Skip to content

fix(deps): bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix - #4690

Merged
atuin-bot merged 1 commit into
mainfrom
mkt/rustsec-2026-0459
Nov 9, 2026
Merged

atuin-bot merged 1 commit into
mainfrom
mkt/rustsec-2026-0459

Conversation

@BinaryMuse

Copy link
Copy Markdown
Member

Clears the new cargo-deny failures.

  • rmcp 3.3 → 3.9 fixes RUSTSEC-2026-0457, -0461 and -0462. 3.9 renames ServerInfo to ServerConfig; the old name is a deprecated alias.
  • RUSTSEC-2026-0459 is ignored for now. The fixed SQLite comes with libsqlite3-sys 0.39, which sqlx 0.9.0 forbids (<0.38). sqlx main allows it (Bump the upper bound on libsqlite3-sys to allow 0.39.x transact-rs/sqlx#4502, merged yesterday) but hasn't released it. The bug needs a crafted database and -wal pair from a less trusted party; atuin opens only files the same user's processes wrote. ATU-671 tracks removing the ignore and bumping sqlx, rusqlite (to 0.41) and our libsqlite3-sys range once sqlx 0.9.1 ships.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedcargo/​rmcp@​3.3.0 ⏵ 3.9.088100100100100

View full report

@BinaryMuse
BinaryMuse marked this pull request as ready for review November 9, 2026 19:29
@greptile-apps

greptile-apps Bot commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 4/5

[Medium impact] The PR updates the MCP SDK and changes advisory reporting for SQLite across the workspace.

The advisory comment must meet the repository’s writing requirement before merging.

Findings

  1. P2 Comment breaks writing rules ▶

Summary

Updates rmcp from 3.3.0 to 3.9.0 and adopts ServerConfig.

  • The Atuin MCP server now uses rmcp 3.9 and returns its renamed initialization type.
  • cargo-deny skips the SQLite advisory until the workspace can update its dependencies.

Reviews (1) · Last reviewed commit: "chore(deny): ignore RUSTSEC-2026-0459 un..." · Reviewed by Greptile

Comment thread deny.toml
Comment on lines +25 to +26
# opens only files the same user's processes wrote. Remove this, and bump sqlx, rusqlite
# (0.41) and our own libsqlite3-sys range, once sqlx 0.9.1 ships.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Comment breaks writing rules

The new advisory comment uses mid-sentence parentheticals, including (0.41). AGENTS.md explicitly forbids these in comments. Write “bump rusqlite to 0.41” and move the other parenthetical details into separate sentences. This repository requirement must be satisfied before merging.

Context Used: AGENTS.md (source)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

@BinaryMuse

Copy link
Copy Markdown
Member Author

/merge

@atuin-bot

atuin-bot commented Nov 9, 2026 •

Copy link
Copy Markdown
Collaborator

Landed as 8abc249. GitHub shows this merged once it reaches main.

…til sqlx allows the fix (#4690)

Clears the new cargo-deny failures.

* **rmcp 3.3 → 3.9** fixes RUSTSEC-2026-0457, -0461 and -0462. 3.9 renames `ServerInfo` to `ServerConfig`; the old name is a deprecated alias.
* **RUSTSEC-2026-0459 is ignored for now.** The fixed SQLite comes with `libsqlite3-sys` 0.39, which sqlx 0.9.0 forbids (`<0.38`). sqlx main allows it (transact-rs/sqlx#4502, merged yesterday) but hasn't released it. The bug needs a crafted database and `-wal` pair from a less trusted party; atuin opens only files the same user's processes wrote. ATU-671 tracks removing the ignore and bumping sqlx, `rusqlite` (to 0.41) and our `libsqlite3-sys` range once sqlx 0.9.1 ships.
@atuin-bot
atuin-bot force-pushed the mkt/rustsec-2026-0459 branch from 9dd44bf to 8abc249 Compare November 9, 2026 19:40
@atuin-bot
atuin-bot merged commit 8abc249 into main Nov 9, 2026
3 checks passed
@atuin-bot
atuin-bot deleted the mkt/rustsec-2026-0459 branch November 9, 2026 19:40
atuin-bot pushed a commit that referenced this pull request Nov 10, 2026
Release 18.24.6


### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([&#35;4634](#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([&#35;4668](#4668))
- *(daemon)* Don't manage the socket with launchd ([&#35;4669](#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([&#35;4690](#4690))
- *(setup)* Don't warn about uninstalled harnesses ([&#35;4680](#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([&#35;4670](#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([&#35;4694](#4694))
- Include workaround for buggy VTE versions ([&#35;4679](#4679))


### Features

- *(search)* Support jj workspace filters ([&#35;4457](#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([&#35;4659](#4659))


### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([&#35;4675](#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([&#35;4676](#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([&#35;4678](#4678))


### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([&#35;4626](#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([&#35;4686](#4686))


### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([&#35;4693](#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([&#35;4671](#4671))
renovate Bot added a commit to sdwilsh/ansible-playbooks that referenced this pull request Nov 10, 2026
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246)

##### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668))
- *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690))
- *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694))
- Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679))

##### Features

- *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659))

##### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678))

##### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686))

##### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
renovate Bot added a commit to sdwilsh/ansible-playbooks that referenced this pull request Nov 10, 2026
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246)

##### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668))
- *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690))
- *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694))
- Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679))

##### Features

- *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659))

##### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678))

##### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686))

##### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
renovate Bot added a commit to sdwilsh/ansible-playbooks that referenced this pull request Nov 10, 2026
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246)

##### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668))
- *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690))
- *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694))
- Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679))

##### Features

- *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659))

##### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678))

##### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686))

##### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
renovate Bot added a commit to sdwilsh/ansible-playbooks that referenced this pull request Nov 10, 2026
##### [\`18.24.6\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246)

##### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([#4634](atuinsh/atuin#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#4668](atuinsh/atuin#4668))
- *(daemon)* Don't manage the socket with launchd ([#4669](atuinsh/atuin#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#4690](atuinsh/atuin#4690))
- *(setup)* Don't warn about uninstalled harnesses ([#4680](atuinsh/atuin#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#4670](atuinsh/atuin#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([#4694](atuinsh/atuin#4694))
- Include workaround for buggy VTE versions ([#4679](atuinsh/atuin#4679))

##### Features

- *(search)* Support jj workspace filters ([#4457](atuinsh/atuin#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([#4659](atuinsh/atuin#4659))

##### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([#4675](atuinsh/atuin#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#4676](atuinsh/atuin#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#4678](atuinsh/atuin#4678))

##### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#4626](atuinsh/atuin#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#4686](atuinsh/atuin#4686))

##### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([#4693](atuinsh/atuin#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([#4671](atuinsh/atuin#4671))
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Nov 10, 2026
…) (#2584)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/atuinsh/atuin](https://github.com/atuinsh/atuin) | patch | `18.24.5` → `18.24.6` |

---

### Release Notes

<details>
<summary>atuinsh/atuin (ghcr.io/atuinsh/atuin)</summary>

### [`v18.24.6`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246)

[Compare Source](atuinsh/atuin@v18.24.5...v18.24.6)

##### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([#&#8203;4634](atuinsh/atuin#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#&#8203;4668](atuinsh/atuin#4668))
- *(daemon)* Don't manage the socket with launchd ([#&#8203;4669](atuinsh/atuin#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#&#8203;4690](atuinsh/atuin#4690))
- *(setup)* Don't warn about uninstalled harnesses ([#&#8203;4680](atuinsh/atuin#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#&#8203;4670](atuinsh/atuin#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([#&#8203;4694](atuinsh/atuin#4694))
- Include workaround for buggy VTE versions ([#&#8203;4679](atuinsh/atuin#4679))

##### Features

- *(search)* Support jj workspace filters ([#&#8203;4457](atuinsh/atuin#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([#&#8203;4659](atuinsh/atuin#4659))

##### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([#&#8203;4675](atuinsh/atuin#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#&#8203;4676](atuinsh/atuin#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#&#8203;4678](atuinsh/atuin#4678))

##### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#&#8203;4626](atuinsh/atuin#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#&#8203;4686](atuinsh/atuin#4686))

##### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([#&#8203;4693](atuinsh/atuin#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([#&#8203;4671](atuinsh/atuin#4671))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2584
doonga pushed a commit to greyrock-labs/home-ops that referenced this pull request Nov 10, 2026
…) (#718)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/atuinsh/atuin](https://github.com/atuinsh/atuin) | patch | `18.24.5` → `18.24.6` |

---

### Release Notes

<details>
<summary>atuinsh/atuin (ghcr.io/atuinsh/atuin)</summary>

### [`v18.24.6`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18246)

[Compare Source](atuinsh/atuin@v18.24.5...v18.24.6)

##### Bug Fixes

- *(api)* Move to the fixed cowboy, cowlib and grpc_server
- *(copilot)* Register the hook as exec/args so PowerShell can run it ([#&#8203;4634](atuinsh/atuin#4634))
- *(daemon)* Close inherited fds before autostarting, fixing indefinite pty-proxy hang on shell exit ([#&#8203;4668](atuinsh/atuin#4668))
- *(daemon)* Don't manage the socket with launchd ([#&#8203;4669](atuinsh/atuin#4669))
- *(deps)* Bump rmcp for three advisories, and hold the SQLite one until sqlx allows the fix ([#&#8203;4690](atuinsh/atuin#4690))
- *(setup)* Don't warn about uninstalled harnesses ([#&#8203;4680](atuinsh/atuin#4680))
- *(threads)* Capture Claude Code shell edits' diffs, and keep the patch of a write that names atuin key ([#&#8203;4670](atuinsh/atuin#4670))
- *(threads)* Fix mislabeling of omp child transcripts as Pi ([#&#8203;4694](atuinsh/atuin#4694))
- Include workaround for buggy VTE versions ([#&#8203;4679](atuinsh/atuin#4679))

##### Features

- *(search)* Support jj workspace filters ([#&#8203;4457](atuinsh/atuin#4457))
- *(setup)* Sharper capture and search labels, and give sync its own section ([#&#8203;4659](atuinsh/atuin#4659))

##### Miscellaneous Tasks

- Add "Writing style" section to AGENTS.md ([#&#8203;4675](atuinsh/atuin#4675))
- Prefer `cfg!()` over `#[cfg()]` in AGENTS.md ([#&#8203;4676](atuinsh/atuin#4676))
- Prefer `let _ = ...` over `_ = ...` in AGENTS.md ([#&#8203;4678](atuinsh/atuin#4678))

##### Refactor

- *(deps)* Bump hyper-util from 0.1.20 to 0.1.21 ([#&#8203;4626](atuinsh/atuin#4626))
- *(deps)* Bump unicode-normalization from 0.1.25 to 0.1.26 ([#&#8203;4686](atuinsh/atuin#4686))

##### Build

- *(atuin)* Make octavo a default feature, still off at runtime ([#&#8203;4693](atuinsh/atuin#4693))
- *(release)* Compile octavo into release artifacts, still off by default ([#&#8203;4671](atuinsh/atuin#4671))

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.greyrock.io/todd/home-ops/pulls/718
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants