5154c5276b
All checks were successful
PR Check — Rust / rust (pull_request) Successful in 10m1s
The daily audit has failed every morning since 2026-08-19 (runs 375 to 391, 17 consecutive reds). Nothing was pushed to main in that window: RUSTSEC-2026-0258 was published on 08-17 and reached the advisory-db two days later. Empty HTTP/2 DATA frames are queued without limit, so an undrained stream grows memory without bound and can overflow into a panic. Low severity, denial of service, patched in 0.4.16. h2 is reachable on both shipped targets, checked per triple rather than with --target all: through tauri-plugin-updater -> reqwest 0.13.2 for the automatic updater, and through the app's own reqwest 0.12.28 for the licence, auth, price and feedback calls. A published fix plus a reachable crate is rule 1 of .cargo/audit.toml, so this gets fixed rather than suppressed; the suppression list and the check-rust guard are both untouched. Only the h2 stanza moves. Running `cargo update -p h2` also re-resolves seven windows-sys pointers from 0.61.2 down to 0.48/0.52/0.59, which is what #321 deliberately reverted three weeks ago after proving 0.61.2 is the state of the v0.14.0 tag and therefore the only windows-sys configuration that has actually compiled under Windows. Letting the re-resolution stand would regress that decision silently, so the bump is applied to the lockfile as a two-line change instead. `cargo metadata --locked` accepts the result without rewriting it. Verified: cargo check and cargo test --all-targets green (111 passed), cargo-audit 0.22.2 exits 0 with the same 22 allowed warnings as before, and the same binary still exits 1 on the previous lockfile — so the green is a real change of state, not a differently configured tool. Resolves #343 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RhPofpLQTZUbkVYR3i2e2D |
||
|---|---|---|
| .. | ||
| capabilities | ||
| icons | ||
| src | ||
| .gitignore | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| tauri.conf.json | ||