fix(deps): update rust crate async-graphql to v7.0.10 [security] #607

renovate · 2024-10-03T21:15:05Z

This PR contains the following updates:

Package	Type	Update	Change
async-graphql	dependencies	patch	`7.0.3` -> `7.0.10`
async-graphql	dependencies	patch	`7.0.1` -> `7.0.10`

GitHub Vulnerability Alerts

CVE-2024-47614

Impact

Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime.
Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure.
User Experience Degradation: Users may experience delays or failures when accessing the service, which could lead to frustration and loss of trust in the service.

Patches

Upgrade to v7.0.10
Use SchemaBuilder.limit_directives to limit the maximum number of directives for a single field.

Release Notes

async-graphql/async-graphql (async-graphql)

`v7.0.10`

add SchemeBuilder.limit_directives method to set the maximum number of directives on a single field.
remove needless ?Sized #1593
fix: generate each variant description correctly. #1589
Make From<T> for [Error] set source #1561
feat(graphiql): add support for WS connection params #1597

`v7.0.9`

add on_ping callback to WebSocket

`v7.0.8`

chore: Make Extensions nullable #1563
expose rejection in async_graphql_axum #1571
Updated crate time to 3.36, as it fixes a compilation error in rust 1.80 #1572
Impl Debug for dynamic::FieldValue & Improve error messages for its methods #1582
Support scraping #[doc = ...] attributes when generating descriptions #1581
add Websocket::keepalive_timeout method to sets a timeout for receiving an acknowledgement of the keep-alive ping.

`v7.0.7`

Support raw values from serde_json #1554
The custom directive ARGUMENT_DEFINITION is not being output at the appropriate location in SDL #1559
Support for JSON extended representations of BSON ObjectId and Uuid #1542
feat: get directives from SelectionField #1548
Support Directives on Subscriptions #1500
fix subscription err typo #1556

`v7.0.6`

add license files to each project #1523
Improve alignment of directive behavior with GraphQL spec #1524
dynamic schema: pass default vals to ResolverContext #1527
Add altair source #1530
feat: Add support for using Interface and OneofObject on the same struct #1534

`v7.0.5`

Fix compiler and clippy warnings #1501
Added support for deploying to wasm targets with axum - (without subscriptions) #1517
Bump opentelemetry (0.21.0 -> 0.22.0) #1513
Update lru dependency #1504
Support TypeDirective for ArgumentDefinition, Enum, EnumValue, InputFieldDefinition, InputObject, Interface #1509
Add display attribute for Enum macro #1518

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2024-10-03T21:15:45Z

🚨 Rust Panic Audit: 342 Potential Panic Points Detected 🚨

Crate: ``

📊 Total Usages: 240

🔎 expect usages: 37
🔢 array_index usages: 32
🎁 unwrap usages: 164
🚨 panic usages: 7

Crate: `federation_query_planner`

📊 Total Usages: 53

🚨 panic usages: 3
🎁 unwrap usages: 32
🔎 expect usages: 8
🔢 array_index usages: 10

Crate: `common`

📊 Total Usages: 11

🔢 array_index usages: 1
🎁 unwrap usages: 10

Crate: `telemetry`

📊 Total Usages: 9

🎁 unwrap usages: 4
🔢 array_index usages: 5

Crate: `cloudflare_worker`

📊 Total Usages: 8

🔎 expect usages: 2
🎁 unwrap usages: 5
🚨 panic usages: 1

Crate: `engine`

📊 Total Usages: 7

🔎 expect usages: 1
🎁 unwrap usages: 6

Crate: `tracing`

📊 Total Usages: 6

🎁 unwrap usages: 5
🔎 expect usages: 1

Crate: `conductor`

📊 Total Usages: 5

🚨 panic usages: 1
🎁 unwrap usages: 1
🔎 expect usages: 3

Crate: `config`

📊 Total Usages: 3

🚨 panic usages: 1
🎁 unwrap usages: 2

📌 Expected Annotations

Crate: ``

📊 Total Expected Usages: 22

expand details

Reason: "if the provided VRL code in the config file can't compile, we have to exit."

