Dev307

[QiiHeng3]

Description

Upgrade Pingora to 0.8.0 and fix security vulnerabilities discovered by cargo audit.

Security Fixes

• bytes 1.11.0 → 1.11.1: Fix integer overflow in BytesMut::reserve (RUSTSEC-2026-0007)
• Remove htpasswd-verify: Replace with a self-contained htpasswd verification module built on md-5 / sha1 / bcrypt, eliminating the vulnerable rust-crypto dependency chain (RUSTSEC-2022-0011 AES miscomputation, RUSTSEC-2022-0004 stack overflow, RUSTSEC-2020-0071 segfault). The new module supports all htpasswd formats: Bcrypt, SHA-1, APR1, and MD5-crypt.
• time 0.3.45 → 0.3.47: Fix denial-of-service via stack exhaustion (RUSTSEC-2026-0009)
• Remove unused rustls-pemfile direct dependency: Marked unmaintained (RUSTSEC-2025-0134) and not referenced anywhere in source code

Audit Summary

Before: 6 vulnerabilities + 6 warnings → After: 1 vulnerability + 3 warnings (all from upstream pingora transitive dependencies, out of our control)

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🔧 Refactoring (no functional changes)

Checklist

• My code follows the project's coding guidelines
• I have run cargo fmt and cargo clippy
• I have added tests that prove my fix/feature works
• All new and existing tests pass (cargo test --all)

Testing

Test Configuration:

• OS: macOS (darwin 24.5.0)
• Rust version: stable

Test Steps:

1. cargo check — compiles with no warnings
2. cargo test --lib basic_auth — all 18 tests pass (5 new htpasswd module tests + existing plugin tests)
3. cargo audit — vulnerabilities reduced from 6 to 1 (remaining is upstream pingora's transitive protobuf dependency)

Additional Notes

Remaining issues are all from upstream pingora transitive dependencies and require upstream updates to resolve:

Type	Crate	Source
Vulnerability	protobuf 2.28.0	pingora-core → prometheus
Warning	daemonize 0.5.0	pingora-core
Warning	derivative 2.2.0	pingora-core / pingora-load-balancing
Warning	rustls-pemfile 2.2.0	tonic 0.12 / pingora-rustls