Skip to content

Update rustc crate rkyv to 0.8.18 - #160807

Merged
rust-bors[bot] merged 1 commit into
rust-lang:mainfrom
rperier:bump_rkyv_security_issues
Aug 10, 2026
Merged

Update rustc crate rkyv to 0.8.18#160807
rust-bors[bot] merged 1 commit into
rust-lang:mainfrom
rperier:bump_rkyv_security_issues

Conversation

@rperier

@rperier rperier commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

See
https://rustsec.org/advisories/RUSTSEC-2026-0233
https://rustsec.org/advisories/RUSTSEC-2026-0234
https://rustsec.org/advisories/RUSTSEC-2026-0235

  • I did not use an LLM to create a change in this PR.
  • I used an LLM to create a change in this PR, and I have explained below how it was used.

@rperier
Update rustc crate rkyv to 0.8.18 [SECURITY]
7ee723b 
This fixes RUSTSEC-2026-0233, RUSTSEC-2026-0234 and RUSTSEC-2026-0235.
@rustbot

rustbot commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

These commits modify the Cargo.lock file. Unintentional changes to Cargo.lock can be introduced when switching branches and rebasing PRs.

If this was unintentional then you should revert the changes before this PR is merged.
Otherwise, you can ignore this comment.

@rustbot rustbot added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Aug 9, 2026
@rustbot

rustbot commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

  • Owners of files modified in this PR: @Mark-Simulacrum

@Mark-Simulacrum Mark-Simulacrum changed the title Update rustc crate rkyv to 0.8.18 [SECURITY] Update rustc crate rkyv to 0.8.18 Aug 9, 2026
@Mark-Simulacrum

Mark-Simulacrum commented Aug 9, 2026

Copy link
Copy Markdown
Member

I suspect you're emulating the renovatebot style of including "[SECURITY]", but please don't do that. If this is genuinely a security issue some discussion of actual impact would be warranted and likely coordination with our security team (per policy) -- which doesn't appear to have happened here.

I'll r+ this anyway since it looks OK to me though.

@bors r+

@rust-bors

rust-bors Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

📌 Commit 7ee723b has been approved by Mark-Simulacrum

It is now in the queue for this repository.

@rust-bors rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 9, 2026
jhpratt added a commit to jhpratt/rust that referenced this pull request Aug 9, 2026
@jhpratt
Rollup merge of rust-lang#160807 - rperier:bump_rkyv_security_issues,…
1fca5fc 
… r=Mark-Simulacrum

Update rustc crate rkyv to 0.8.18

See
https://rustsec.org/advisories/RUSTSEC-2026-0233
https://rustsec.org/advisories/RUSTSEC-2026-0234
https://rustsec.org/advisories/RUSTSEC-2026-0235
@jhpratt jhpratt mentioned this pull request Aug 9, 2026
Closed
rust-bors Bot pushed a commit that referenced this pull request Aug 10, 2026
@bors
Auto merge of #160823 - jhpratt:rollup-UYV9Lg9, r=jhpratt
ae22f5b 
Rollup of 7 pull requests

Successful merges:

 - #160533 (dirfd dir operations (3/4))
 - #160675 (bootstrap: Remove `PATH_REMAP` from command-line selector handling )
 - #160807 (Update rustc crate rkyv to 0.8.18)
 - #160560 (Add nightly-only support for Cargo unremap trim-paths files in `rust-gdb`)
 - #160804 (Change .expect message on net/parser to follow precondition style)
 - #160805 (`extern "custom"`: add tests)
 - #160816 (Mark const ptr methods and free functions as inline(always) to match *mut)
@jhpratt jhpratt mentioned this pull request Aug 10, 2026
Merged
@rperier

rperier commented Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

I suspect you're emulating the renovatebot style of including "[SECURITY]", but please don't do that. If this is genuinely a security issue some discussion of actual impact would be warranted and likely coordination with our security team (per policy) -- which doesn't appear to have happened here.

I'll r+ this anyway since it looks OK to me though.

@bors r+

Oh yeah sorry, its noted for the next time. Thanks !

rust-bors Bot pushed a commit that referenced this pull request Aug 10, 2026
@bors
Auto merge of #160830 - jhpratt:rollup-IMvXhX3, r=jhpratt
8a2fbe3 
Rollup of 11 pull requests

Successful merges:

 - #160675 (bootstrap: Remove `PATH_REMAP` from command-line selector handling )
 - #160807 (Update rustc crate rkyv to 0.8.18)
 - #159690 (Clarify `--remap-path-scope` impact on `rustc` metadata)
 - #160560 (Add nightly-only support for Cargo unremap trim-paths files in `rust-gdb`)
 - #160608 (normalization rework: clean up projection_ty_core)
 - #160785 (Get rid of LLM disclosure checkboxes)
 - #160804 (Change .expect message on net/parser to follow precondition style)
 - #160805 (`extern "custom"`: add tests)
 - #160816 (Mark const ptr methods and free functions as inline(always) to match *mut)
 - #160820 (Stabilize fs_set_times)
 - #160826 (Rename parse_delimited_token_tree in cfg_select)
@rust-bors
rust-bors Bot merged commit 6e8c73d into rust-lang:main Aug 10, 2026
13 checks passed
@rustbot rustbot added this to the 1.99.0 milestone Aug 10, 2026
rust-timer added a commit that referenced this pull request Aug 10, 2026
@rust-timer
Unrolled build for #160807
8cb6859 
Rollup merge of #160807 - rperier:bump_rkyv_security_issues, r=Mark-Simulacrum

Update rustc crate rkyv to 0.8.18

See
https://rustsec.org/advisories/RUSTSEC-2026-0233
https://rustsec.org/advisories/RUSTSEC-2026-0234
https://rustsec.org/advisories/RUSTSEC-2026-0235
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@Mark-Simulacrum Mark-Simulacrum

Labels

S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion.

Projects

None yet

Milestone

1.99.0

Development

Successfully merging this pull request may close these issues.

3 participants

@rperier @rustbot @Mark-Simulacrum