Repository navigation
chore(deps): move tokio to 1.53.3 for RUSTSEC-2026-0386 - #57
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Comment |
Tiny Sweeper reviewReviewed head: Verdict: Ready for maintainer review · Priority: none Diagnostics and supporting detailsFull summaryPull request purpose (title): chore(deps): move tokio to 1.53.3 for RUSTSEC-2026-0386. Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. Review snapshot
Completeness: Complete FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Before mergeNone. Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
Moves the root
Cargo.lockfrom tokio 1.53.1 to 1.53.3, the first patched release for RUSTSEC-2026-0386 (AsyncFdconstructors violate I/O safety). The advisory turns the supply-chain check red.Two lines change: the version and its crates.io checksum. tokio 1.53.3 declares the same dependencies and features as 1.53.1 in the crates.io index, so nothing else in the lock moves.
crates/tinyvoice-module/Cargo.lockalready resolves tokio 1.54.0, which is patched, andcrates/tinyvoice-hotkey-win/Cargo.lockhas no tokio.This lands before the v0.4.0 tag.