0.4.16 ``` `h2` reaches the gateway through `hyper` -> `tonic` 0.14.6, and the tonic server *is* the gateway's own client-facing listener on `:15003`. A peer that can open a connection and send unbounded empty DATA frames is the threat model of a cluster- or internet-facing gRPC proxy, not a hypothetical. #### Scope: what this does not fix The other two advisories are deliberately left out of this change. - **RUSTSEC-2026-0285** -- `rustls` 0.23.43, "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries", 5.3 medium. Patched in 0.23.45 and already proposed by dependabot in #47, so it belongs there rather than here. Worth noting the gateway's exposure is limited: it does not terminate TLS (no `ServerConfig` / `TlsAcceptor` / `ServerTlsConfig` anywhere under `crates/`, and `:15003` is plaintext), and pulls `rustls` only on client paths -- `kube-client` for the K8s API, `reqwest` for OIDC JWKS, and `opentelemetry-otlp`'s `tls-ring`. - **RUSTSEC-2023-0071** -- `rsa` 0.9.10, Marvin Attack timing sidechannel, 5.9 medium. No fixed version exists, so there is nothing to bump to. It arrives via `jsonwebtoken`'s RSA backend under the `rust_crypto` provider selected in SPARK-59552, and needs a decision -- accept the risk, or change backend -- rather than a version bump. Possibly worth resolving alongside #39. #### A limitation of this fix A `--precise` pin on a transitive dependency is not durable: the next `cargo update`, or a dependabot bump of `hyper` or `tonic`, can re-resolve `h2` and silently drop back below 0.4.16. The durable fix is running `cargo audit` in CI, which is **not wired up today** -- all three advisories reached `main` unnoticed and were found only by running it by hand. That is worth its own change, and this PR does not attempt it. ### Does this PR introduce _any_ user-facing change? No. No configuration, API, or behavioural change; the only effect is that the HTTP/2 implementation underneath the gRPC server no longer accepts an unbounded stream of empty DATA frames. ### How was this patch tested? On the pinned 1.99.0 toolchain: - `cargo audit` now reports **2 vulnerabilities instead of 3**, with RUSTSEC-2026-0258 gone and the `rustls` and `rsa` findings unchanged. - `cargo clippy --workspace --all-targets -- -D warnings` -- clean. - `cargo fmt --all -- --check` -- clean. - `cargo test --workspace` -- **204 passed, 0 failed, 10 ignored**, matching the baseline on `main`. The lockfile claim was verified by comparing the full resolved package set (name + version for all 431 entries) before and after, rather than by reading the diff -- `cargo update --dry-run` had reported only the `h2` line and did not mention the `windows-sys` re-pointing. ### Was this patch authored or co-authored using generative AI tooling? Yes, co-authored with Claude Code. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
