Skip to content

chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224 - #4139

Merged
wpfleger96 merged 1 commit into
mainfrom
alia/rustsec-2026-0224-nostr-relay-pool
Aug 1, 2026
Merged

chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224#4139
wpfleger96 merged 1 commit into
mainfrom
alia/rustsec-2026-0224-nostr-relay-pool

Conversation

@wpfleger96

@wpfleger96 wpfleger96 commented Aug 1, 2026

Copy link
Copy Markdown
Member

Bump nostr-relay-pool from 0.44.1 to 0.44.2 to clear RUSTSEC-2026-0224, which addresses verification-cache poisoning that could let forged Nostr events bypass signature validation on redelivery.

The dependency is transitive through nostr-sdk; this PR updates only the corresponding package version and checksum in Cargo.lock. The advisory currently marks every open PR red until this fix merges.

  • cargo test -p buzz-sdk -p buzz-cli passes: 271 + 241 tests
  • cargo deny check advisories passes
  • just fmt-check passes

npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 @wpfleger96
chore(deps): bump nostr-relay-pool to 0.44.2 for RUSTSEC-2026-0224
70cefaa 
Fix verification-cache poisoning that could allow forged Nostr events to bypass signature validation on redelivery.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
@wpfleger96
wpfleger96 requested a review from a team as a code owner August 1, 2026 16:34
@wpfleger96
wpfleger96 enabled auto-merge (squash) August 1, 2026 16:39
@wpfleger96
wpfleger96 merged commit 9d6726e into main Aug 1, 2026
33 checks passed
@wpfleger96
wpfleger96 deleted the alia/rustsec-2026-0224-nostr-relay-pool branch August 1, 2026 17:04
tellaho added a commit that referenced this pull request Aug 1, 2026
npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w @tellaho
Merge remote-tracking branch 'origin/main' into tho/mobile-channel-menu
433c76d 
* origin/main: (24 commits)
  perf(relay): serve relay-membership checks from the read replica (#4124)
  chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224 (#4139)
  docs(nostr): document #h requirement for live reaction subscriptions (#3487)
  docs(chart): fix ArgoCD example for native OCI sources (full artifact repoURL + path) (#3426)
  docs(readme): clarify which release asset to download per platform (#3481)
  fix(relay): allow open relays to set their NIP-11 workspace icon (kind:9033) (#3998)
  docs: note that addressable channel events scope by d, not h (#4103)
  docs: fix stale kind count, quick-start numbering, and empty Further Reading (#2613)
  fix(desktop): keep thread-open affordance in archived channels (#4012)
  docs: add one-click Railway deploy for a hosted relay (#2733)
  fix(desktop): point Oh My Pi preset at omp.sh (#3516)
  fix(mesh): stop restarting a busy or loading shared-compute node (#3909)
  fix(desktop): preserve first huddle speech (#3962)
  feat(desktop): Agent Trading Cards — mintable agent-snapshot card PNGs with optional NIP-44 lock (#3278)
  fix(buzz-acp): thread cache-read tokens into NIP-AM kind:44200 events (#3999)
  feat(relay): accept kind:30621 multi-repo projects at ingest (#3171)
  fix(release): preserve main in desktop PR body (#3979)
  chore(release): release Buzz Desktop version 0.5.3 (#3972)
  fix(release): require exact-head approval for desktop tags (#3973)
  fix(release): make desktop tagging squash-safe (#3965)
  ...

