Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

maplibre/martin

              main @ 4f7abb0
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

Cargo.lock: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Removed dangerous default that skipped certificate verification entirely; added verify-ca/verify-full modes, indicating prior connections could be made without validating server identity.

TLS Verification Bypass: sslmode=verify-ca was incorrectly skipping CA verification along with hostname check, allowing MITM attacks. Fix ensures CA is verified while only hostname is skipped.

Auth Bypass: Upgraded aws-lc-sys and rustls-webpki to fix TLS certificate validation bypass vulnerabilities in dependencies, affecting all TLS connections.