resolve cargo audit CVEs, unmaintained deps, cmake build, and clippy warnings

codegen/Cargo.toml

@@ -10,5 +10,7 @@ protox = "0.9"
 prettyplease = "0.2"
 quote = "1"
 syn = "2"
-tempfile = "3.8.0"
-tonic-prost-build = {path = "../tonic-prost-build", default-features = false, features = ["cleanup-markdown"]}
+tempfile = "3.27"
+tonic-prost-build = { path = "../tonic-prost-build", default-features = false, features = [
+    "cleanup-markdown",
+] }

examples/Cargo.toml

@@ -254,31 +254,81 @@ path = "src/codec_buffers/client.rs"
 
 [features]
 gcp = ["dep:prost-types", "tonic/tls-ring"]
-routeguide = ["dep:async-stream", "dep:tokio-stream", "dep:rand", "dep:serde", "dep:serde_json"]
+routeguide = [
+    "dep:async-stream",
+    "dep:tokio-stream",
+    "dep:rand",
+    "dep:serde",
+    "dep:serde_json",
+]
 reflection = ["dep:tonic-reflection"]
 autoreload = ["dep:tokio-stream", "tokio-stream?/net", "dep:listenfd"]
 health = ["dep:tonic-health"]
-grpc-web = ["dep:tonic-web", "dep:bytes", "dep:http", "dep:hyper", "dep:hyper-util", "dep:tracing-subscriber", "dep:tower", "dep:tower-http", "tower-http?/cors"]
+grpc-web = [
+    "dep:tonic-web",
+    "dep:bytes",
+    "dep:http",
+    "dep:hyper",
+    "dep:hyper-util",
+    "dep:tracing-subscriber",
+    "dep:tower",
+    "dep:tower-http",
+    "tower-http?/cors",
+]
 tracing = ["dep:tracing", "dep:tracing-subscriber"]
-uds = ["dep:tokio-stream", "tokio-stream?/net", "dep:tower", "dep:hyper", "dep:hyper-util"]
+uds = [
+    "dep:tokio-stream",
+    "tokio-stream?/net",
+    "dep:tower",
+    "dep:hyper",
+    "dep:hyper-util",
+]
 streaming = ["dep:tokio-stream", "dep:h2"]
 mock = ["dep:tokio-stream", "dep:tower", "dep:hyper-util"]
 json-codec = ["dep:serde", "dep:serde_json", "dep:bytes"]
 compression = ["tonic/gzip"]
 tls = ["tonic/tls-ring"]
-tls-rustls = ["dep:http", "dep:hyper", "dep:hyper-util", "dep:hyper-rustls", "dep:tower", "tower-http/util", "tower-http/add-extension", "dep:tokio-rustls"]
+tls-rustls = [
+    "dep:http",
+    "dep:hyper",
+    "dep:hyper-util",
+    "dep:hyper-rustls",
+    "dep:tower",
+    "tower-http/util",
+    "tower-http/add-extension",
+    "dep:tokio-rustls",
+]
 tls-client-auth = ["tonic/tls-ring"]
 types = ["dep:tonic-types"]
 h2c = ["dep:hyper", "dep:tower", "dep:http", "dep:hyper-util"]
 cancellation = ["dep:tokio-util"]
 
-full = ["gcp", "routeguide", "reflection", "autoreload", "health", "grpc-web", "tracing", "uds", "streaming", "mock", "json-codec", "compression", "tls", "tls-rustls", "tls-client-auth", "types", "cancellation", "h2c"]
+full = [
+    "gcp",
+    "routeguide",
+    "reflection",
+    "autoreload",
+    "health",
+    "grpc-web",
+    "tracing",
+    "uds",
+    "streaming",
+    "mock",
+    "json-codec",
+    "compression",
+    "tls",
+    "tls-rustls",
+    "tls-client-auth",
+    "types",
+    "cancellation",
+    "h2c",
+]
 tower = ["dep:tower", "dep:http"]
 default = ["full"]
 
