Skip to content

fix(deps): patch tar & rkyv advisories, document glib unsoundness #249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamgell merged 1 commit into from
Jul 13, 2026
Merged

fix(deps): patch tar & rkyv advisories, document glib unsoundness #249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions .cargo/audit.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,19 @@
# cargo-audit does NOT read src-tauri/deny.toml, so vulnerability advisories
# that cannot be resolved by a version bump must be listed here as well.
#
# quick-xml <0.41 enters only transitively and cannot be upgraded without
# bumping the Tauri stack itself: it comes in via `plist` (a Tauri dependency,
# all platforms) and via `wayland-scanner` build tooling on Linux. Neither is a
# direct dependency we control. Keep this list in sync with the corresponding
# entries in src-tauri/deny.toml.
# These advisories enter only transitively via the Tauri stack and cannot be
# resolved by a version bump we control:
#
# * quick-xml <0.41 comes in via `plist` (a Tauri dependency, all platforms) and
# via `wayland-scanner` build tooling on Linux.
# * glib 0.18 (RUSTSEC-2024-0429) is fixed in glib 0.20, but Tauri v2 pins the
# gtk-rs 0.18 stack on Linux (gtk 0.18 requires glib ^0.18); it clears only
# once Tauri adopts gtk-rs 0.20.
#
# Keep this list in sync with the corresponding entries in src-tauri/deny.toml.
[advisories]
ignore = [
"RUSTSEC-2024-0429", # glib: VariantStrIter unsoundness, fixed in glib 0.20; blocked by Tauri's gtk-rs 0.18 pin (Tauri Linux)
"RUSTSEC-2026-0194", # quick-xml <0.41: quadratic runtime on duplicate attrs (transitive: plist/Tauri, wayland-scanner)
"RUSTSEC-2026-0195", # quick-xml <0.41: unbounded namespace-declaration alloc (transitive: plist/Tauri, wayland-scanner)
]
56 changes: 25 additions & 31 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions src-tauri/deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ ignore = [
"RUSTSEC-2024-0414", # gdk-pixbuf: GTK3 unmaintained (Tauri Linux)
"RUSTSEC-2024-0415", # gio: GTK3 unmaintained (Tauri Linux)
"RUSTSEC-2024-0416", # glib: GTK3 unmaintained (Tauri Linux)
"RUSTSEC-2024-0429", # glib: VariantStrIter unsoundness, fixed in glib 0.20; blocked by Tauri's gtk-rs 0.18 pin (Tauri Linux)
"RUSTSEC-2024-0417", # pango: GTK3 unmaintained (Tauri Linux)
Comment on lines 12 to 16
"RUSTSEC-2024-0418", # cairo-rs: GTK3 unmaintained (Tauri Linux)
"RUSTSEC-2024-0419", # gtk-sys etc: GTK3 unmaintained (Tauri Linux)
Expand Down
Loading