run: Process::new() should take &[Str] instead of &[~str] for args#8203
run: Process::new() should take &[Str] instead of &[~str] for args#8203lilyball wants to merge 1 commit into
Conversation
|
@graydon: Upon thinking more about the ugly code in Alternatively I could reimplement Thoughts? |
|
@graydon: I deleted your r+ comment due to the above issue. |
|
@graydon: r? I fixed |
|
Needs a rebase. Otherwise r=me, yeah. This is something I thought wouldn't be a problem at first since you were asking about a code change when the incoming values were all |
|
r? @graydon |
The method .into_owned() is meant to be used as an optimization when you need to get a ~str from a Str, but don't want to unnecessarily copy it if it's already a ~str. This is meant to ease functions that look like fn foo<S: Str>(strs: &[S]) Previously they could work with the strings as slices using .as_slice(), but producing ~str required copying the string, even if the vector turned out be a &[~str] already. I don't have any concrete uses for this yet, since the one conversion I've done to `&[S]` so far (see PR #8203) didn't actually need owned strings. But having this here may make using `Str` more attractive. It also may be worth adding an `into_managed()` function, but that one is less obviously useful than `into_owned()`.
|
The bad news is that we just (today) agreed to take the patch that removes the trailing nulls from slices and sets their length back to always cover only valid chars. This means that (a) you'll always need to copy and (b) if you use that probe-one-past-the-end code you copied and pasted in here, it'll start causing memory faults. Sorry about this mess. Confusion around the trailing nulls is exactly the thing we are trying to get rid of, by removing the feature. |
|
Holding this patch until #8296 lands, at which point I will rewrite this on top of it. |
|
@graydon There was one error in librust, which I didn't catch because I only ran the libstd tests instead of doing a full build. My bad. r? |
|
Rebased yet again. |
|
@kballard Needs rebase (and the test failure may be legitimate, I'm not sure) |
|
Rebased. Don't understand the test failures though. Nothing I did should affect Windows linkage, or should add calls to Windows functions that weren't previously used. |
|
I have no idea what's causing the Windows failures: |
|
The referenced calls are all used in |
|
@kballard Needs a rebase in any case. |
|
@catamorphism I can rebase it yet again, but that won't solve the windows problem. My best guess right now is that there's something going on here where the fact that it's generic means that libstd isn't actually linking against the FFI functions (because it contains the AST for the function instead of the actual compiled executable code), and then when libextra tries to call it, it hits the undefined symbols. |
|
It appears that process spawning has changed significantly. I'm going to re-write this PR on top of the new approach, but I don't know if the Windows issue will continue to happen. I wish I had some way of testing without going through the full r+ process. |
|
Looks like the new approach no longer defines the Windows FFI functions as part of the process stuff, instead relying on libuv to deal with it, so I hope that means it won't happen again. |
|
I have a rewritten version now that passes the stage2 libstd tests, but I'm running |
|
Don't review yet. Pushing here because I'm having a compilation issue. |
|
Ok this new commit passes |
|
r? |
|
@alexcrichton Why was it reverted? Was that the source of the crashes on the builders? Anyway, going back to the previous implementation of this is just going to bring back the Windows test failures. My guess right now is there's a problem with declaring extern fns inside a generic fn. I could try refactoring those declarations to be outside the generic fn, but I have no way of test Windows short of going through the whole r+ -> full make check process again. |
|
It was both the source of a massive regression on windows and I also suspect that it was causing all the segfaults. For you extern fn inside a generic fn problem, I'd be interested in seeing if #8843 fixes that issue. |
|
Rebased. This presumably is going to require #8843 to work on Windows though. |
|
@huonw Great. This can be reviewed again now. |
|
Damn. #8843 didn't fix it. |
|
Closing due to lack of activity. Please reopen a new pull request if you get the chance to work on this more -- thanks! |
|
It seems #9055 may be the cause of the Windows errors. |
New lint: `iter_overeager_cloned` Closes rust-lang#8202 changelog: New lint: [`iter_overeager_cloned`]
…kout-6.x, r=marcoieni Update actions/checkout action to v6 This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5` → `v6.0.3` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2439](https://redirect.github.com/actions/checkout/pull/2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2414](https://redirect.github.com/actions/checkout/pull/2414) ### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2356](https://redirect.github.com/actions/checkout/pull/2356) ### [`v6.0.1`](https://redirect.github.com/actions/checkout/compare/v6.0.0...v6.0.1) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1) ### [`v6.0.0`](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6.0.0) [Compare Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6) ### [`v5.0.1`](https://redirect.github.com/actions/checkout/releases/tag/v5.0.1) [Compare Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1) ##### What's Changed - Port v6 cleanup to v5 by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2301](https://redirect.github.com/actions/checkout/pull/2301) **Full Changelog**: <actions/checkout@v5...v5.0.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…load-artifact-8.x, r=Mark-Simulacrum Update actions/download-artifact action to v8.0.1 This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8` → `v8.0.1` | --- ### Release Notes <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1) #### What's Changed - Support for CJK characters in the artifact name by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;471](https://redirect.github.com/actions/download-artifact/pull/471) - Add a regression test for artifact name + content-type mismatches by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;472](https://redirect.github.com/actions/download-artifact/pull/472) **Full Changelog**: <actions/download-artifact@v8...v8.0.