sec audit 8.2.0 #264
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Platform Compatibility | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| test: | |
| name: Build & Test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| rust: [stable] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust (${{ matrix.rust }}) | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ matrix.rust }} | |
| - name: Cache Cargo registry & build | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - name: Install ODBC (Ubuntu) | |
| if: matrix.os == 'ubuntu-latest' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y unixodbc-dev | |
| - name: Install ODBC (macOS) | |
| if: matrix.os == 'macos-latest' | |
| run: | | |
| brew install unixodbc | |
| - name: Build | |
| run: cargo build --verbose | |
| - name: Run tests | |
| run: cargo test --verbose | |
| security-audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Audit Rust dependencies | |
| uses: actions-rust-lang/audit@v1 | |
| with: | |
| # ── Advisories ignored because they are in transitive deps | |
| # that Elusion does not control and that do not affect | |
| # Elusion's own code paths. | |
| # | |
| # RUSTSEC-2026-0041: lz4_flex uninitialized memory (high) | |
| # — pulled in by parquet 54.3.1 via datafusion 46. | |
| # Fix: wait for datafusion to bump lz4_flex >= 0.11.6 | |
| # | |
| # RUSTSEC-2026-0037: quinn-proto DoS (high) | |
| # — pulled in by reqwest 0.12/0.13 via object_store/azure_core. | |
| # Elusion does not use QUIC transport directly. | |
| # Fix: wait for reqwest/object_store to bump quinn-proto >= 0.11.14 | |
| # | |
| # RUSTSEC-2026-0049: rustls-webpki CRL matching (moderate) | |
| # — pulled in by reqwest 0.13 via rustls-platform-verifier. | |
| # Fix: wait for reqwest to bump rustls-webpki >= 0.103.10 | |
| # | |
| # RUSTSEC-2026-0002: lru IterMut Stacked Borrows (low) | |
| # — pulled in by mysql_async 0.36.1 (optional mysql feature). | |
| # Theoretical soundness issue, no known exploit path via Elusion. | |
| # Fix: wait for mysql_async to bump lru | |
| # | |
| # RUSTSEC-2024-0384: instant unmaintained (warning) | |
| # — pulled in by azure_core 0.21 via http-types/futures-lite. | |
| # Informational only, no vulnerability. | |
| # | |
| # RUSTSEC-2024-0436: paste unmaintained (warning) | |
| # — pulled in by parquet 54/57 via datafusion/deltalake. | |
| # Informational only, no vulnerability. | |
| # | |
| # RUSTSEC-2025-0134: rustls-pemfile unmaintained (warning) | |
| # — pulled in by object_store 0.12 via deltalake. | |
| # Informational only, no vulnerability. | |
| ignore: >- | |
| RUSTSEC-2026-0041, | |
| RUSTSEC-2026-0037, | |
| RUSTSEC-2026-0049, | |
| RUSTSEC-2026-0002, | |
| RUSTSEC-2024-0384, | |
| RUSTSEC-2024-0436, | |
| RUSTSEC-2025-0134 | |
| tls-check: | |
| name: HTTPS Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Check no plain HTTP URLs in source | |
| run: | | |
| if grep -rn "http://" src/ --include="*.rs"; then | |
| echo "Plain HTTP URLs found in source. Use HTTPS instead." | |
| exit 1 | |
| fi | |
| echo "No plain HTTP URLs found." |