 [dependencies]
 # Common dependencies
-tokio = { version = "1.0", features = ["rt-multi-thread", "macros"] }
+tokio = { version = "1.52", features = ["rt-multi-thread", "macros"] }
 prost = "0.14"
 tonic = { path = "../tonic" }
 tonic-prost = { path = "../tonic-prost" }
@@ -289,22 +339,32 @@ tonic-reflection = { path = "../tonic-reflection", optional = true }
 tonic-types = { path = "../tonic-types", optional = true }
 async-stream = { version = "0.3", optional = true }
 tokio-stream = { version = "0.1", optional = true }
-tokio-util = { version = "0.7.8", optional = true }
+tokio-util = { version = "0.7", optional = true }
 tower = { version = "0.5", optional = true }
-rand = { version = "0.9", optional = true }
+rand = { version = "0.10", optional = true }
 serde = { version = "1.0", features = ["derive"], optional = true }
 serde_json = { version = "1.0", optional = true }
-tracing = { version = "0.1.16", optional = true }
-tracing-subscriber = { version = "0.3", features = ["tracing-log", "fmt"], optional = true }
+tracing = { version = "0.1", optional = true }
+tracing-subscriber = { version = "0.3", features = [
+    "tracing-log",
+    "fmt",
+], optional = true }
 prost-types = { version = "0.14", optional = true }
 http = { version = "1", optional = true }
 hyper = { version = "1", optional = true }
-hyper-util = { version = "0.1.4", optional = true }
+hyper-util = { version = "0.1", optional = true }
 listenfd = { version = "1.0", optional = true }
 bytes = { version = "1", optional = true }
 h2 = { version = "0.4", optional = true }
-tokio-rustls = { version = "0.26.1", optional = true, features = ["ring", "tls12"], default-features = false }
-hyper-rustls = { version = "0.27.0", features = ["http2", "ring", "tls12"], optional = true, default-features = false }
+tokio-rustls = { version = "0.26", optional = true, features = [
+    "ring",
+    "tls12",
+], default-features = false }
+hyper-rustls = { version = "0.27", features = [
+    "http2",
+    "ring",
+    "tls12",
+], optional = true, default-features = false }
 tower-http = { version = "0.6", optional = true }
 
 [build-dependencies]

examples/src/health/server.rs

@@ -35,7 +35,7 @@ async fn twiddle_service_status(reporter: HealthReporter) {
         iter += 1;
         tokio::time::sleep(Duration::from_secs(1)).await;
 
-        if iter % 2 == 0 {
+        if iter.is_multiple_of(2) {
             reporter.set_serving::<GreeterServer<MyGreeter>>().await;
         } else {
             reporter.set_not_serving::<GreeterServer<MyGreeter>>().await;

examples/src/routeguide/client.rs

@@ -1,7 +1,7 @@
 use std::error::Error;
 use std::time::Duration;
 
-use rand::Rng;
+use rand::RngExt;
 use rand::rngs::ThreadRng;
 use tokio::time;
 use tonic::Request;

grpc-protobuf-build/Cargo.toml

@@ -8,9 +8,9 @@ publish = false
 rust-version = { workspace = true }
 
 [dependencies]
-prettyplease = "0.2.35"
+prettyplease = "0.2"
 protobuf-codegen = { version = "4.34.0-release" }
-syn = "2.0.104"
+syn = "2.0"
 
 [build-dependencies]
 cmake = "0.1"

grpc/Cargo.toml

@@ -33,7 +33,6 @@ _runtime-tokio = [
 tower = ["_runtime-tokio"]
 tls-rustls = [
     "dep:rustls",
-    "dep:rustls-pemfile",
     "dep:rustls-pki-types",
     "dep:tokio-rustls",
     "dep:rustls-platform-verifier",
@@ -42,51 +41,48 @@ tls-rustls = [
 