Signed-off-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>
Co-authored-by: Taylor Ho <taylorkmho@gmail.com>
Signed-off-by: Taylor Ho <taylorkmho@gmail.com>
@mattbalza mattbalza mentioned this pull request Aug 1, 2026
Merged
4 tasks
tellaho added a commit that referenced this pull request Aug 1, 2026
npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w @tellaho
Merge remote-tracking branch 'origin/main' into tho/skippable-agent-c…
2efaebb 
…onfig

* origin/main:
  perf(relay): serve relay-membership checks from the read replica (#4124)
  chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224 (#4139)
  docs(nostr): document #h requirement for live reaction subscriptions (#3487)
  docs(chart): fix ArgoCD example for native OCI sources (full artifact repoURL + path) (#3426)
  docs(readme): clarify which release asset to download per platform (#3481)
  fix(relay): allow open relays to set their NIP-11 workspace icon (kind:9033) (#3998)
  docs: note that addressable channel events scope by d, not h (#4103)
  docs: fix stale kind count, quick-start numbering, and empty Further Reading (#2613)
  fix(desktop): keep thread-open affordance in archived channels (#4012)
  docs: add one-click Railway deploy for a hosted relay (#2733)
  fix(desktop): point Oh My Pi preset at omp.sh (#3516)
  fix(mesh): stop restarting a busy or loading shared-compute node (#3909)
  fix(desktop): preserve first huddle speech (#3962)
  feat(desktop): Agent Trading Cards — mintable agent-snapshot card PNGs with optional NIP-44 lock (#3278)
  fix(buzz-acp): thread cache-read tokens into NIP-AM kind:44200 events (#3999)
  feat(relay): accept kind:30621 multi-repo projects at ingest (#3171)
  fix(release): preserve main in desktop PR body (#3979)
  chore(release): release Buzz Desktop version 0.5.3 (#3972)
  fix(release): require exact-head approval for desktop tags (#3973)
  fix(release): make desktop tagging squash-safe (#3965)

Signed-off-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>
Co-authored-by: Taylor Ho <taylorkmho@gmail.com>
Signed-off-by: Taylor Ho <taylorkmho@gmail.com>
@munirad7s munirad7s mentioned this pull request Aug 1, 2026
Merged
mattbalza added a commit to mattbalza/buzz that referenced this pull request Aug 1, 2026
@mattbalza @wpfleger96 npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2
ci: unblock Sprig publishing and clear RUSTSEC-2026-0224 (#4)
cc2fc53 
* chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224 (block#4139)

Bump `nostr-relay-pool` from 0.44.1 to 0.44.2 to clear
[RUSTSEC-2026-0224](https://rustsec.org/advisories/RUSTSEC-2026-0224),
which addresses verification-cache poisoning that could let forged Nostr
events bypass signature validation on redelivery.

The dependency is transitive through `nostr-sdk`; this PR updates only
the corresponding package version and checksum in `Cargo.lock`. The
advisory currently marks every open PR red until this fix merges.

- `cargo test -p buzz-sdk -p buzz-cli` passes: 271 + 241 tests
- `cargo deny check advisories` passes
- `just fmt-check` passes

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@buzz.block.builderlab.xyz>
Signed-off-by: aria-inboxia <aria@inboxia.com>

* ci(sprig): create the rolling release before editing it

`Publish rolling release` has failed on every push to main with
`release not found`, exit 1. The step calls `gh release edit
sprig-latest` with no create path, so it can only ever succeed on a
repo where that release already exists.

Nothing creates it. `publish-tag` cuts `sprig-v*` tags, not the rolling
tag, and releases are not inherited when a repo is forked or re-created
— so the first run on a fresh repo fails, and keeps failing, with two
successful build jobs behind it.

Create the release on demand, then edit as before so the title and
notes still track the current SHA.