Code: panic!("failed to compile vrl program");
Location: ./plugins/vrl/src/plugin.rs:129

Reason: "states is a non-user provided variable"

Code: .expect("can't merge states when states is an empty vector!")
Location: ./plugins/vrl/src/plugin.rs:146

Reason: "if initiating an http client fails, then we have to exit."

Code: let client = wasm_polyfills::create_http_client().build().unwrap();
Location: ./plugins/jwt_auth/src/jwks_provider.rs:49

Reason: "part of development docgen CLI"

Code: .expect("Failed to serialize json schema for config file!");
Location: ./libs/config/src/generate-json-schema.rs:50

Reason: "part of development docgen CLI"

Code: .expect("Failed to write the json schema to the file system!");
Location: ./libs/config/src/generate-json-schema.rs:54

Reason: "statically defined regex pattern, we know it works ;)"

Code: .unwrap();
Location: ./libs/config/src/interpolate.rs:18

Reason: "👇"

Code: let raw_contents = read_to_string(file_path)
Location: ./libs/config/src/lib.rs:815

Reason: "👇"

Code: panic!("Failed to interpolate config file, please resolve the above errors");
Location: ./libs/config/src/lib.rs:847

Reason: "👇"

Code: parse_config_from_json(&config_string).expect("Failed to parse JSON config file")
Location: ./libs/config/src/lib.rs:854

Reason: "👇"

Code: parse_config_from_yaml(&config_string).expect("Failed to parse YAML config file")
Location: ./libs/config/src/lib.rs:858

Reason: "👇"

Code: _ => panic!("Unsupported config file extension"),
Location: ./libs/config/src/lib.rs:875

Reason: "👇"

Code: None => panic!("Config file has no extension"),
Location: ./libs/config/src/lib.rs:878

Reason: "if we are unable to construct the endpoints and attach them onto the gateway's http server, we have to exit"

Code: Err(e) => panic!("failed to construct endpoint: {:?}", e),
Location: ./libs/engine/src/gateway.rs:158

Reason: "we can safely index here, it's inside a test with constant defined fixtures."

Code: ConductorGateway::execute(request, &gw.routes[0].route_data).await
Location: ./libs/engine/src/gateway.rs:190

Reason: "we need this"

Code: panic!("Exited process!")
Location: ./libs/napi/src/lib.rs:18

Reason: "we're parsing a statically defined constant, we know it works ;)"

Code: .unwrap()
Location: ./libs/common/src/graphql.rs:31

Reason: "we need to exit the process, if the logger can't be correctly set."

Code: let _guard = tracing::subscriber::set_default(subscriber);
Location: ./bin/conductor/src/lib.rs:37

Reason: "we need to exit the process, if the provided configuration file is incorrect."

Code: panic!("Failed to initialize gateway: {:?}", e);
Location: ./bin/conductor/src/lib.rs:76

Reason: "it panics only if the header name is not valid, and we know it is."

Code: .unwrap()
Location: ./bin/cloudflare_worker/src/http_tracing.rs:20

Reason: "it panics only if the URL source is not valid, and it's already validated before."

Code: let url = req.url().unwrap();
Location: ./bin/cloudflare_worker/src/http_tracing.rs:23

Reason: "it only panics if we are not running in a CF context, should be safe."

Code: let cf_info = req.cf().unwrap();
Location: ./bin/cloudflare_worker/src/http_tracing.rs:27

Reason: "unwraps only in special cases where "data:text" is used."

Code: let http_host = url.host().unwrap().to_string();
Location: ./bin/cloudflare_worker/src/http_tracing.rs:36

Crate: `cloudflare_worker`

📊 Total Expected Usages: 4

expand details

Reason: "it panics only if the header name is not valid, and we know it is."

Code: .unwrap()
Location: ./bin/cloudflare_worker/src/http_tracing.rs:20

Reason: "it panics only if the URL source is not valid, and it's already validated before."

