diff --git a/.cargo/audit.toml b/.cargo/audit.toml index c8634f161..29e7dd8d6 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -3,13 +3,19 @@ # cargo-audit does NOT read src-tauri/deny.toml, so vulnerability advisories # that cannot be resolved by a version bump must be listed here as well. # -# quick-xml <0.41 enters only transitively and cannot be upgraded without -# bumping the Tauri stack itself: it comes in via `plist` (a Tauri dependency, -# all platforms) and via `wayland-scanner` build tooling on Linux. Neither is a -# direct dependency we control. Keep this list in sync with the corresponding -# entries in src-tauri/deny.toml. +# These advisories enter only transitively via the Tauri stack and cannot be +# resolved by a version bump we control: +# +# * quick-xml <0.41 comes in via `plist` (a Tauri dependency, all platforms) and +# via `wayland-scanner` build tooling on Linux. +# * glib 0.18 (RUSTSEC-2024-0429) is fixed in glib 0.20, but Tauri v2 pins the +# gtk-rs 0.18 stack on Linux (gtk 0.18 requires glib ^0.18); it clears only +# once Tauri adopts gtk-rs 0.20. +# +# Keep this list in sync with the corresponding entries in src-tauri/deny.toml. [advisories] ignore = [ + "RUSTSEC-2024-0429", # glib: VariantStrIter unsoundness, fixed in glib 0.20; blocked by Tauri's gtk-rs 0.18 pin (Tauri Linux) "RUSTSEC-2026-0194", # quick-xml <0.41: quadratic runtime on duplicate attrs (transitive: plist/Tauri, wayland-scanner) "RUSTSEC-2026-0195", # quick-xml <0.41: unbounded namespace-declaration alloc (transitive: plist/Tauri, wayland-scanner) ] diff --git a/Cargo.lock b/Cargo.lock index 7bd316e89..5ddb6133b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -124,7 +124,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -135,7 +135,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -1065,7 +1065,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1346,7 +1346,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1410,7 +1410,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1ca7d44d22004409a61c393afb3369c8f7bb74abcae49fe249ee01dcc3002113" dependencies = [ "bytes", - "rkyv 0.8.15", + "rkyv 0.8.16", "serde", "simdutf8", ] @@ -2021,12 +2021,6 @@ dependencies = [ "foldhash 0.1.5", ] -[[package]] -name = "hashbrown" -version = "0.16.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" - [[package]] name = "hashbrown" version = "0.17.0" @@ -2412,7 +2406,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2471,7 +2465,7 @@ dependencies = [ "portable-atomic", "portable-atomic-util", "serde_core", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2810,7 +2804,7 @@ dependencies = [ "png 0.18.1", "serde", "thiserror 2.0.18", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3230,7 +3224,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.45.0", ] [[package]] @@ -3949,18 +3943,18 @@ dependencies = [ [[package]] name = "rkyv" -version = "0.8.15" +version = "0.8.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a30e631b7f4a03dee9056b8ef6982e8ba371dd5bedb74d3ec86df4499132c70" +checksum = "73389e0c99e664f919275ab5b5b0471391fe9a8de61e1dff9b1eaf56a90f16e3" dependencies = [ "bytes", - "hashbrown 0.16.1", + "hashbrown 0.17.0", "indexmap 2.14.0", "munge", "ptr_meta 0.3.1", "rancor", "rend 0.5.3", - "rkyv_derive 0.8.15", + "rkyv_derive 0.8.16", "tinyvec", "uuid", ] @@ -3978,9 +3972,9 @@ dependencies = [ [[package]] name = "rkyv_derive" -version = "0.8.15" +version = "0.8.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8100bb34c0a1d0f907143db3149e6b4eea3c33b9ee8b189720168e818303986f" +checksum = "5d2ed0b54125315fb36bd021e82d314d1c126548f871634b483f46b31d13cac6" dependencies = [ "proc-macro2", "quote", @@ -4029,7 +4023,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4086,7 +4080,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4509,7 +4503,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -4775,9 +4769,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369" [[package]] name = "tar" -version = "0.4.45" +version = "0.4.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973" +checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840" dependencies = [ "filetime", "libc", @@ -5166,10 +5160,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.2", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5553,7 +5547,7 @@ dependencies = [ "png 0.18.1", "serde", "thiserror 2.0.18", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -6168,7 +6162,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6672,7 +6666,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10" dependencies = [ "cfg-if", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] diff --git a/src-tauri/deny.toml b/src-tauri/deny.toml index b6b3b9a38..63e75afb8 100644 --- a/src-tauri/deny.toml +++ b/src-tauri/deny.toml @@ -12,6 +12,7 @@ ignore = [ "RUSTSEC-2024-0414", # gdk-pixbuf: GTK3 unmaintained (Tauri Linux) "RUSTSEC-2024-0415", # gio: GTK3 unmaintained (Tauri Linux) "RUSTSEC-2024-0416", # glib: GTK3 unmaintained (Tauri Linux) + "RUSTSEC-2024-0429", # glib: VariantStrIter unsoundness, fixed in glib 0.20; blocked by Tauri's gtk-rs 0.18 pin (Tauri Linux) "RUSTSEC-2024-0417", # pango: GTK3 unmaintained (Tauri Linux) "RUSTSEC-2024-0418", # cairo-rs: GTK3 unmaintained (Tauri Linux) "RUSTSEC-2024-0419", # gtk-sys etc: GTK3 unmaintained (Tauri Linux)