 [dependencies]
 base64 = "0.22"
-bytes = "1.10.1"
-hickory-resolver = { version = "0.25.1", optional = true }
-http = "1.1.0"
+bytes = "1.11"
+hickory-resolver = { version = "0.26", optional = true }
+http = "1.4"
 http-body = "1.0.1"
-hyper = { version = "1.6.0", features = ["client", "http2"] }
+hyper = { version = "1.9", features = ["client", "http2"] }
 itoa = "1.0"
-parking_lot = "0.12.4"
-pin-project-lite = "0.2.16"
-rand = "0.9"
+parking_lot = "0.12"
+pin-project-lite = "0.2"
+rand = "0.10"
 rustls = { version = "0.23", optional = true, default-features = false, features = [
     "tls12",
     "logging",
     "std",
 ] }
-rustls-pemfile = { version = "2.1", optional = true, default-features = false, features = [
-    "std",
-] }
-rustls-pki-types = { version = "1.8", optional = true, default-features = false }
-rustls-platform-verifier = { version = "0.6", optional = true, default-features = false }
-rustls-webpki = { version = "0.102", optional = true, default-features = false }
-serde = { version = "1.0.219", features = ["derive"] }
-serde_json = "1.0.140"
+rustls-pki-types = { version = "1.14", optional = true, default-features = false }
+rustls-platform-verifier = { version = "0.7", optional = true, default-features = false }
+rustls-webpki = { version = "0.103", optional = true, default-features = false }
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
 socket2 = { version = "0.6", optional = true }
-tokio = { version = "1.37.0", features = ["sync", "macros"] }
+tokio = { version = "1.52", features = ["sync", "macros"] }
 tokio-rustls = { version = "0.26", optional = true, default-features = false }
-tokio-stream = { version = "0.1.17", default-features = false }
+tokio-stream = { version = "0.1", default-features = false }
 tonic = { version = "0.14.0", path = "../tonic", default-features = false, features = [
     "codegen",
 ] }
-tower = { version = "0.5.2", features = [
+tower = { version = "0.5", features = [
     "limit",
     "util",
     "buffer",
 ], optional = true }
 tower-service = "0.3.3"
 trait-variant = "0.1.2"
-url = "2.5.0"
+url = "2.5"
 
 [dev-dependencies]
 async-stream = "0.3.6"
-criterion = "0.5"
-hickory-server = "0.25.2"
-prost = "0.14.0"
+criterion = "0.8"
+hickory-server = "0.26"
+prost = "0.14"
 rustls = { version = "0.23", default-features = false, features = ["ring"] }
-tempfile = "3.26"
+tempfile = "3.27"
 tonic = { version = "0.14.0", path = "../tonic", default-features = false, features = [
     "server",
     "router",

grpc/benches/metadata.rs

@@ -23,12 +23,12 @@
  */
 
 use criterion::Criterion;
-use criterion::black_box;
 use criterion::criterion_group;
 use criterion::criterion_main;
 use grpc::metadata::MetadataKey;
 use grpc::metadata::MetadataMap;
 use grpc::metadata::MetadataValue;
+use std::hint::black_box;
 use tonic::metadata::MetadataMap as TonicMetadataMap;
 
 fn bench_metadata_map_insert(c: &mut Criterion) {

grpc/src/client/name_resolution/backoff.rs

@@ -24,7 +24,7 @@
 
 use std::time::Duration;
 
-use rand::Rng;
+use rand::RngExt;
 
 #[derive(Clone)]
 pub(crate) struct BackoffConfig {

grpc/src/credentials/rustls/client/test.rs

@@ -32,6 +32,7 @@ use rustls::ServerConfig;
 use rustls::crypto::ring;
 use rustls_pki_types::CertificateDer;
 use rustls_pki_types::PrivateKeyDer;
+use rustls_pki_types::pem::PemObject;
 use tempfile::NamedTempFile;
 use tokio::io::AsyncReadExt;
 use tokio::io::AsyncWriteExt;
@@ -489,7 +490,7 @@ fn mtls_server_config() -> ServerConfig {
     let file = std::fs::File::open(client_ca_path).expect("cannot open client CA file");
     let mut reader = std::io::BufReader::new(file);
     let mut root_store = rustls::RootCertStore::empty();
-    for cert in rustls_pemfile::certs(&mut reader) {
+    for cert in CertificateDer::pem_reader_iter(&mut reader) {
         root_store.add(cert.unwrap()).unwrap();
     }
 
