Skip to content

fix: Bump launchdarkly-sdk-transport to 0.1.4#178

Closed
keelerm84 wants to merge 1 commit into
mainfrom
mk/SDK-2597/bump-transport
Closed

fix: Bump launchdarkly-sdk-transport to 0.1.4#178
keelerm84 wants to merge 1 commit into
mainfrom
mk/SDK-2597/bump-transport

Conversation

@keelerm84

@keelerm84 keelerm84 commented Jun 24, 2026

Copy link
Copy Markdown
Member

Summary

Follow-up to the rust-sdk-transport change (transport 0.1.4 is published).

launchdarkly-sdk-transport 0.1.4 requires hyper-http-proxy ^1.1.1, which removed its dependency on the unmaintained rustls-pemfile crate (RUSTSEC-2025-0134). This raises the transport floor from 0.1.0 to 0.1.4 in both launchdarkly-server-sdk and contract-tests so fresh dependency resolution can no longer select a transport version that drags rustls-pemfile into the tree. With this bump, rustls-pemfile no longer appears in the resolved dependency tree.

Fixes #176.


Note

Low Risk
Dependency version floor only; no runtime or API changes in this repo, with expected benefit of clearing a known advisory from the tree.

Overview
Raises the minimum launchdarkly-sdk-transport version from 0.1.0 to 0.1.4 in launchdarkly-server-sdk and contract-tests so dependency resolution cannot pull in older transport releases that transitively depend on the unmaintained rustls-pemfile crate (RUSTSEC-2025-0134).

Transport 0.1.4 aligns with hyper-http-proxy ^1.1.1, which drops that dependency; this is a manifest-only change with no SDK source edits.

Reviewed by Cursor Bugbot for commit 69f82a8. Bugbot is set up for automated code reviews on this repo. Configure here.

transport 0.1.4 requires hyper-http-proxy 1.1.1, which dropped the
unmaintained rustls-pemfile crate (RUSTSEC-2025-0134). Raising the floor
guarantees the advisory-free transport for fresh dependency resolution.

Fixes #176
@keelerm84 keelerm84 marked this pull request as ready for review June 24, 2026 20:20
@keelerm84 keelerm84 requested a review from a team as a code owner June 24, 2026 20:20
@keelerm84

Copy link
Copy Markdown
Member Author

Closing as unnecessary. The transport dependency is declared as version = "0.1.0" (= ^0.1.0), which already permits 0.1.4, so a fresh resolve / cargo update picks transport 0.1.4 -> hyper-http-proxy 1.1.1 and drops rustls-pemfile without this floor bump. Verified a from-scratch lockfile resolves to transport 0.1.4 and contains zero rustls-pemfile entries. The transport 0.1.4 release fully resolves RUSTSEC-2025-0134 for consumers.

@keelerm84 keelerm84 closed this Jun 24, 2026
@keelerm84 keelerm84 deleted the mk/SDK-2597/bump-transport branch June 24, 2026 20:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cargo warning with Rust SDK 3.1.1 for rustls-pemfile

1 participant