mirror of
https://github.com/mountain-loop/yaak.git
synced 2026-11-13 12:13:42 +01:00
Gregory SchierandClaude Opus 5.5
479a2af6c3
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It reaches Yaak through the bundled Node (`yaaknode`, used by plugins) and through the pure-Rust `brotli-decompressor` that yaak-http uses to decode `br` responses. - Bump the plugin runtime Node from 24.11.1 to 24.22.2 and update the vendoring script's SHA256 pins from the signed SHASUMS256.txt. - Move yaak-http from `brotli = "8"` to `brotli = "9"`, locking brotli 9.1.1 and brotli-decompressor 6.2.0. - Bump compression-codecs 0.4.43 -> 0.4.45 (as on main) so async-compression's streaming decoder also uses brotli 9.1.1. Tauri's pinned git rev still pulls brotli 8.0.1 and brotli-decompressor 5.0.0 for its embedded-asset compression; that needs a Tauri bump. (cherry picked from commit 39ff1351) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.2 KiB
TOML
44 lines
1.2 KiB
TOML
[package]
|
|
name = "yaak-http"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
publish = false
|
|
|
|
[dependencies]
|
|
async-compression = { version = "0.4", features = ["tokio", "gzip", "deflate", "brotli", "zstd"] }
|
|
async-trait = "0.1"
|
|
brotli = "9"
|
|
bytes = "1.11.1"
|
|
cookie = "0.18.1"
|
|
flate2 = "1"
|
|
futures-util = "0.3"
|
|
http-body = "1"
|
|
url = "2"
|
|
zstd = "0.13"
|
|
hyper-util = { version = "0.1.17", default-features = false, features = ["client-legacy"] }
|
|
log = { workspace = true }
|
|
mime_guess = "2.0.5"
|
|
native-tls = { version = "0.2", features = ["alpn"] }
|
|
reqwest = { workspace = true, features = [
|
|
"rustls-no-provider",
|
|
"native-tls",
|
|
"socks",
|
|
"http2",
|
|
"stream",
|
|
] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt", "fs", "io-util"] }
|
|
tokio-util = { version = "0.7", features = ["codec", "io", "io-util"] }
|
|
tower-service = "0.3.3"
|
|
urlencoding = "2.1.3"
|
|
yaak-common = { workspace = true }
|
|
yaak-models = { workspace = true }
|
|
yaak-templates = { workspace = true }
|
|
yaak-tls = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
tokio = { workspace = true, features = ["net"] }
|