c5efc38e96
All checks were successful
PR Check — Rust / rust (pull_request) Successful in 4m14s
Clears RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 on zip 4.6.1, which turned the daily audit.yml red at run 558 (2026-10-17) without any lockfile change. zip was compiled only for Windows, through the default `zip` feature of tauri-plugin-updater 2.10.0. It is fixed only in zip >= 9.0.0, and tauri-plugin-updater 2.14.0 still requires zip ^4, so no cargo update can reach a fix. That feature only unpacks archived update packages (.nsis.zip, .msi.zip, .AppImage.tar.gz, produced by createUpdaterArtifacts "v1Compatible"); this app ships createUpdaterArtifacts: true, whose packages are never archives. The updater is now declared without its default features, keeping rustls-tls. The lockfile loses zip, arbitrary and derive_arbitrary (666 -> 663 packages, nothing added), and tar leaves the Linux graph. tar was the canary of the suppression guard in check-rust.yml. It is replaced by webkit2gtk, Tauri's Linux webview, which keeps the property that made tar useful: a dependency present on x86_64-unknown-linux-gnu only, so finding it also proves that --target resolves conditional edges. ADR 0018, architecture.md, qa-update-cycle.md and the release skill are updated to match. Verified locally: cargo-audit 0.22.2 exits 1 on the old lock with the three IDs and 0 on the new one (663 crates, the same 12 allowed warnings); the suppression guard is green, and red with the canary swapped for tar or zip; windows-sys guard 9/9; cargo check and cargo test (267 passed) on Linux; cargo xwin check for x86_64-pc-windows-msvc is green on main (zip compiled) and on this branch (zip gone). Refs #455 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 0001-tauri-v2.md | ||
| 0002-useReducer-vs-redux.md | ||
| 0003-sqlx-migrations.md | ||
| 0004-aes-256-gcm-encryption.md | ||
| 0005-multi-profile-db.md | ||
| 0006-oauth-tokens-keychain.md | ||
| 0007-reports-hub-refactor.md | ||
| 0008-modified-dietz-pour-rendement.md | ||
| 0009-proxy-price-fetching-via-maximus-api.md | ||
| 0010-fk-restrict-balance-transfers.md | ||
| 0011-providers-best-effort-yahoo.md | ||
| 0012-balance-two-level-model.md | ||
| 0013-stocks-provider-evaluation.md | ||
| 0014-balance-vehicule-attribut.md | ||
| 0015-balance-detail-par-titre.md | ||
| 0016-persistance-etat-ui-par-profil.md | ||
| 0017-feature-gating-par-tier.md | ||
| 0018-suppression-advisories-non-atteignables.md | ||
| 0019-format-import-persiste.md | ||
| 0020-identifiant-machine-derive.md | ||
| 0021-migrations-profils-secondaires.md | ||
| 0022-canal-evenements-donnees.md | ||
| 0023-windows-sys-pinning.md | ||
| 0024-serveur-mcp.md | ||