Repository navigation
fix(deps): bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix - #4690
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
[Medium impact] The PR updates the MCP SDK and changes advisory reporting for SQLite across the workspace. The advisory comment must meet the repository’s writing requirement before merging. Findings
SummaryUpdates
Reviews (1) · Last reviewed commit: "chore(deny): ignore RUSTSEC-2026-0459 un..." · Reviewed by Greptile |
| # opens only files the same user's processes wrote. Remove this, and bump sqlx, rusqlite | ||
| # (0.41) and our own libsqlite3-sys range, once sqlx 0.9.1 ships. |
There was a problem hiding this comment.
The new advisory comment uses mid-sentence parentheticals, including (0.41). AGENTS.md explicitly forbids these in comments. Write “bump rusqlite to 0.41” and move the other parenthetical details into separate sentences. This repository requirement must be satisfied before merging.
Context Used: AGENTS.md (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
|
/merge |
|
Landed as 8abc249. GitHub shows this merged once it reaches main. |
…til sqlx allows the fix (#4690) Clears the new cargo-deny failures. * **rmcp 3.3 → 3.9** fixes RUSTSEC-2026-0457, -0461 and -0462. 3.9 renames `ServerInfo` to `ServerConfig`; the old name is a deprecated alias. * **RUSTSEC-2026-0459 is ignored for now.** The fixed SQLite comes with `libsqlite3-sys` 0.39, which sqlx 0.9.0 forbids (`<0.38`). sqlx main allows it (transact-rs/sqlx#4502, merged yesterday) but hasn't released it. The bug needs a crafted database and `-wal` pair from a less trusted party; atuin opens only files the same user's processes wrote. ATU-671 tracks removing the ignore and bumping sqlx, `rusqlite` (to 0.41) and our `libsqlite3-sys` range once sqlx 0.9.1 ships.
9dd44bf to
8abc249
Compare
Release 18.24.6 ### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](#4668)) - *(daemon)* Don't manage the socket with launchd ([#4669](#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#4680](#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](#4694)) - Include workaround for buggy VTE versions ([#4679](#4679)) ### Features - *(search)* Support jj workspace filters ([#4457](#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](#4659)) ### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#4675](#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](#4678)) ### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](#4686)) ### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#4693](#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#4671](#4671))
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246) ##### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668)) - *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694)) - Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679)) ##### Features - *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659)) ##### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678)) ##### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686)) ##### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246) ##### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668)) - *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694)) - Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679)) ##### Features - *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659)) ##### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678)) ##### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686)) ##### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246) ##### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668)) - *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694)) - Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679)) ##### Features - *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659)) ##### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678)) ##### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686)) ##### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246) ##### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668)) - *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694)) - Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679)) ##### Features - *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659)) ##### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678)) ##### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686)) ##### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
…) (#2584) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/atuinsh/atuin](https://github.com/atuinsh/atuin) | patch | `18.24.5` → `18.24.6` | --- ### Release Notes <details> <summary>atuinsh/atuin (ghcr.io/atuinsh/atuin)</summary> ### [`v18.24.6`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246) [Compare Source](atuinsh/atuin@v18.24.5...v18.24.6) ##### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#​4634](atuinsh/atuin#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#​4668](atuinsh/atuin#4668)) - *(daemon)* Don't manage the socket with launchd ([#​4669](atuinsh/atuin#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#​4690](atuinsh/atuin#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#​4680](atuinsh/atuin#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#​4670](atuinsh/atuin#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#​4694](atuinsh/atuin#4694)) - Include workaround for buggy VTE versions ([#​4679](atuinsh/atuin#4679)) ##### Features - *(search)* Support jj workspace filters ([#​4457](atuinsh/atuin#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#​4659](atuinsh/atuin#4659)) ##### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#​4675](atuinsh/atuin#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#​4676](atuinsh/atuin#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#​4678](atuinsh/atuin#4678)) ##### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#​4626](atuinsh/atuin#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#​4686](atuinsh/atuin#4686)) ##### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#​4693](atuinsh/atuin#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#​4671](atuinsh/atuin#4671)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2584
…) (#718) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/atuinsh/atuin](https://github.com/atuinsh/atuin) | patch | `18.24.5` → `18.24.6` | --- ### Release Notes <details> <summary>atuinsh/atuin (ghcr.io/atuinsh/atuin)</summary> ### [`v18.24.6`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246) [Compare Source](atuinsh/atuin@v18.24.5...v18.24.6) ##### Bug Fixes - *(api)* Move to the fixed cowboy, cowlib and grpc_server - *(copilot)* Register the hook as exec/args so PowerShell can run it ([#​4634](atuinsh/atuin#4634)) - *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#​4668](atuinsh/atuin#4668)) - *(daemon)* Don't manage the socket with launchd ([#​4669](atuinsh/atuin#4669)) - *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#​4690](atuinsh/atuin#4690)) - *(setup)* Don't warn about uninstalled harnesses ([#​4680](atuinsh/atuin#4680)) - *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#​4670](atuinsh/atuin#4670)) - *(threads)* Fix mislabeling of omp child transcripts as Pi ([#​4694](atuinsh/atuin#4694)) - Include workaround for buggy VTE versions ([#​4679](atuinsh/atuin#4679)) ##### Features - *(search)* Support jj workspace filters ([#​4457](atuinsh/atuin#4457)) - *(setup)* Sharper capture and search labels, and give sync its own section ([#​4659](atuinsh/atuin#4659)) ##### Miscellaneous Tasks - Add "Writing style" section to AGENTS.md ([#​4675](atuinsh/atuin#4675)) - Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#​4676](atuinsh/atuin#4676)) - Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#​4678](atuinsh/atuin#4678)) ##### Refactor - *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#​4626](atuinsh/atuin#4626)) - *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#​4686](atuinsh/atuin#4686)) ##### Build - *(atuin)* Make octavo a default feature, still off at runtime ([#​4693](atuinsh/atuin#4693)) - *(release)* Compile octavo into release artifacts, still off by default ([#​4671](atuinsh/atuin#4671)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.greyrock.io/todd/home-ops/pulls/718
Clears the new cargo-deny failures.
ServerInfotoServerConfig; the old name is a deprecated alias.libsqlite3-sys0.39, which sqlx 0.9.0 forbids (<0.38). sqlx main allows it (Bump the upper bound on libsqlite3-sys to allow 0.39.x transact-rs/sqlx#4502, merged yesterday) but hasn't released it. The bug needs a crafted database and-walpair from a less trusted party; atuin opens only files the same user's processes wrote. ATU-671 tracks removing the ignore and bumping sqlx,rusqlite(to 0.41) and ourlibsqlite3-sysrange once sqlx 0.9.1 ships.