Skip to content

Comments

remove sqlx MySQL support to eliminate RSA transitive vulnerability#324

Merged
bug-ops merged 1 commit intomainfrom
feat/m14/remove-sqlx-mysql
Feb 15, 2026
Merged

remove sqlx MySQL support to eliminate RSA transitive vulnerability#324
bug-ops merged 1 commit intomainfrom
feat/m14/remove-sqlx-mysql

Conversation

@bug-ops
Copy link
Owner

@bug-ops bug-ops commented Feb 15, 2026

Summary

  • Disable sqlx default features in workspace Cargo.toml, explicitly listing only needed features (macros)
  • Per-crate sqlx dependencies already specify runtime-tokio, sqlite, migrate as needed
  • Eliminates sqlx-mysql → rsa transitive dependency (RUSTSEC-2023-0071)
  • cargo deny check passes clean; cargo audit still flags the lockfile entry (known limitation — optional deps remain in Cargo.lock)

Test plan

  • cargo build --workspace succeeds
  • cargo nextest run --workspace --lib --bins: 1351 tests pass
  • cargo deny check advisories: no vulnerabilities
  • cargo tree confirms sqlx-mysql is not in resolved dependency graph

Closes #305

@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #324      +/-   ##
==========================================
+ Coverage   79.96%   80.01%   +0.05%     
==========================================
  Files          98       98              
  Lines       23964    23926      -38     
==========================================
- Hits        19163    19145      -18     
+ Misses       4801     4781      -20     

see 3 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@bug-ops bug-ops merged commit 2b4851a into main Feb 15, 2026
18 checks passed
@bug-ops bug-ops deleted the feat/m14/remove-sqlx-mysql branch February 15, 2026 12:41
@bug-ops bug-ops mentioned this pull request Feb 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove transitive RSA vulnerability by disabling sqlx MySQL support

2 participants