v0.17.1-rc — security fixes + cargo fmt

rettde · rettde · commit a2cdfd85ab51 · 2026-03-21T06:06:18.000+01:00
- RUSTSEC-2026-0044/0048: aws-lc-sys 0.38.0 → 0.39.0 (X.509 bypass + CRL logic, severity 7.4)
- RUSTSEC-2026-0049: rustls-webpki 0.103.9 → 0.103.10 (CRL DP matching)
- cargo audit: 0 vulnerabilities
- cargo fmt: enforced across workspace
- All 7 crates bumped to 0.17.1-rc
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,20 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [0.17.1-rc] — 2026-03-20
+
+### Security
+- **RUSTSEC-2026-0044** — `aws-lc-sys` 0.38.0 → 0.39.0 (X.509 Name Constraints bypass)
+- **RUSTSEC-2026-0048** — `aws-lc-sys` 0.38.0 → 0.39.0 (CRL scope logic error, severity 7.4)
+- **RUSTSEC-2026-0049** — `rustls-webpki` 0.103.9 → 0.103.10 (CRL Distribution Point matching)
+- `cargo audit` now **0 vulnerabilities** (3 unmaintained warnings — transitive via `sled`)
+- `cargo fmt` enforced across workspace
+
+### Internal
+- All 7 workspace crates bumped to **0.17.1-rc**
+
+---
+
 ## [0.17.0-rc] — 2026-03-20
 
 ### Code Review Fixes
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/examples/demo-ecu/Cargo.toml b/examples/demo-ecu/Cargo.toml
@@ -8,7 +8,7 @@
 
 [package]
 name = "demo-ecu"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 publish = false
diff --git a/native-comm-someip/Cargo.toml b/native-comm-someip/Cargo.toml
@@ -5,7 +5,7 @@
 
 [package]
 name = "native-comm-someip"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 homepage.workspace = true
diff --git a/native-core/Cargo.toml b/native-core/Cargo.toml
@@ -7,7 +7,7 @@
 
 [package]
 name = "native-core"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 homepage.workspace = true
diff --git a/native-health/Cargo.toml b/native-health/Cargo.toml
@@ -4,7 +4,7 @@
 
 [package]
 name = "native-health"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 homepage.workspace = true
diff --git a/native-interfaces/Cargo.toml b/native-interfaces/Cargo.toml
@@ -5,7 +5,7 @@
 
 [package]
 name = "native-interfaces"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 homepage.workspace = true
diff --git a/native-interfaces/src/sovd.rs b/native-interfaces/src/sovd.rs
@@ -953,7 +953,11 @@ pub struct UdsSecurityLevel {
     /// Whether this level is currently unlocked
     pub unlocked: bool,
     /// Services protected by this level (UDS SIDs, hex strings)
-    #[serde(rename = "protectedServices", default, skip_serializing_if = "Vec::is_empty")]
+    #[serde(
+        rename = "protectedServices",
+        default,
+        skip_serializing_if = "Vec::is_empty"
+    )]
     pub protected_services: Vec<String>,
 }
 
@@ -1017,7 +1021,11 @@ pub struct UcmCampaign {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
     /// Per-component transfer states
-    #[serde(rename = "transferStates", default, skip_serializing_if = "Vec::is_empty")]
+    #[serde(
+        rename = "transferStates",
+        default,
+        skip_serializing_if = "Vec::is_empty"
+    )]
     pub transfer_states: Vec<UcmTransferState>,
 }
 
diff --git a/native-server/Cargo.toml b/native-server/Cargo.toml
@@ -4,7 +4,7 @@
 
 [package]
 name = "opensovd-native-server"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 homepage.workspace = true
diff --git a/native-sovd/Cargo.toml b/native-sovd/Cargo.toml
@@ -4,7 +4,7 @@
 
