mirrors/arti.git/Cargo.lock, branch main mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=main 2026-08-19T20:57:28Z Merge branch 'otel-out-of-arti' into 'main' 2026-08-19T20:57:28Z wesleyac wesleyac@torproject.org 2026-08-19T20:57:28Z urn:sha1:0a846fdf984b31725c8b9c6a390048fb484af3d4 Split OTLP exporter into separate crate. Closes #2611 See merge request tpo/core/arti!4297 maint/cargo-audit: Bump h2 to address RUSTSEC-2026-0258 2026-08-18T13:11:02Z Gabriela Moldovan gabi@torproject.org 2026-08-18T13:11:00Z urn:sha1:2a13c4368b57b9042001c59449ea7118ec619762 Older versions of `h2` have a bug that causes empty HTTP/2 DATA frames to be queued without limit if the streams are not read from quickly enough. According to the [hyper advisory]: > To determine if vulnerable, all these things must be true: > > * You are using HTTP/2, either as a server or a client. > * Your application does not fully drain incoming request > or response bodies (for example, a proxy applying backpressure, > or a client that delays reading the body). > * The direct remote peer is malicious and intentionally > sends large numbers of empty DATA frames. To my knowledge, the only non-example crates that use `hyper` are `arti` and `tor-dirserver`. Both of them run HTTP/1.1 servers, so I don't believe we're affected by the `h2` bug. [hyper advisory]: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h Fix many review comments. 2026-08-17T20:39:56Z Wesley Aptekar-Cassels me@wesleyac.com 2026-08-17T20:39:56Z urn:sha1:96760875d9800fa3849cf3f455cdee3d06f955f3 Mostly relating to typos and dependencies. Merge branch 'dir-cache-kludge' into 'main' 2026-08-11T16:32:17Z Nick Mathewson nickm@torproject.org 2026-08-11T16:32:17Z urn:sha1:828665cfdb289e8ea3b0f03b8e425f571c74a132 Implement kludge to allow use of DirMgr as a backend for DirServer. See merge request tpo/core/arti!4298 dirmgr: Provide a DirPlugin to temporarily pose as a directory cache 2026-08-11T16:08:32Z Nick Mathewson nickm@torproject.org 2026-08-10T16:50:58Z urn:sha1:a64416ec1782ace0878b5d2a6f3929acfb13401d Part of #2657 tor-dirserver: Remove getters from database.rs 2026-08-11T13:58:58Z Clara Engler cve@cve.cx 2026-08-11T13:58:36Z urn:sha1:ec0b69d3fca203dbbfe1751679230cb80684493b This commit removes the getters in database.rs. If the overall tor-netdoc refactoring has taught us something, then that the use of getters can be quite annoying. Therefore, this commit removes the getters and marks the respective fields as pub. Given that these data types are pub(crate) only right now, it does not matter a lot anyways. Fix cyclic dependency issues. 2026-08-10T20:34:41Z Wesley Aptekar-Cassels me@wesleyac.com 2026-08-10T16:42:11Z urn:sha1:a60eb22ae8fd311a5bcb68cb1304e6bf16f794d9 dircommon: Add trait to use DirMgr as a temporary plugin 2026-08-10T17:18:51Z Nick Mathewson nickm@torproject.org 2026-08-10T15:10:41Z urn:sha1:89d7a63aab58a7b9e2e2166a300f59e1a98a70d1 This is part of #2657. The goal here is to use DirMgr as a temporary backend for tor-dirserver, so that we can have a sort-of-working directory cache that can be used for testing guards before tor-dirserver is complete. tor-config-shared: Stop using Option<Duration>. 2026-08-10T15:44:31Z Wesley Aptekar-Cassels me@wesleyac.com 2026-08-10T15:30:35Z urn:sha1:97eb9c822db2e0396c5369ae8050463b2aa94ac7 Add new tor-conig-shared crate. 2026-08-10T15:44:29Z Wesley Aptekar-Cassels me@wesleyac.com 2026-08-03T20:13:05Z urn:sha1:7eebb40491b2ae959f6227a37754ce8a81957f99 This contains configuration types that are shared between arti and arti-rely.