fix(desktop): update vulnerable Cargo dependencies

[luvs01]

Summary

The desktop lockfile selects serde_with 3.1.0 and time 0.3.44, inside the affected ranges of GHSA-7gcf-g7xr-8hxj and GHSA-r6v5-fh4h-64xc. Update them to 3.23.0 and 0.3.55 and move the exact serde/serde_json pins to the compatible 1.0.229/1.0.151 pair.

Declare Rust 1.88 as the desktop minimum. The existing locked graph already requires 1.88 through tauri -> image and reqwest -> url -> idna -> idna_adapter -> icu_normalizer; the previous 1.77 declaration did not describe a buildable locked graph. This changes the source-build requirement, not installed app configuration or the minimum operating-system versions. Keep dependency alerts open until the patched graph lands; no advisory suppression is added.

The higher declared MSRV enables Clippy's is_none_or simplifications. Apply the equivalent forms in the tray, supervisor and macOS widget conditions without changing their default behavior.

Verification

• Original and updated cargo metadata --locked --filter-platform x86_64-pc-windows-msvc: resolved; target advisory packages are outside the affected ranges.
• cargo +1.88.0 test --locked --manifest-path desktop/src-tauri/Cargo.toml -j 2: 151 passed, 0 failed on Windows; binary/doc-test targets also passed (0 tests).
• cargo +stable fmt --manifest-path desktop/src-tauri/Cargo.toml --check: passed with installed Rust 1.98.1.
• cargo +1.88.0 clippy --locked --manifest-path desktop/src-tauri/Cargo.toml --all-targets -j 4 -- -D warnings: passed after the MSRV-related simplifications.
• bun scripts/structure-ssot.ts: passed.
• bun scripts/privacy-scan.ts: passed.
• Exact-head Cross-platform CI 36364058224 passed at ccdb79c814ed362e8c5725bf9a09bc7b18c716c0, including all four general shards, both macOS shards, stable Rust checks, macOS widget/app bundle and Linux packaging/E2E. Conditional Windows/manual-only jobs remain skipped. No live app or proxy was upgraded during validation.
• Explicit dependency/security review remains required before merge.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Documentation
  • Updated desktop build guidance to require Rust 1.88 or newer and use the committed dependency lockfile.
  • Clarified dependency version requirements and confirmed that these updates do not change app configuration, the bundled model proxy, or minimum supported operating-system versions.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6940a9e4-b532-455a-8325-d1dc8c8b915b

📥 Commits

Reviewing files that changed from the base of the PR and between eb7f0f0 and ccdb79c.

⛔ Files ignored due to path filters (1)

• desktop/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• desktop/src-tauri/Cargo.toml
• desktop/src-tauri/src/companion_usage.rs
• desktop/src-tauri/src/native_tray_data.rs
• desktop/src-tauri/src/native_tray_snapshot.rs
• desktop/src-tauri/src/supervisor.rs
• desktop/src-tauri/src/widget.rs
• structure/desktop-shell.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The desktop crate now requires Rust 1.88 and pins newer serde and serde_json versions. Several desktop checks use Option::is_none_or while preserving their stated selection, filtering, defaulting, and reload conditions. The desktop-shell documentation records the build requirements.

Changes

Desktop crate updates

Layer / File(s)	Summary
Build requirements and dependency pins desktop/src-tauri/Cargo.toml:8,21-22, structure/desktop-shell.md:8-14	The crate’s minimum Rust version is now 1.88. The pinned serde and serde_json versions are now 1.0.229 and 1.0.151. The documentation records the lockfile and --locked requirement.
Optional-value checks desktop/src-tauri/src/companion_usage.rs:22-27, desktop/src-tauri/src/native_tray_data.rs:131-134, desktop/src-tauri/src/native_tray_snapshot.rs:10, desktop/src-tauri/src/supervisor.rs:358,375, desktop/src-tauri/src/widget.rs:299-300	These checks use Option::is_none_or instead of explicit matches or map_or(true, ...). The summaries state that their previous conditions and outcomes are preserved.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to ccdb7

The desktop dependency versions are updated, and the inspected build workflows do not use an older Rust toolchain. No concrete merge-blocking issue is established in the available evidence.