 [package]
 name = "native-sovd"
-version = "0.17.0-rc"
+version = "0.17.1-rc"
 edition.workspace = true
 license.workspace = true
 homepage.workspace = true
diff --git a/native-sovd/src/openapi.rs b/native-sovd/src/openapi.rs
@@ -96,7 +96,12 @@ fn filter_paths(paths: &serde_json::Value, segment: &str) -> serde_json::Value {
 
 fn build_schemas() -> serde_json::Value {
     let mut map = serde_json::Map::new();
-    for sub in [core_schemas(), resource_schemas(), f15_f16_schemas(), f17_f18_schemas()] {
+    for sub in [
+        core_schemas(),
+        resource_schemas(),
+        f15_f16_schemas(),
+        f17_f18_schemas(),
+    ] {
         if let serde_json::Value::Object(m) = sub {
             map.extend(m);
         }
@@ -1277,12 +1282,20 @@ mod tests {
     fn contract_f15_rxswin_paths_present() {
         let spec = build_openapi_json();
         let paths = spec["paths"].as_object().unwrap();
-        let rxswin_paths = ["/rxswin", "/rxswin/report", "/rxswin/{component_id}", "/update-provenance"];
+        let rxswin_paths = [
+            "/rxswin",
+            "/rxswin/report",
+            "/rxswin/{component_id}",
+            "/update-provenance",
+        ];
         for path in &rxswin_paths {
             assert!(paths.contains_key(*path), "RXSWIN path missing: {path}");
         }
         assert!(paths["/rxswin"]["get"].is_object(), "/rxswin GET missing");
-        assert!(paths["/rxswin"]["x-sovd-name"].is_string(), "/rxswin x-sovd-name missing");
+        assert!(
+            paths["/rxswin"]["x-sovd-name"].is_string(),
+            "/rxswin x-sovd-name missing"
+        );
     }
 
     #[test]
@@ -1309,7 +1322,10 @@ mod tests {
         );
         let sa = &paths["/x-uds/components/{component_id}/security-access"];
         assert!(sa["post"].is_object(), "security-access POST missing");
-        assert!(sa["post"]["requestBody"].is_object(), "security-access requestBody missing");
+        assert!(
+            sa["post"]["requestBody"].is_object(),
+            "security-access requestBody missing"
+        );
     }
 
     #[test]
@@ -1325,22 +1341,37 @@ mod tests {
         for path in &ucm_paths {
             assert!(paths.contains_key(*path), "UCM path missing: {path}");
         }
-        assert!(paths["/ucm/campaigns"]["get"].is_object(), "UCM campaigns GET missing");
-        assert!(paths["/ucm/campaigns"]["post"].is_object(), "UCM campaigns POST missing");
+        assert!(
+            paths["/ucm/campaigns"]["get"].is_object(),
+            "UCM campaigns GET missing"
+        );
+        assert!(
+            paths["/ucm/campaigns"]["post"].is_object(),
+            "UCM campaigns POST missing"
+        );
     }
 
     #[test]
     fn contract_f15_f18_schemas_present() {
         let spec = build_openapi_json();
         let schemas = spec["components"]["schemas"].as_object().unwrap();
         let f15_f18_schemas = [
-            "RxswinEntry", "RxswinReport", "UpdateProvenanceEntry",
-            "TaraAsset", "TaraThreatEntry", "TaraExport",
-            "UdsSecurityLevel", "UdsSecurityAccessRequest", "UdsSecurityAccessResponse",
+            "RxswinEntry",
+            "RxswinReport",
+            "UpdateProvenanceEntry",
+            "TaraAsset",
+            "TaraThreatEntry",
+            "TaraExport",
+            "UdsSecurityLevel",
+            "UdsSecurityAccessRequest",
+            "UdsSecurityAccessResponse",
             "UcmCampaign",
         ];
         for schema in &f15_f18_schemas {
-            assert!(schemas.contains_key(*schema), "F15-F18 schema missing: {schema}");
+            assert!(
+                schemas.contains_key(*schema),
+                "F15-F18 schema missing: {schema}"
+            );
         }
     }
 
diff --git a/native-sovd/src/routes.rs b/native-sovd/src/routes.rs
diff --git a/native-sovd/src/state.rs b/native-sovd/src/state.rs
