c5efc38e96
All checks were successful
PR Check — Rust / rust (pull_request) Successful in 4m14s
Clears RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 on zip 4.6.1, which turned the daily audit.yml red at run 558 (2026-10-17) without any lockfile change. zip was compiled only for Windows, through the default `zip` feature of tauri-plugin-updater 2.10.0. It is fixed only in zip >= 9.0.0, and tauri-plugin-updater 2.14.0 still requires zip ^4, so no cargo update can reach a fix. That feature only unpacks archived update packages (.nsis.zip, .msi.zip, .AppImage.tar.gz, produced by createUpdaterArtifacts "v1Compatible"); this app ships createUpdaterArtifacts: true, whose packages are never archives. The updater is now declared without its default features, keeping rustls-tls. The lockfile loses zip, arbitrary and derive_arbitrary (666 -> 663 packages, nothing added), and tar leaves the Linux graph. tar was the canary of the suppression guard in check-rust.yml. It is replaced by webkit2gtk, Tauri's Linux webview, which keeps the property that made tar useful: a dependency present on x86_64-unknown-linux-gnu only, so finding it also proves that --target resolves conditional edges. ADR 0018, architecture.md, qa-update-cycle.md and the release skill are updated to match. Verified locally: cargo-audit 0.22.2 exits 1 on the old lock with the three IDs and 0 on the new one (663 crates, the same 12 allowed warnings); the suppression guard is green, and red with the canary swapped for tar or zip; windows-sys guard 9/9; cargo check and cargo test (267 passed) on Linux; cargo xwin check for x86_64-pc-windows-msvc is green on main (zip compiled) and on this branch (zip gone). Refs #455 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
3.7 KiB
TOML
86 lines
3.7 KiB
TOML
[package]
|
|
name = "simpl-result"
|
|
version = "0.17.1"
|
|
description = "Personal finance management app"
|
|
license = "GPL-3.0-only"
|
|
authors = ["you"]
|
|
edition = "2021"
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
[lib]
|
|
# The `_lib` suffix may seem redundant but it is necessary
|
|
# to make the lib name unique and wouldn't conflict with the bin name.
|
|
# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
|
|
name = "simpl_result_lib"
|
|
crate-type = ["staticlib", "cdylib", "rlib"]
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
|
|
[dependencies]
|
|
tauri = { version = "2", features = [] }
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-sql = { version = "2", features = ["sqlite"] }
|
|
tauri-plugin-dialog = "2"
|
|
# Built without its default `zip` feature (#455): that feature only pulls
|
|
# `zip` on Windows and `tar` on Linux to unpack archived update packages, and
|
|
# ours are never archives (`createUpdaterArtifacts: true` serves the NSIS
|
|
# `.exe`, the `.deb` and the `.rpm` as they are). Restore it only if
|
|
# `createUpdaterArtifacts` becomes "v1Compatible" (docs/qa-update-cycle.md).
|
|
tauri-plugin-updater = { version = "2", default-features = false, features = ["rustls-tls"] }
|
|
tauri-plugin-process = "2"
|
|
tauri-plugin-deep-link = "2"
|
|
tauri-plugin-single-instance = { version = "2", features = ["deep-link"] }
|
|
libsqlite3-sys = { version = "0.30", features = ["bundled"] }
|
|
rusqlite = { version = "0.32", features = ["bundled"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
sha2 = "0.10"
|
|
encoding_rs = "0.8"
|
|
walkdir = "2"
|
|
aes-gcm = "0.10"
|
|
argon2 = "0.5"
|
|
subtle = "2"
|
|
rand = "0.8"
|
|
jsonwebtoken = "9"
|
|
machine-uid = "0.5"
|
|
reqwest = { version = "0.12", features = ["json"] }
|
|
# Date arithmetic for the Modified Dietz return calculator (Issue #142):
|
|
# we need day-precision diffs to weight cash flows W_i = (T - t_i) / T.
|
|
# `serde` feature lets `NaiveDate` cross the Tauri command boundary in JSON.
|
|
chrono = { version = "0.4", default-features = false, features = ["serde", "std"] }
|
|
tokio = { version = "1", features = ["macros"] }
|
|
hostname = "0.4"
|
|
urlencoding = "2"
|
|
base64 = "0.22"
|
|
# OAuth token storage in OS keychain (Credential Manager on Windows,
|
|
# Secret Service on Linux). We use sync-secret-service to get sync
|
|
# methods that are safe to call from async Tauri commands without
|
|
# tokio runtime entanglement. Requires libdbus-1-dev at build time
|
|
# on Linux (libdbus-1-3 is present on every desktop Linux at runtime).
|
|
keyring = { version = "3.6", default-features = false, features = ["sync-secret-service", "crypto-rust", "windows-native"] }
|
|
zeroize = "1"
|
|
hmac = "0.12"
|
|
|
|
[dev-dependencies]
|
|
# Used in license_commands.rs tests to sign test JWTs. We avoid the `pem`
|
|
# feature because the `LineEnding` re-export path varies between versions
|
|
# of pkcs8/spki; building the PKCS#8 DER manually is stable and trivial
|
|
# for Ed25519.
|
|
ed25519-dalek = { version = "2", features = ["pkcs8", "rand_core"] }
|
|
# HTTP mock server for balance_commands fetch_price tests (Issue #155).
|
|
mockito = "1.6"
|
|
# MockRuntime for the profile database folder test (#390). The `test`
|
|
# feature adds no crate (`test = []` in tauri's manifest).
|
|
tauri = { version = "2", features = ["test"] }
|
|
|
|
[features]
|
|
# Dev-only escape hatch: when enabled, the SR_DEV_EDITION env var forces the
|
|
# resolved edition (free|base|premium) so the three license tiers can be tested
|
|
# without real license files. MUST stay out of `default` and of any release
|
|
# feature set — gating this on debug_assertions instead would let a custom
|
|
# release build honor the env var and become a Premium backdoor (CWE-489).
|
|
# Usage: cargo test --features dev-override, or `tauri dev` with
|
|
# `-- --features dev-override`.
|
|
dev-override = []
|