@@ -516,7 +517,7 @@ fn load_certs(filename: &str) -> Vec<CertificateDer<'static>> {
     let path = test_certs_path().join(filename);
     let file = std::fs::File::open(path).expect("cannot open certificate file");
     let mut reader = std::io::BufReader::new(file);
-    rustls_pemfile::certs(&mut reader)
+    CertificateDer::pem_reader_iter(&mut reader)
         .map(|result| result.unwrap())
         .collect()
 }
@@ -525,15 +526,7 @@ fn load_private_key(filename: &str) -> PrivateKeyDer<'static> {
     let path = test_certs_path().join(filename);
     let file = std::fs::File::open(path).expect("cannot open private key file");
     let mut reader = std::io::BufReader::new(file);
-    loop {
-        match rustls_pemfile::read_one(&mut reader).expect("cannot read private key") {
-            Some(rustls_pemfile::Item::Pkcs1Key(key)) => return key.into(),
-            Some(rustls_pemfile::Item::Pkcs8Key(key)) => return key.into(),
-            Some(rustls_pemfile::Item::Sec1Key(key)) => return key.into(),
-            None => panic!("no keys found"),
-            _ => {}
-        }
-    }
+    PrivateKeyDer::from_pem_reader(&mut reader).expect("cannot read private key")
 }
 
 fn load_root_certs(filename: &str) -> RootCertificates {

grpc/src/credentials/rustls/mod.rs

@@ -22,11 +22,10 @@
  *
  */
 
-use std::io::BufReader;
-
 use rustls::crypto::CryptoProvider;
 use rustls::pki_types::PrivateKeyDer;
 use rustls_pki_types::CertificateDer;
+use rustls_pki_types::pem::PemObject;
 use tokio::sync::watch;
 
 use crate::credentials::ProtocolInfo;
@@ -154,21 +153,11 @@ fn sanitize_crypto_provider(mut crypto_provider: CryptoProvider) -> Result<Crypt
 }
 
 fn parse_certs(pem: &[u8]) -> Result<Vec<CertificateDer<'static>>, String> {
-    let mut reader = BufReader::new(pem);
-    rustls_pemfile::certs(&mut reader)
+    CertificateDer::pem_slice_iter(pem)
         .map(|result| result.map_err(|e| e.to_string()))
         .collect()
 }
 
 fn parse_key(pem: &[u8]) -> Result<PrivateKeyDer<'static>, String> {
-    let mut reader = BufReader::new(pem);
-    loop {
-        match rustls_pemfile::read_one(&mut reader).map_err(|e| e.to_string())? {
-            Some(rustls_pemfile::Item::Pkcs1Key(key)) => return Ok(key.into()),
-            Some(rustls_pemfile::Item::Pkcs8Key(key)) => return Ok(key.into()),
-            Some(rustls_pemfile::Item::Sec1Key(key)) => return Ok(key.into()),
-            None => return Err("no private key found".to_string()),
-            _ => continue,
-        }
-    }
+    PrivateKeyDer::from_pem_slice(pem).map_err(|e| e.to_string())
 }

grpc/src/credentials/rustls/server/test.rs

@@ -29,6 +29,7 @@ use std::sync::Once;
 use rustls::HandshakeKind;
 use rustls::crypto::ring;
 use rustls_pki_types::ServerName;
+use rustls_pki_types::pem::PemObject;
 use tempfile::NamedTempFile;
 use tokio::io::AsyncReadExt;
 use tokio::io::AsyncWriteExt;
@@ -675,7 +676,7 @@ fn load_certs(filename: &str) -> Vec<rustls_pki_types::CertificateDer<'static>>
     let path = test_certs_path().join(filename);
     let file = std::fs::File::open(path).expect("cannot open certificate file");
     let mut reader = std::io::BufReader::new(file);
-    rustls_pemfile::certs(&mut reader)
+    rustls_pki_types::CertificateDer::pem_reader_iter(&mut reader)
         .map(|result| result.unwrap())
         .collect()
 }
@@ -684,15 +685,7 @@ fn load_private_key(filename: &str) -> rustls_pki_types::PrivateKeyDer<'static>
     let path = test_certs_path().join(filename);
     let file = std::fs::File::open(path).expect("cannot open private key file");
     let mut reader = std::io::BufReader::new(file);
-    loop {
-        match rustls_pemfile::read_one(&mut reader).expect("cannot read private key") {
-            Some(rustls_pemfile::Item::Pkcs1Key(key)) => return key.into(),
-            Some(rustls_pemfile::Item::Pkcs8Key(key)) => return key.into(),
-            Some(rustls_pemfile::Item::Sec1Key(key)) => return key.into(),
-            None => panic!("no keys found"),
-            _ => {}
-        }
-    }
+    rustls_pki_types::PrivateKeyDer::from_pem_reader(&mut reader).expect("cannot read private key")
 }
 
 fn load_root_certs(filename: &str) -> RootCertificates {