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…load-artifact-8.x, r=Mark-Simulacrum Update actions/download-artifact action to v8.0.1 This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8` → `v8.0.1` | --- ### Release Notes <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1) #### What's Changed - Support for CJK characters in the artifact name by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;471](https://redirect.github.com/actions/download-artifact/pull/471) - Add a regression test for artifact name + content-type mismatches by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;472](https://redirect.github.com/actions/download-artifact/pull/472) **Full Changelog**: <actions/download-artifact@v8...v8.0.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Rollup merge of #158108 - renovate-bot:renovate/actions-download-artifact-8.x, r=Mark-Simulacrum Update actions/download-artifact action to v8.0.1 This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8` → `v8.0.1` | --- ### Release Notes <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1) #### What's Changed - Support for CJK characters in the artifact name by [@​danwkennedy](https://redirect.github.com/danwkennedy) in [#​471](https://redirect.github.com/actions/download-artifact/pull/471) - Add a regression test for artifact name + content-type mismatches by [@​danwkennedy](https://redirect.github.com/danwkennedy) in [#​472](https://redirect.github.com/actions/download-artifact/pull/472) **Full Changelog**: <actions/download-artifact@v8...v8.0.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…ulnerability, r=jieyouxu Update Rust crate rand to v0.9.3 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dependencies | patch | `0.9.2` → `0.9.3` | | [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dev-dependencies | patch | `0.9.2` → `0.9.3` | --- ### Rand is unsound with a custom logger using rand::rng() [GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) <details> <summary>More information</summary> #### Details It has been reported (by @&rust-lang#8203;lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met: - The `log` and `thread_rng` features are enabled - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng` - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data) - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict. #### Severity Low #### References - [https://github.com/rust-random/rand/pull/1763](https://redirect.github.com/rust-random/rand/pull/1763) - [https://rustsec.org/advisories/RUSTSEC-2026-0097.html](https://rustsec.org/advisories/RUSTSEC-2026-0097.html) - [https://github.com/advisories/GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>rust-random/rand (rand)</summary> ### [`v0.9.3`](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3) [Compare Source](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…lnerability, r=jieyouxu Update Rust crate tar to v0.4.46 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tar](https://redirect.github.com/composefs/tar-rs) | dependencies | patch | `0.4.45` → `0.4.46` | --- ### tar has a PAX header desynchronization issue [GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) <details> <summary>More information</summary> #### Details ##### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`. [Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the "pax Header Block" section for the specific prescription there. As a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header's `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers. ##### PoC [This tar](https://redirect.github.com/user-attachments/files/27141941/pax-overrides-extension-header.tar.zip) (zipped for size) demonstrates the desynchronization: with `tar tvf`: ``` % tar tvf tests/archives/pax-overrides-extension-header.tar ---------- 0 0 0 2048 Dec 31 1969 longname.txt ---------- 0 0 0 0 Dec 31 1969 file_b ``` with `tar-rs`: ``` ---- pax_size_does_not_apply_to_extension_headers stdout ---- thread 'pax_size_does_not_apply_to_extension_headers' (250476889) panicked at tests/all.rs:2121:27: called `Result::unwrap()` on an `Err` value: Custom { kind: Other, error: "numeric field was not a number: AAAAAAAA when getting cksum for AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace ``` In the above case, the PoC is not weaponized, so it jumps into the middle of an entry and subsequently fails the checksum test rather than silently continuing with attacker-controlled archive state. ##### Impact This is very similar to GHSA-j5gw-2vrg-8fgx and GHSA-fp55-jw48-c537 in impact -- an attacker can use this to extract (or not extract) files from a tar stream depending on the tar parser used, which in turn can be used to obscure the presence of malicious files. #### Severity Medium #### References - [https://github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2) - [https://github.com/composefs/tar-rs/pull/454](https://redirect.github.com/composefs/tar-rs/pull/454) - [https://github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838](https://redirect.github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838) - [https://github.com/composefs/tar-rs/releases/tag/0.4.46](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46) - [https://github.com/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>composefs/tar-rs (tar)</summary> ### [`v0.4.46`](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46) [Compare Source](https://redirect.github.com/composefs/tar-rs/compare/0.4.45...0.4.46) #### Security - archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;454](https://redirect.github.com/composefs/tar-rs/pull/454) See also <GHSA-3cv2-h65g-fgmm> #### Other changes - ci: Fix and re-enable reverse dependency testing by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;444](https://redirect.github.com/composefs/tar-rs/pull/444) - Update astral-tokio-tar requirement from 0.5 to 0.6 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446) - Update some links by [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445) - Add support of absolute paths by [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426) - docs: Expand notes on concurrent mutations and following symlinks by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;453](https://redirect.github.com/composefs/tar-rs/pull/453) - Update repo links