From be919bf786e8c31276bb6e845f2dbea72efd3f51 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Sat, 22 Aug 2026 22:08:46 +0200 Subject: [PATCH 1/4] Bump rusqlite to 0.34 for bundled SQLite 3.49.1 libsqlite3-sys 0.32.0 bundles SQLite 3.49.1, which fixes upstream CVE-2025-29030/-29031 present in the previously bundled 3.48.0. Relevant only to builds using the 'bundled' feature (storage/sqlite); not remotely exploitable (requires local crafted SQL/DB file). --- Cargo.lock | 8 ++++---- Cargo.toml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index b42075227..991720695 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4758,9 +4758,9 @@ dependencies = [ [[package]] name = "libsqlite3-sys" -version = "0.31.0" +version = "0.32.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ad8935b44e7c13394a179a438e0cebba0fe08fe01b54f152e29a93b5cf993fd4" +checksum = "fbb8270bb4060bd76c6e96f20c52d80620f1d82a3470885694e41e0f81ef6fe7" dependencies = [ "cc", "pkg-config", @@ -7555,9 +7555,9 @@ dependencies = [ [[package]] name = "rusqlite" -version = "0.33.0" +version = "0.34.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c6d5e5acb6f6129fe3f7ba0a7fc77bca1942cb568535e18e7bc40262baf3110" +checksum = "37e34486da88d8e051c7c0e23c3f15fd806ea8546260aa2fec247e97242ec143" dependencies = [ "bitflags 2.10.0", "fallible-iterator 0.3.0", diff --git a/Cargo.toml b/Cargo.toml index 441d12818..8dd68902a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -235,7 +235,7 @@ ripemd = "0.1" rlimit = "0.10" rstest = "0.24" rstest_reuse = "0.7" -rusqlite = "0.33" +rusqlite = "0.34" schnorrkel = "0.11" secp256k1 = { version = "0.29", default-features = false } semver = "1.0" From a554e079a4cb34be5af4502c2253d0e5f5daa2da Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Sat, 22 Aug 2026 22:08:47 +0200 Subject: [PATCH 2/4] Use POSIX mutexes for LMDB on macOS Darwin's default System V semaphore backend fails with EINVAL once a process holds locks on more than kern.sysv.semume (=10) semaphore sets concurrently, breaking workloads that open multiple DB environments in one process (e.g. the storage-lmdb test suite). Compile lmdb with MDB_USE_POSIX_MUTEX=1 on Apple targets via target- scoped CFLAGS in .cargo/config.toml; MDB_USE_ROBUST must be disabled because Darwin does not implement robust mutexes. Linux builds keep upstream defaults. --- .cargo/config.toml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.cargo/config.toml b/.cargo/config.toml index 019321653..10f638a32 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -11,3 +11,18 @@ linker = "aarch64-linux-gnu-gcc" [target.x86_64-pc-windows-msvc] rustflags = ["-C", "target-feature=+crt-static"] + +# Force lmdb-sys (lmdb-mintlayer fork) to use POSIX mutexes instead of System V +# semaphores on macOS. Darwin's default SysV backend fails with EINVAL once a +# process holds locks on more than `kern.sysv.semume` (=10) semaphore sets +# concurrently, which breaks any workload opening multiple DB environments in +# one process (e.g. the storage-lmdb test suite). +# +# MDB_USE_ROBUST must be 0 because Darwin does not implement robust mutexes +# (no PTHREAD_MUTEX_ROBUST); the cost is that a process crash while holding an +# env lock can leave other processes deadlocked on that environment. +# These flags are only applied when compiling FOR apple targets, so Linux/CI +# builds keep upstream defaults (robust glibc pthread mutexes). +[env] +CFLAGS_aarch64-apple-darwin = "-DMDB_USE_POSIX_MUTEX=1 -DMDB_USE_ROBUST=0" +CFLAGS_x86_64-apple-darwin = "-DMDB_USE_POSIX_MUTEX=1 -DMDB_USE_ROBUST=0" From f084e057d3824e4f08038065c77b5dffffb13bae Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Sat, 22 Aug 2026 22:41:20 +0200 Subject: [PATCH 3/4] Update h2 to 0.4.18 (RUSTSEC-2026-0258) --- Cargo.lock | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 991720695..3e12c336d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2862,7 +2862,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3298,7 +3298,7 @@ dependencies = [ "libc", "log", "rustversion", - "windows-link 0.2.1", + "windows-link 0.1.3", "windows-result 0.4.1", ] @@ -3515,9 +3515,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.13" +version = "0.4.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54" +checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228" dependencies = [ "atomic-waker", "bytes", @@ -3917,7 +3917,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.2", + "socket2 0.5.10", "system-configuration", "tokio", "tower-service", @@ -4354,7 +4354,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5583,7 +5583,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -7643,7 +7643,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.11.0", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -8835,7 +8835,7 @@ dependencies = [ "getrandom 0.4.1", "once_cell", "rustix 1.1.3", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -10637,7 +10637,7 @@ dependencies = [ "js-sys", "log", "naga", - "parking_lot 0.12.5", + "parking_lot 0.11.2", "profiling", "raw-window-handle", "smallvec", @@ -10665,7 +10665,7 @@ dependencies = [ "log", "naga", "once_cell", - "parking_lot 0.12.5", + "parking_lot 0.11.2", "profiling", "raw-window-handle", "rustc-hash 1.1.0", @@ -10707,7 +10707,7 @@ dependencies = [ "ndk-sys 0.5.0+25.2.9519653", "objc", "once_cell", - "parking_lot 0.12.5", + "parking_lot 0.11.2", "profiling", "range-alloc", "raw-window-handle", @@ -10771,7 +10771,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] From 668ef884eacd4b653cad84fc84ea26102d1d5c15 Mon Sep 17 00:00:00 2001 From: Enrico Rubboli Date: Sat, 22 Aug 2026 23:00:52 +0200 Subject: [PATCH 4/4] Update cargo-vet imports.lock for h2/rusqlite/libsqlite3-sys bumps --- supply-chain/imports.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 752f73594..a9f557036 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -665,8 +665,8 @@ user-id = 55123 user-login = "rust-lang-owner" [[publisher.h2]] -version = "0.4.13" -when = "2026-01-05" +version = "0.4.18" +when = "2026-08-20" user-id = 359 user-login = "seanmonstar" user-name = "Sean McArthur" @@ -954,8 +954,8 @@ user-id = 55123 user-login = "rust-lang-owner" [[publisher.libsqlite3-sys]] -version = "0.31.0" -when = "2025-01-19" +version = "0.32.0" +when = "2025-03-05" user-id = 5062 user-login = "gwenn" user-name = "gwenn" @@ -1380,8 +1380,8 @@ user-login = "yoshuawuyts" user-name = "Yosh" [[publisher.rusqlite]] -version = "0.33.0" -when = "2025-01-19" +version = "0.34.0" +when = "2025-03-05" user-id = 5062 user-login = "gwenn" user-name = "gwenn"