fix(deps): patch tar & rkyv advisories, document glib unsoundness - #249
Merged
Conversation
Resolves the fixable Dependabot alerts and records the one blocked upstream: - tar 0.4.45 -> 0.4.46: PAX header desynchronization (GHSA-3pv8-6f4r-ffg2) - rkyv 0.8.15 -> 0.8.16: panic-safety bugs in InlineVec/SerVec clear that enable arbitrary code execution (GHSA-vfvv-c25p-m7mm) glib 0.18 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429, VariantStrIter unsoundness) is patched in glib 0.20, but gtk 0.18 -- pinned transitively by tauri 2.11 on Linux -- requires glib ^0.18, so it cannot be bumped until Tauri adopts gtk-rs 0.20. It is warn-level (unsoundness) and does not gate CI; documented as an accepted, upstream-blocked advisory in src-tauri/deny.toml and .cargo/audit.toml alongside the existing GTK-stack entries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request addresses dependency security advisories by updating Rust lockfile-resolved crate versions and documenting an upstream-blocked advisory in the RustSec/audit configuration so CI can pass while risk is tracked.
Changes:
- Bumps
tarto0.4.46andrkyv/rkyv_deriveto0.8.16viaCargo.lockupdates. - Adds
RUSTSEC-2024-0429(glibVariantStrIterunsoundness) tocargo-denyandcargo-auditignore lists with explanatory comments.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src-tauri/deny.toml |
Adds RUSTSEC-2024-0429 to the cargo-deny ignore list with rationale. |
Cargo.lock |
Updates resolved dependency versions, including tar and rkyv (plus additional resolution churn). |
.cargo/audit.toml |
Documents/ignores upstream-blocked advisories so cargo audit remains green. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
12
to
16
| "RUSTSEC-2024-0414", # gdk-pixbuf: GTK3 unmaintained (Tauri Linux) | ||
| "RUSTSEC-2024-0415", # gio: GTK3 unmaintained (Tauri Linux) | ||
| "RUSTSEC-2024-0416", # glib: GTK3 unmaintained (Tauri Linux) | ||
| "RUSTSEC-2024-0429", # glib: VariantStrIter unsoundness, fixed in glib 0.20; blocked by Tauri's gtk-rs 0.18 pin (Tauri Linux) | ||
| "RUSTSEC-2024-0417", # pango: GTK3 unmaintained (Tauri Linux) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the fixable Dependabot alerts on the default branch and documents the one that is blocked upstream.
Fixed (lockfile bumps)
tar0.4.45 → 0.4.46rkyvInlineVec/SerVecclearenabling arbitrary code execution0.8.15 → 0.8.16Both are pure
Cargo.lockpatch bumps (rkyvreaches us transitively viafaststr → sonic-rs → evtx).Cannot fix — documented instead
glibVariantStrIterunsoundnessglibis a Linux-only transitive dependency of Tauri's GTK backend:glib 0.18 ← gtk 0.18 ← tauri 2.11.5.gtk 0.18requiresglib ^0.18, so the patchedglib 0.20is unreachable until Tauri adopts gtk-rs 0.20. The advisory is unsoundness (warn-level), so it does not gate CI. It's recorded as an accepted, upstream-blocked advisory insrc-tauri/deny.tomland.cargo/audit.toml, alongside the existing GTK-stack entries. The alert is being dismissed as tolerable risk; it will clear automatically when a future Tauri release moves to glib 0.20.Verification
cargo check— clean (tar 0.4.46rebuilt viatauri-plugin-updater)cargo audit(repo root) — exit 0, glib now among suppressed warningscargo deny check(fromsrc-tauri, as CI runs it) — advisories/bans/licenses/sources all ok🤖 Generated with Claude Code