Code: let url = req.url().unwrap();
Location: ./bin/cloudflare_worker/src/http_tracing.rs:23

Reason: "it only panics if we are not running in a CF context, should be safe."

Code: let cf_info = req.cf().unwrap();
Location: ./bin/cloudflare_worker/src/http_tracing.rs:27

Reason: "unwraps only in special cases where "data:text" is used."

Code: let http_host = url.host().unwrap().to_string();
Location: ./bin/cloudflare_worker/src/http_tracing.rs:36

Crate: `config`

📊 Total Expected Usages: 9

expand details

Reason: "part of development docgen CLI"

Code: .expect("Failed to serialize json schema for config file!");
Location: ./libs/config/src/generate-json-schema.rs:50

Reason: "part of development docgen CLI"

Code: .expect("Failed to write the json schema to the file system!");
Location: ./libs/config/src/generate-json-schema.rs:54

Reason: "statically defined regex pattern, we know it works ;)"

Code: .unwrap();
Location: ./libs/config/src/interpolate.rs:18

Reason: "👇"

Code: let raw_contents = read_to_string(file_path)
Location: ./libs/config/src/lib.rs:815

Reason: "👇"

Code: panic!("Failed to interpolate config file, please resolve the above errors");
Location: ./libs/config/src/lib.rs:847

Reason: "👇"

Code: parse_config_from_json(&config_string).expect("Failed to parse JSON config file")
Location: ./libs/config/src/lib.rs:854

Reason: "👇"

Code: parse_config_from_yaml(&config_string).expect("Failed to parse YAML config file")
Location: ./libs/config/src/lib.rs:858

Reason: "👇"

Code: _ => panic!("Unsupported config file extension"),
Location: ./libs/config/src/lib.rs:875

Reason: "👇"

Code: None => panic!("Config file has no extension"),
Location: ./libs/config/src/lib.rs:878

Crate: `common`

📊 Total Expected Usages: 1

expand details

Reason: "we're parsing a statically defined constant, we know it works ;)"

Code: .unwrap()
Location: ./libs/common/src/graphql.rs:31

Crate: `engine`

📊 Total Expected Usages: 2

expand details

Reason: "if we are unable to construct the endpoints and attach them onto the gateway's http server, we have to exit"

Code: Err(e) => panic!("failed to construct endpoint: {:?}", e),
Location: ./libs/engine/src/gateway.rs:158

Reason: "we can safely index here, it's inside a test with constant defined fixtures."

Code: ConductorGateway::execute(request, &gw.routes[0].route_data).await
Location: ./libs/engine/src/gateway.rs:190

Crate: `vrl`

📊 Total Expected Usages: 2

expand details

Reason: "if the provided VRL code in the config file can't compile, we have to exit."

Code: panic!("failed to compile vrl program");
Location: ./plugins/vrl/src/plugin.rs:129

Reason: "states is a non-user provided variable"

Code: .expect("can't merge states when states is an empty vector!")
Location: ./plugins/vrl/src/plugin.rs:146

Crate: `jwt_auth`

📊 Total Expected Usages: 1

expand details

Reason: "if initiating an http client fails, then we have to exit."

Code: let client = wasm_polyfills::create_http_client().build().unwrap();
Location: ./plugins/jwt_auth/src/jwks_provider.rs:49

Crate: `napi`

📊 Total Expected Usages: 1

expand details

Reason: "we need this"

Code: panic!("Exited process!")
Location: ./libs/napi/src/lib.rs:18

Crate: `conductor`

📊 Total Expected Usages: 2

expand details

Reason: "we need to exit the process, if the logger can't be correctly set."

Code: let _guard = tracing::subscriber::set_default(subscriber);
Location: ./bin/conductor/src/lib.rs:37

Reason: "we need to exit the process, if the provided configuration file is incorrect."