Signed-off-by: mattbalza <mattbalza@users.noreply.github.com>

---------

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: aria-inboxia <aria@inboxia.com>
Signed-off-by: mattbalza <mattbalza@users.noreply.github.com>
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@buzz.block.builderlab.xyz>
Co-authored-by: mattbalza <mattbalza@users.noreply.github.com>
@munirad7s munirad7s mentioned this pull request Aug 1, 2026
Closed
5 tasks
@github-actions github-actions Bot mentioned this pull request Aug 1, 2026
Open
tellaho added a commit that referenced this pull request Aug 2, 2026
@tellaho
chore: merge latest main into link preview branch
c1539f8 
- Incorporate upstream desktop changes required by the pre-push overlap guard
- Preserve the link preview thumbnail stabilization work on the updated base

Co-authored-by: Taylor Ho <taylorkmho@gmail.com>

* origin/main: (26 commits)
  docs: formal spec for remote agents and their management (#3748)
  fix(nip-oa): accept raw Nostr tag form in parse_json_array (#4203)
  perf(relay): serve relay-membership checks from the read replica (#4124)
  chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224 (#4139)
  docs(nostr): document #h requirement for live reaction subscriptions (#3487)
  docs(chart): fix ArgoCD example for native OCI sources (full artifact repoURL + path) (#3426)
  docs(readme): clarify which release asset to download per platform (#3481)
  fix(relay): allow open relays to set their NIP-11 workspace icon (kind:9033) (#3998)
  docs: note that addressable channel events scope by d, not h (#4103)
  docs: fix stale kind count, quick-start numbering, and empty Further Reading (#2613)
  fix(desktop): keep thread-open affordance in archived channels (#4012)
  docs: add one-click Railway deploy for a hosted relay (#2733)
  fix(desktop): point Oh My Pi preset at omp.sh (#3516)
  fix(mesh): stop restarting a busy or loading shared-compute node (#3909)
  fix(desktop): preserve first huddle speech (#3962)
  feat(desktop): Agent Trading Cards — mintable agent-snapshot card PNGs with optional NIP-44 lock (#3278)
  fix(buzz-acp): thread cache-read tokens into NIP-AM kind:44200 events (#3999)
  feat(relay): accept kind:30621 multi-repo projects at ingest (#3171)
  fix(release): preserve main in desktop PR body (#3979)
  chore(release): release Buzz Desktop version 0.5.3 (#3972)
  ...

Signed-off-by: Taylor Ho <taylorkmho@gmail.com>
This was referenced Aug 2, 2026
Open
Open
Merged
@iroiro147 iroiro147 mentioned this pull request Aug 2, 2026
Open
@github-actions github-actions Bot mentioned this pull request Aug 3, 2026
Open
joahg added a commit to joahg/buzz-dev-mode that referenced this pull request Aug 3, 2026
@joahg
Merge remote-tracking branch 'origin/main' into joah/dev-mode-display…
3e72629 
…-style

* origin/main:
  Polish mobile composer and messaging UI (block#3918)
  ci(linux): enable mesh-llm feature in Linux release and canary builds (block#4524)
  fix(desktop): stop the create-agent provider config probe from erasing keystrokes (block#4411)
  fix(mobile): recover and pace live subscriptions (block#3053)
  feat(acp): deliver system prompt via _meta.systemPrompt for claude-agent-acp (block#4395)
  fix(security): bump nostr crates for RUSTSEC-2026-0225..0232 + default sprig image to published digest (block#4392)
  fix(desktop): back/forward via keyboard chords, mouse X1/X2 buttons, and swipe gestures (block#3778)
  feat(k8s): Kubernetes backend plugin + desktop deploy path (block#4289)
  fix(git): allow deleting the default branch (block#4297)
  feat(projects): add buzz projects CLI commands (NIP-MP kind:30621) (block#4020)
  docs: formal spec for remote agents and their management (block#3748)
  fix(nip-oa): accept raw Nostr tag form in parse_json_array (block#4203)
  perf(relay): serve relay-membership checks from the read replica (block#4124)
  chore(deps): bump nostr-relay-pool for RUSTSEC-2026-0224 (block#4139)
  docs(nostr): document #h requirement for live reaction subscriptions (block#3487)

Signed-off-by: Joah Gerstenberg <joah@squareup.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tlongwell-block tlongwell-block tlongwell-block approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@wpfleger96 @tlongwell-block