From 177dbb2bc7c4f027944dda4332d95695a525e44a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonasz=20Ma=C5=82ecki?= Date: Thu, 8 Oct 2026 08:20:41 +0200 Subject: [PATCH 1/2] chore(sdk): bump version to 0.3.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jonasz Małecki --- Cargo.lock | 2 +- sdk/Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 783a1f0..9881550 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -395,7 +395,7 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" [[package]] name = "function-sdk-rust" -version = "0.3.0" +version = "0.3.1" dependencies = [ "bytes", "clap", diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml index d81bee7..46fca62 100644 --- a/sdk/Cargo.toml +++ b/sdk/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "function-sdk-rust" -version = "0.3.0" +version = "0.3.1" edition.workspace = true license.workspace = true description = "A Rust SDK for writing Crossplane composition functions" From d376afdd5c2fcdb7c3699c42b4fa9c485f7753c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonasz=20Ma=C5=82ecki?= Date: Thu, 8 Oct 2026 08:24:31 +0200 Subject: [PATCH 2/2] fix(deps): require rustls 0.23.45 or later MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The rustls fix from #27 only changed this repo's Cargo.lock, which projects depending on the SDK ignore. Declare rustls directly with a 0.23.45 floor so they cannot resolve a version affected by RUSTSEC-2026-0285. default-features = false keeps the feature set that tonic's tls-aws-lc already enables. Signed-off-by: Jonasz Małecki --- Cargo.lock | 1 + sdk/Cargo.toml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/Cargo.lock b/Cargo.lock index 9881550..71ee1b6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -405,6 +405,7 @@ dependencies = [ "pbjson-types", "prometheus-client", "prost", + "rustls", "serde", "serde_json", "sha2", diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml index 46fca62..8240015 100644 --- a/sdk/Cargo.toml +++ b/sdk/Cargo.toml @@ -31,6 +31,8 @@ tower-service = "0.3" tracing-subscriber = { version = "0.3", features = ["json"] } sha2 = "0.11" thiserror = "2" +# Not used directly: raises the transitive rustls floor past RUSTSEC-2026-0285. +rustls = { version = "0.23.45", default-features = false } [dev-dependencies] tokio-test = "0.4"