2d4caecae8
All checks were successful
PR Check — Rust / rust (pull_request) Successful in 9m23s
The removal trigger #312 was written for had already fired — I filed the issue without checking whether a newer plist existed. plist 1.10.0 ships quick-xml 0.41.0, which carries the fix, within tauri's existing bound: cargo update -p plist -> plist 1.8.0 -> 1.10.0 quick-xml 0.38.4 -> 0.41.0 So RUSTSEC-2026-0194 and -0195 are resolved rather than accepted, and leave .cargo/audit.toml the day they entered it. rsa is now the only entry, and the guard loops on that crate alone; its rationale comment is re-pointed accordingly, since it was written entirely around quick-xml/plist. Also bumps the two yanked crates (#313). tauri-plugin-deep-link 2.4.8 -> 2.4.9: upstream's 2.4.9 is a single commit, "Fix broken iOS custom URL schemes", so the defect behind the yank is iOS-only and never reached this desktop app — v0.14.0 shipping 2.4.8 was not a user-facing problem, which is why neither Security nor Fixed applies to it in the changelog. spin 0.9.8 -> 0.9.9; every 0.9.x up to 0.9.8 is yanked, which reads as a bulk yank rather than a defect. The #310 changelog bullet is amended rather than contradicted: it sits in the same unreleased section and would otherwise ship two opposing claims in the same release notes. Two of its statements were wrong. It said three advisories remained (now one), and it said tar sits on "real code paths in the shipped app" — tar is compiled, but its vulnerable extraction path is only reached by the AppImage and macOS installers this project does not bundle. The rustls-webpki half stands: TLS runs on every update check. ADR 0018's decision is untouched; an amendment header marks the passages that are now historical, including the "override is impossible" alternative, which plist 1.10.0 made false the same day. cargo audit from the repo root: 0 vulnerabilities, warnings 23 -> 21 (the two yanked ones). From src-tauri/ it reports 1 — that is the cwd sensitivity of .cargo/audit.toml, not a regression. Guard: 2 checks + canary, exit 0. cargo check + cargo test green (106 tests). Lock diff: 4 packages, 666 before and after. Resolves #312 Resolves #313 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| audit.yml | ||
| check-frontend.yml | ||
| check-rust.yml | ||
| release.yml | ||