RUSTSEC-2025-0134 rustls-pemfile crate is no longer maintained

Open
#2,325 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
rust
Domain
ci-cd, cli, security

Research direction

Start with the cargo deny job in the CI workflow and trace the reported dependency chain from rustls-pemfile through rustls-native-certs, hyper-rustls, and jsonrpsee-http-client. Review the rustls-pki-types PemObject API and make the dependency migration; done means the advisory no longer causes cargo deny to fail.

Written by the indexing model from the issue text.

Description

The cargo deny job in the ci workflow is erroring with:

    ├ ID: RUSTSEC-2025-0134
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0134
    ├ The rustls-pemfile crate is no longer maintained. The repository has been archived since August
      2025, and users are encouraged to depend directly on the underlying PEM parsing code included
      in rustls-pki-types since 1.9.0. The latest version of rustls-pemfile is in fact a thin wrapper
      around the same code used in rustls-pki-types, so migrating should be straightforward.
      
      The new API is represented by the [`PemObject`][PemObject] trait, which provides methods for
      reading a single or multiple PEM objects from a file or byte slice.
      
      [PemObject]: https://docs.rs/rustls-pki-types/latest/rustls_pki_types/pem/trait.PemObject.html
    ├ Announcement: https://github.com/rustls/pemfile/issues/61
    ├ Solution: No safe upgrade is available!
    ├ rustls-pemfile v1.0.4
      └── rustls-native-certs v0.6.3
          └── hyper-rustls v0.24.2
              └── jsonrpsee-http-client v0.20.4
                  ├── soroban-cli v23.3.0
                  │   ├── doc-gen v23.3.0
                  │   ├── soroban-test v23.3.0
                  │   └── stellar-cli v23.3.0
                  └── stellar-rpc-client v23.2.1
                      ├── soroban-cli v23.3.0 (*)
                      └── soroban-test v23.3.0 (*)

Ref: https://github.com/stellar/stellar-cli/actions/runs/20120963963/job/57740830196?pr=2324

Dominant language
Rust
Stars
123
Forks
141
Avg merge
2d 21h
Merged PRs (30d)
17

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stellar/stellar-cli

All issues in stellar/stellar-cli

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.