From c4e0c4e7ed0845fb7fd948abdb0b0b39115a4cfb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C5=81ukasz=20Gumowski?= Date: Tue, 4 Aug 2026 00:14:56 +0200 Subject: [PATCH] fix(deps): bump tract family to 0.22.2 for RUSTSEC-2026-0217 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cargo audit fails the Audit job on every PR since the advisory published: tract-nnef 0.22.1 has an integer overflow in the NNEF tensor parser leading to an out-of-bounds read on model load (RUSTSEC-2026-0217, severity 6.1 medium). tract-onnx pins its siblings with exact versions, so the whole family moves together: tract-core/-data/-hir/-linalg/-nnef/-onnx/-onnx-opl 0.22.1 -> 0.22.2. Lockfile-only change; no manifest or code edits. Verified locally: fmt + clippy -D warnings green, cargo test -p loomem-server green, cargo audit clean. Signed-off-by: Łukasz Gumowski --- Cargo.lock | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 074996b..e2d67a9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -117,7 +117,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -128,7 +128,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -970,7 +970,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2185,7 +2185,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -2870,7 +2870,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2927,7 +2927,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3210,7 +3210,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3475,7 +3475,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3846,9 +3846,9 @@ dependencies = [ [[package]] name = "tract-core" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b65d67f5190132365dda73fe215bfc5e01b031e8cbfbea9d486bb5b0dbba3545" +checksum = "63e26fc0597e4faface4cdd0f6c332bc47b2deb5b70e33e7da96b7341da48419" dependencies = [ "anyhow", "anymap3", @@ -3872,9 +3872,9 @@ dependencies = [ [[package]] name = "tract-data" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "73cd7fda1e5e8b854ea3abdd09126a87fc4af81e6d1e29ec1710a8a4abf4f13a" +checksum = "3c1bc905ca888e7bd9ffddef28a154947811ec7152ffbe24bc414875349171e0" dependencies = [ "anyhow", "downcast-rs 1.2.1", @@ -3898,9 +3898,9 @@ dependencies = [ [[package]] name = "tract-hir" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "554df991b647dba8af0547ee5838b6912ed20b424f2adda0ea0b7faf8db1b151" +checksum = "95808598010849688af5a8ef027ffa05fd8eceb7d3ec8b2f1eea4400643a8378" dependencies = [ "derive-new", "log", @@ -3909,9 +3909,9 @@ dependencies = [ [[package]] name = "tract-linalg" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e72097a89cc4e7c5f1bc4f854b9294dd30fa6f6d8f7f409c556953b49078c94f" +checksum = "94e978802002e63d9fc682e28ef04f5f8ca8e57d0611b06a9bd8443f9c7ba62b" dependencies = [ "byteorder", "cc", @@ -3937,9 +3937,9 @@ dependencies = [ [[package]] name = "tract-nnef" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45b3755dd0948111b407085d11033ba218cb85b85ce8d795cec2b8353db552ea" +checksum = "d0ba114f3d3a336df89e07fad7afff23bcbbf21807eeb4ba3993146474b1cab5" dependencies = [ "byteorder", "flate2", @@ -3957,9 +3957,9 @@ dependencies = [ [[package]] name = "tract-onnx" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac23ad1d2d5da3256ae1a78757b1072a8a3fac2a4b28d27cfb561c5942ec2701" +checksum = "c360502e479d8148420c896baafb69a6d30bb8618e243ce9052d7450b6343a83" dependencies = [ "bytes", "derive-new", @@ -3975,9 +3975,9 @@ dependencies = [ [[package]] name = "tract-onnx-opl" -version = "0.22.1" +version = "0.22.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "87561bf0b84f74a124afc0f1997682728da6cd821083511e0357432954fd24f6" +checksum = "3c2297168305f39aec022d291757e31c0e1badd74e23bdba6bc12bf323990534" dependencies = [ "getrandom 0.2.17", "log", @@ -4334,7 +4334,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]]