by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;451](https://redirect.github.com/composefs/tar-rs/pull/451) - ci: Add crates.io trusted publishing workflow by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;456](https://redirect.github.com/composefs/tar-rs/pull/456) - Release 0.4.46 by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;455](https://redirect.github.com/composefs/tar-rs/pull/455) #### New Contributors - [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] made their first contribution in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446) - [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) made their first contribution in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445) - [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) made their first contribution in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426) **Full Changelog**: <composefs/tar-rs@0.4.45...0.4.46> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…g-subscriber-vulnerability, r=jieyouxu Update Rust crate tracing-subscriber [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` | --- ### Tracing logging user input may result in poisoning logs with ANSI escape sequences [CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) <details> <summary>More information</summary> #### Details ##### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator. ##### Patches `tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal. ##### Workarounds Avoid printing logs to terminal emulators without escaping ANSI control sequences. ##### References https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/ ##### Acknowledgments We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`. If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) - [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html) - [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>tokio-rs/tracing (tracing-subscriber)</summary> ### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22) ##### Important The previous release [0.3.21] was yanked as it depended explicitly on [tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang#8203;3424] for details). This release contains all the changes from the previous release, plus an update to the newer version of `tracing`. ##### Changed - `tracing`: updated to 0.1.43 ([#&rust-lang#8203;3427]) [#&rust-lang#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424 [#&rust-lang#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427 [0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21 [tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42 ### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21) ##### Fixed - Change registry exit to decrement local span ref only ([#&rust-lang#8203;3331]) - Make Layered propagate `on_register_dispatch` ([#&rust-lang#8203;3379]) ##### Changed - `tracing`: updated to 0.1.42 ([#&rust-lang#8203;3418]) ##### Performance - Remove `clone_span` on enter ([#&rust-lang#8203;3289]) ##### Documented - Fix a few small things in the format module ([#&rust-lang#8203;3339]) - Fix extra closing brace in layer docs ([#&rust-lang#8203;3350]) - Fix link in `FmtSpan` docs ([#&rust-lang#8203;3411]) [#&rust-lang#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289 [#&rust-lang#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331 [#&rust-lang#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339 [#&rust-lang#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350 [#&rust-lang#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379 [#&rust-lang#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411 [#&rust-lang#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…-actions, r=jieyouxu Update actions/checkout action to v7 This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@&rust-lang#8203;actions/core](https://redirect.github.com/actions/core) and [@&rust-lang#8203;actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2462](https://redirect.github.com/actions/checkout/pull/2462) ### [`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2439](https://redirect.github.com/actions/checkout/pull/2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2414](https://redirect.github.com/actions/checkout/pull/2414) ### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2356](https://redirect.github.com/actions/checkout/pull/2356) ### [`v6.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2327](https://redirect.github.com/actions/checkout/pull/2327) ### [`v6.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6) - Persist creds to a separate file by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2286](https://redirect.github.com/actions/checkout/pull/2286) - Update README to include Node.js 24 support details and requirements by [@&rust-lang#8203;salmanmkc](https://redirect.github.com/salmanmkc) in [#&rust-lang#8203;2248](https://redirect.github.com/actions/checkout/pull/2248) ### [`v5.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1) - Port v6 cleanup to v5 by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2301](https://redirect.github.com/actions/checkout/pull/2301) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…ulnerability, r=jieyouxu Update Rust crate rand to v0.9.3 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dependencies | patch | `0.9.2` → `0.9.3` | | [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dev-dependencies | patch | `0.9.2` → `0.9.3` | --- ### Rand is unsound with a custom logger using rand::rng() [GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) <details> <summary>More information</summary> #### Details It has been reported (by @&rust-lang#8203;lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met: - The `log` and `thread_rng` features are enabled - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng` - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data) - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict. #### Severity Low #### References - [https://github.com/rust-random/rand/pull/1763](https://redirect.github.com/rust-random/rand/pull/1763) - [https://rustsec.org/advisories/RUSTSEC-2026-0097.html](https://rustsec.org/advisories/RUSTSEC-2026-0097.html) - [https://github.com/advisories/GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>rust-random/rand (rand)</summary> ### [`v0.9.3`](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3) [Compare Source](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…lnerability, r=jieyouxu