mirror of
https://github.com/ankitects/anki.git
synced 2026-09-10 06:20:47 -04:00
a306f84ccc
## Linked issue (required) Fixes #5364 ## Summary / motivation (required) CI (`check (linux)` → `Run cargo-deny check`) started failing on [RUSTSEC-2026-0258](https://rustsec.org/advisories/RUSTSEC-2026-0258) — "h2 unbounded empty DATA frames". No code change of ours introduced it: cargo-deny fetches the advisory DB at run time, so the same commit began failing once the advisory was published (2026-08-19). Two vulnerable `h2` copies were in the tree: - `h2 0.4.12` — the shipped stack (`hyper 1.x`). Bumped to the patched `0.4.17`. - `h2 0.3.27` — pulled in **only** by the internal `linkchecker` dev tool, via `linkcheck → reqwest 0.11 → hyper 0.14 → h2 0.3`. The `h2 0.3` series has **no fix** (patched only in `>= 0.4.16`). As #5364 anticipated, the fix is to move our `linkcheck` fork off `reqwest 0.11`. `ankitects/linkcheck` was bumped to `reqwest 0.12` / `http 1` (no source changes required — the APIs used are unchanged), and this PR pins `linkcheck` to the new `anchors` tip. That removes the old subtree at the root instead of suppressing the advisory via a `deny.toml` ignore (which would also force an explicit license allow-list on the project, since cargo-deny switches to strict license checking once a config file exists). ## Steps to reproduce (required, use N/A if not applicable) 1. Check out `main` at any recent commit. 2. Run `cargo deny check` (or push and let `check (linux)` run in CI). 3. It fails with `error[vulnerability]: h2 unbounded empty DATA frames` (RUSTSEC-2026-0258) for both `h2 0.3.27` and `h2 0.4.12`. ## How to test (required) ### Details - `cargo deny check` → `advisories ok, bans ok, licenses ok, sources ok`. - `cargo build -p linkchecker` succeeds against the updated `linkcheck`. - Full `just check` (`./ninja check`) passes, including `check:minilints` (`cargo/licenses.json` regenerated for the updated tree). ## Before / after behavior **Before**: `cargo deny check` fails on RUSTSEC-2026-0258 (two `h2` copies), breaking CI. **After**: `h2` resolves to a single patched `0.4.17`; the `reqwest 0.11` subtree is gone; cargo-deny is clean. ## Risk / compatibility / migration Low. Dependency-only change. `linkcheck` (used only by the `linkchecker` test tool) now builds on `reqwest 0.12` / `http 1`, which the rest of the workspace already uses; `Cargo.lock` shrinks as the duplicate old subtree is dropped.
This folder contains:
- a list of Rust crate licenses, which is checked/updated with ./ninja [check|fix]:minilints
- a nightly toolchain definition for formatting