Code: panic!("Failed to initialize gateway: {:?}", e);
Location: ./bin/conductor/src/lib.rs:76

github-actions · 2024-10-03T21:23:36Z

🐋 This PR was built and pushed to the following Docker images:

Docker Bake metadata

{
"conductor": {
  "buildx.build.provenance": {
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/[email protected]?platform=linux%2Famd64",
        "digest": {
          "sha256": "a92ed51e0996d8e9de041ca05ce623d2c491444df6a535a566dabd5cb8336946"
        }
      },
      {
        "uri": "pkg:docker/[email protected]?platform=linux%2Famd64",
        "digest": {
          "sha256": "83101f6985c93e1e6501b3375de188ee3d2cbb89968bcc91611591f9f447bd42"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "Dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "label:org.opencontainers.image.authors": "The Guild <[email protected]>",
          "label:org.opencontainers.image.description": "Conductor is a robust GraphQL Gateway.",
          "label:org.opencontainers.image.docs": "https://the-guild.dev/graphql/gateway",
          "label:org.opencontainers.image.licenses": "MIT",
          "label:org.opencontainers.image.revision": "dcbbb60254d4195f860aa58682b3d1e58389081c",
          "label:org.opencontainers.image.source": "https://github.com/the-guild-org/conductor",
          "label:org.opencontainers.image.title": "Conductor",
          "label:org.opencontainers.image.url": "https://the-guild.dev/graphql/gateway",
          "label:org.opencontainers.image.vendor": "The Guild",
          "label:org.opencontainers.image.version": ""
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dockerfile"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64"
      }
    }
  },
  "buildx.build.ref": "builder-2b488ced-c818-450f-a6fe-d5befbe75c9b/builder-2b488ced-c818-450f-a6fe-d5befbe75c9b0/ah0dq04bzwzs9l2ofo3wbjs77",
  "containerimage.config.digest": "sha256:d2f7013269b784a3e57c963a632744db9562749880139e176188a7a161a6b8a3",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:64a19f7a8b04ed5ec9f74f14871b5f369799ccd63ae31afba45454ca59572de9",
    "size": 902,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:64a19f7a8b04ed5ec9f74f14871b5f369799ccd63ae31afba45454ca59572de9",
  "image.name": "ghcr.io/the-guild-org/conductor/conductor:dcbbb60254d4195f860aa58682b3d1e58389081c"
}
}

fix(deps): update rust crate async-graphql to v7.0.10 [security]

dcbbb60

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update rust crate async-graphql to v7.0.10 [security] #607

fix(deps): update rust crate async-graphql to v7.0.10 [security] #607

renovate bot commented Oct 3, 2024

github-actions bot commented Oct 3, 2024

github-actions bot commented Oct 3, 2024

fix(deps): update rust crate async-graphql to v7.0.10 [security] #607

Are you sure you want to change the base?

fix(deps): update rust crate async-graphql to v7.0.10 [security] #607

Conversation

renovate bot commented Oct 3, 2024

GitHub Vulnerability Alerts

CVE-2024-47614

Impact

Patches

Release Notes

v7.0.10

v7.0.9

v7.0.8

v7.0.7

v7.0.6

v7.0.5

Configuration

github-actions bot commented Oct 3, 2024

🚨 Rust Panic Audit: 342 Potential Panic Points Detected 🚨

Crate: ``

Crate: federation_query_planner

Crate: common

Crate: telemetry

Crate: cloudflare_worker

Crate: engine

Crate: tracing

Crate: conductor

Crate: config

📌 Expected Annotations

Crate: ``

Crate: cloudflare_worker

Crate: config

Crate: common

Crate: engine

Crate: vrl

Crate: jwt_auth

Crate: napi

Crate: conductor

github-actions bot commented Oct 3, 2024

`v7.0.10`

`v7.0.9`

`v7.0.8`

`v7.0.7`

`v7.0.6`

`v7.0.5`

Crate: `federation_query_planner`

Crate: `common`

Crate: `telemetry`

Crate: `cloudflare_worker`

Crate: `engine`

Crate: `tracing`

Crate: `conductor`

Crate: `config`

Crate: `cloudflare_worker`

Crate: `config`

Crate: `common`

Crate: `engine`

Crate: `vrl`

Crate: `jwt_auth`

Crate: `napi`

Crate: `conductor`