Repository navigation
fix(deps): bump h2 to 0.4.18 to fix RUSTSEC-2026-0258 - #1335
Merged
Merged
Conversation
The Audit (cargo-audit) check fails on main: h2 0.4.13 accepts and queues empty DATA frames without limit (RUSTSEC-2026-0258), patched in 0.4.16. Lockfile-only change; LICENSE-3rdparty.csv is unchanged since h2 is already listed and no crates were added or removed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
lucaspimentel
approved these changes
Aug 20, 2026
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
smithclay
added a commit
to usetero/datadog-lambda-extension
that referenced
this pull request
Sep 1, 2026
* fix(deps): bump h2 to 0.4.18 to fix RUSTSEC-2026-0258 (DataDog#1335) The **Audit** check (`cargo-audit`) is failing on `main`: [RUSTSEC-2026-0258](https://rustsec.org/advisories/RUSTSEC-2026-0258) — `h2` accepts and queues empty DATA frames without limit, which can lead to unbounded memory usage or a panic on length overflow. Low severity, patched in `h2` 0.4.16. This bumps `h2` 0.4.13 → 0.4.18 in `bottlecap/Cargo.lock`. Lockfile-only; no source changes. Notes on the diff: - The diff is restricted to the two `h2` lines. Running `cargo update -p h2` locally also re-resolved six unrelated `windows-sys` entries downward (0.61.2 → 0.52.0/0.60.2); that churn was reverted, and `cargo metadata --locked` confirms the lockfile is still self-consistent. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * [SVLS-8070] Remove dormant GHCR publisher (DataDog#1330) ## Overview * Removes the dormant GHCR publisher; companion to https://github.com/DataDog/serverless-init-ci/pull/51 * Updates Bottlecap's locked `h2` dependency from 0.4.13 to 0.4.16 to resolve [RUSTSEC-2026-0258](https://rustsec.org/advisories/RUSTSEC-2026-0258), which is blocking `main` and unrelated PRs ## Testing * `cargo check --workspace --locked` * chore: add PR size guidance to AGENTS.md (DataDog#1331) ## Overview Adds a line to `AGENTS.md` asking agents to keep PRs small — usually no more than 300 lines of core code, excluding tests, dependency updates, and other generated changes — so reviews stay manageable. ## Testing Docs-only change; no code affected. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(dsm): Add support for automatic DSM context extraction inside the extension (DataDog#1265) **Please include Jira ticket in title.** Update the trace context propagation support in universal instrumentation to include the automatic extraction of Data Streams Monitoring context for SQS, SNS, Kinesis and EventBridge. Added unit tests. Manually tested the functionality for Java, Go and .NET. Java and Go work correctly. [The .NET tracer needs updating to support the 2.x version of `Amazon.Lambda.RuntimeSupport`](DataDog/dd-trace-dotnet#8797) so can't test that manually yet. * feat(traces): use DD_SERVICE for inferred spans when integration service names are removed (DataDog#1343) ## Summary - Adds `DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED` (default `false`). When it is set **and** `DD_SERVICE` is configured, inferred (synthetic) event-source spans report the function's base service instead of the AWS resource/instance representation. - An explicit `DD_SERVICE_MAPPING` entry still takes precedence. - Applies to the wrapped inferred spans too (SQS→SNS, SQS→EventBridge, SNS→EventBridge). ## Motivation Customers currently need one `DD_SERVICE_MAPPING` entry per trigger type per function to get their event-source spans onto their own service name. This gives them a single setting that consolidates all of them at once. Tracked by [FRSLES-869](https://datadoghq.atlassian.net/browse/FRSLES-869). This repo is the **only** inferred-span implementation for Go, Java, .NET, and Ruby, which delegate inference to the extension entirely. Companion PRs: [datadog-lambda-python#834](DataDog/datadog-lambda-python#834), [datadog-lambda-js#814](DataDog/datadog-lambda-js#814). ## Implementation note Rather than thread two more parameters through `Trigger::enrich_span` and `resolve_service_name` (a ~200-line mechanical change across all 13 trigger modules and their tests), the override is applied in `span_inferrer.rs` immediately after enrichment. To keep `DD_SERVICE_MAPPING` precedence expressed in one place, `Trigger` gains a default `has_service_mapping_entry` method that reuses the same specific/generic identifiers `resolve_service_name` looks up. Happy to switch to the full parameter-threading approach if reviewers prefer a single resolution ladder. The override lowercases `DD_SERVICE` to match the invocation span built in `processor.rs`, so both spans land on the same service. ## Scope Service-name resolution only. `complete_inferred_spans` still sets `peer.service` to the invocation span's service as it does today; revisiting that pairing is deliberately left to a follow-up. ## Test plan - [x] 6 new tests in `span_inferrer.rs`: override applies, disabled by default, yields to `DD_SERVICE_MAPPING`, no-op without `DD_SERVICE`, lowercases `DD_SERVICE`, applies to wrapped spans - [x] 3 new config tests: default off, from env, from YAML - [x] `cargo test --lib` — 550 passed - [x] `cargo clippy --lib --tests -- -D warnings` clean - [x] `cargo fmt --check` clean [FRSLES-869]: https://datadoghq.atlassian.net/browse/FRSLES-869?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ * chore(deps): update `libdatadog` to `72fa8685` and `serverless-components` to `9daae40` (DataDog#1332) --------- Co-authored-by: Yiming Luo <10097700+lym953@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: E. Lewis <lewis.lewis@datadoghq.com> Co-authored-by: James Eastham <dev@jameseastham.co.uk> Co-authored-by: Zarir Hamza <zarir.hamza@datadoghq.com> Co-authored-by: Lucas Pimentel <lucas.pimentel@datadoghq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
The Audit check (
cargo-audit) is failing onmain: RUSTSEC-2026-0258 —h2accepts and queues empty DATA frames without limit, which can lead to unbounded memory usage or a panic on length overflow. Low severity, patched inh20.4.16.This bumps
h20.4.13 → 0.4.18 inbottlecap/Cargo.lock. Lockfile-only; no source changes.Notes on the diff:
h2lines. Runningcargo update -p h2locally also re-resolved six unrelatedwindows-sysentries downward (0.61.2 → 0.52.0/0.60.2); that churn was reverted, andcargo metadata --lockedconfirms the lockfile is still self-consistent.🤖 Generated with Claude Code