Update Rust crate tar to v0.4.46 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tar](https://redirect.github.com/composefs/tar-rs) | dependencies | patch | `0.4.45` → `0.4.46` | --- ### tar has a PAX header desynchronization issue [GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) <details> <summary>More information</summary> #### Details ##### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`. [Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the "pax Header Block" section for the specific prescription there. As a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header's `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers. ##### PoC [This tar](https://redirect.github.com/user-attachments/files/27141941/pax-overrides-extension-header.tar.zip) (zipped for size) demonstrates the desynchronization: with `tar tvf`: ``` % tar tvf tests/archives/pax-overrides-extension-header.tar ---------- 0 0 0 2048 Dec 31 1969 longname.txt ---------- 0 0 0 0 Dec 31 1969 file_b ``` with `tar-rs`: ``` ---- pax_size_does_not_apply_to_extension_headers stdout ---- thread 'pax_size_does_not_apply_to_extension_headers' (250476889) panicked at tests/all.rs:2121:27: called `Result::unwrap()` on an `Err` value: Custom { kind: Other, error: "numeric field was not a number: AAAAAAAA when getting cksum for AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" } note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace ``` In the above case, the PoC is not weaponized, so it jumps into the middle of an entry and subsequently fails the checksum test rather than silently continuing with attacker-controlled archive state. ##### Impact This is very similar to GHSA-j5gw-2vrg-8fgx and GHSA-fp55-jw48-c537 in impact -- an attacker can use this to extract (or not extract) files from a tar stream depending on the tar parser used, which in turn can be used to obscure the presence of malicious files. #### Severity Medium #### References - [https://github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2) - [https://github.com/composefs/tar-rs/pull/454](https://redirect.github.com/composefs/tar-rs/pull/454) - [https://github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838](https://redirect.github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838) - [https://github.com/composefs/tar-rs/releases/tag/0.4.46](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46) - [https://github.com/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>composefs/tar-rs (tar)</summary> ### [`v0.4.46`](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46) [Compare Source](https://redirect.github.com/composefs/tar-rs/compare/0.4.45...0.4.46) #### Security - archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;454](https://redirect.github.com/composefs/tar-rs/pull/454) See also <GHSA-3cv2-h65g-fgmm> #### Other changes - ci: Fix and re-enable reverse dependency testing by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;444](https://redirect.github.com/composefs/tar-rs/pull/444) - Update astral-tokio-tar requirement from 0.5 to 0.6 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446) - Update some links by [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445) - Add support of absolute paths by [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426) - docs: Expand notes on concurrent mutations and following symlinks by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;453](https://redirect.github.com/composefs/tar-rs/pull/453) - Update repo links by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;451](https://redirect.github.com/composefs/tar-rs/pull/451) - ci: Add crates.io trusted publishing workflow by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;456](https://redirect.github.com/composefs/tar-rs/pull/456) - Release 0.4.46 by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;455](https://redirect.github.com/composefs/tar-rs/pull/455) #### New Contributors - [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] made their first contribution in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446) - [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) made their first contribution in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445) - [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) made their first contribution in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426) **Full Changelog**: <composefs/tar-rs@0.4.45...0.4.46> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…g-subscriber-vulnerability, r=jieyouxu Update Rust crate tracing-subscriber [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` | --- ### Tracing logging user input may result in poisoning logs with ANSI escape sequences [CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) <details> <summary>More information</summary> #### Details ##### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator. ##### Patches `tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal. ##### Workarounds Avoid printing logs to terminal emulators without escaping ANSI control sequences. ##### References https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/ ##### Acknowledgments We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`. If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) - [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html) - [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>tokio-rs/tracing (tracing-subscriber)</summary> ### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22) ##### Important The previous release [0.3.21] was yanked as it depended explicitly on [tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang#8203;3424] for details). This release contains all the changes from the previous release, plus an update to the newer version of `tracing`. ##### Changed - `tracing`: updated to 0.1.43 ([#&rust-lang#8203;3427]) [#&rust-lang#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424 [#&rust-lang#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427 [0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21 [tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42 ### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21) ##### Fixed - Change registry exit to decrement local span ref only ([#&rust-lang#8203;3331]) - Make Layered propagate `on_register_dispatch` ([#&rust-lang#8203;3379]) ##### Changed - `tracing`: updated to 0.1.42 ([#&rust-lang#8203;3418]) ##### Performance - Remove `clone_span` on enter ([#&rust-lang#8203;3289]) ##### Documented - Fix a few small things in the format module ([#&rust-lang#8203;3339]) - Fix extra closing brace in layer docs ([#&rust-lang#8203;3350]) - Fix link in `FmtSpan` docs ([#&rust-lang#8203;3411]) [#&rust-lang#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289 [#&rust-lang#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331 [#&rust-lang#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339 [#&rust-lang#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350 [#&rust-lang#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379 [#&rust-lang#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411 [#&rust-lang#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…-actions, r=jieyouxu Update actions/checkout action to v7 This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@&rust-lang#8203;actions/core](https://redirect.github.com/actions/core) and [@&rust-lang#8203;actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2462](https://redirect.github.com/actions/checkout/pull/2462) ### [`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2439](https://redirect.github.com/actions/checkout/pull/2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2414](https://redirect.github.com/actions/checkout/pull/2414) ### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2356](https://redirect.github.com/actions/checkout/pull/2356) ### [`v6.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2327](https://redirect.github.com/actions/checkout/pull/2327) ### [`v6.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6) - Persist creds to a separate file by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2286](https://redirect.github.com/actions/checkout/pull/2286) - Update README to include Node.js 24 support details and requirements by [@&rust-lang#8203;salmanmkc](https://redirect.github.com/salmanmkc) in [#&rust-lang#8203;2248](https://redirect.github.com/actions/checkout/pull/2248) ### [`v5.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1) - Port v6 cleanup to v5 by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2301](https://redirect.github.com/actions/checkout/pull/2301) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…ity, r=jieyouxu Update Rust crate rand to v0.9.3 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dependencies | patch | `0.9.2` → `0.9.3` | | [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dev-dependencies | patch | `0.9.2` → `0.9.3` | --- ### Rand is unsound with a custom logger using rand::rng() [GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) <details> <summary>More information</summary> #### Details It has been reported (by @&rust-lang/rust#8203;lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met: - The `log` and `thread_rng` features are enabled - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng` - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data) - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict. #### Severity Low #### References - [https://github.com/rust-random/rand/pull/1763](https://redirect.github.com/rust-random/rand/pull/1763) - [https://rustsec.org/advisories/RUSTSEC-2026-0097.html](https://rustsec.org/advisories/RUSTSEC-2026-0097.html) - [https://github.com/advisories/GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>rust-random/rand (rand)</summary> ### [`v0.9.3`](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3) [Compare Source](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
…ber-vulnerability, r=jieyouxu Update Rust crate tracing-subscriber [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` | --- ### Tracing logging user input may result in poisoning logs with ANSI escape sequences [CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) <details> <summary>More information</summary> #### Details ##### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator. ##### Patches `tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal. ##### Workarounds Avoid printing logs to terminal emulators without escaping ANSI control sequences. ##### References https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/ ##### Acknowledgments We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`. If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) - [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html) - [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>tokio-rs/tracing (tracing-subscriber)</summary> ### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22) ##### Important The previous release [0.3.21] was yanked as it depended explicitly on [tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang/rust#8203;3424] for details). This release contains all the changes from the previous release, plus an update to the newer version of `tracing`. ##### Changed - `tracing`: updated to 0.1.43 ([#&rust-lang/rust#8203;3427]) [#&rust-lang/rust#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424 [#&rust-lang/rust#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427 [0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21 [tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42 ### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21) ##### Fixed - Change registry exit to decrement local span ref only ([#&rust-lang/rust#8203;3331]) - Make Layered propagate `on_register_dispatch` ([#&rust-lang/rust#8203;3379]) ##### Changed - `tracing`: updated to 0.1.42 ([#&rust-lang/rust#8203;3418]) ##### Performance - Remove `clone_span` on enter ([#&rust-lang/rust#8203;3289]) ##### Documented - Fix a few small things in the format module ([#&rust-lang/rust#8203;3339]) - Fix extra closing brace in layer docs ([#&rust-lang/rust#8203;3350]) - Fix link in `FmtSpan` docs ([#&rust-lang/rust#8203;3411]) [#&rust-lang/rust#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289 [#&rust-lang/rust#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331 [#&rust-lang/rust#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339 [#&rust-lang/rust#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350 [#&rust-lang/rust#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379 [#&rust-lang/rust#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411 [#&rust-lang/rust#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Fixes #7928.
As a side-effect, this no longer clones all the arg strings on unix.