Architecture Summary

Architecture risk: 🟡 Medium · up to ccdb7

The change affects 2 systems.

Changed systems: desktop, structure

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — desktop (service) was modified; 6 changed files map to changed impact.
• observed — structure (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in desktop/src-tauri/Cargo.toml: The crate’s minimum Rust version increases from 1.77 to 1.88.
• observed — Modified behavior in desktop/src-tauri/Cargo.toml: The pinned versions of serde and serde_json increase from 1.0.219 to 1.0.229 and from 1.0.140 to 1.0.151, respectively.
• observed — Modified behavior in desktop/src-tauri/src/companion_usage.rs: selected replaces a match on settings["models"] with is_none_or: a non-array value still allows the row, while an array requires a matching model name or provider/model entry.
• observed — Modified behavior in desktop/src-tauri/src/native_tray_data.rs: The source filter retains sources when settings are absent or when snapshot::hidden returns false, replacing the explicit None/Some match with is_none_or.

Reliability and maintainability

• inferred — Risk-relevant change factors for desktop: blast_radius_1; direct_dependents_1

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the primary change: updating vulnerable desktop Cargo dependencies. It is concise and specific enough for the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 64 / 80

데스크톱 Rust 잠금 파일에 걸린 보안 경고 두 개를 지우는 수정이다. 앱 설정, 같이 넣는 모델 프록시, 지원 운영체제의 최소 버전은 그대로다. 베이스는 dev다.

serde_with 3.1.0은 빈 항목을 직렬화할 때 프로그램이 죽을 수 있다(GHSA-7gcf-g7xr-8hxj, 중간). 3.21.0부터 고쳐졌고, 이 PR은 3.23.0이다. 이 크레이트는 tauri-utils가 쓴다.

time 0.3.44는 나쁜 시간 문자열을 깊게 읽으면 스택이 넘칠 수 있다(GHSA-r6v5-fh4h-64xc, CVE-2026-25727, 중간). 0.3.47부터 고쳐졌고, 이 PR은 0.3.55다. 잠금 파일에서 time을 가리키는 곳은 cookie, plist, tauri-codegen, tauri-plugin-updater, serde_with다.

serde는 1.0.229, serde_json은 1.0.151로 정확히 고정했다. 새 serde_with와 맞는 짝이고, 잠금 파일의 serde는 그 버전 하나다. serde_json 1.0.151은 숫자를 읽는 zmij를 항상 가져온다. Rust 최소 버전은 1.77에서 1.88이다. 이미 잠겨 있던 image 0.25.10과 icu_normalizer 2.3.0이 1.88을 요구하고, 이번에 올린 serde_with 3.23.0과 time 0.3.55도 1.88이다. 1.88에서 쓸 수 있는 is_none_or로 트레이, 감독, macOS 위젯의 "없으면 참" 조건을 같은 뜻으로 바꿨다.

라인 - desktop/src-tauri/Cargo.lock. 잠금 파일 형식이 3에서 4로 바뀌었다. Rust 1.88의 cargo가 쓰는 형식이라 최소 버전 선언과는 맞다. diff가 커진 이유의 일부다.

라인 - desktop/src-tauri/Cargo.lock의 serde_with 3.23.0. jiff, defmt, schemars 0.9.0, schemars 1.2.2, bs58가 새로 잠긴다. tauri-utils 2.9.3은 serde_with에 추가 기능을 켜지 않고, 기본 기능은 std와 macros뿐이다. 이 크레이트들은 그 기본 기능 밖이라 데스크톱 바이너리에 바로 들어가지 않는다. 잠금 파일 전체를 훑는 알림은 이들을 검사 대상에 넣는다.

메인테이너의 판단이 필요한 지점

이 PR은 아직 draft다. CodeRabbit은 draft라서 리뷰를 건너뛰었다. 본문은 Windows에서만 cargo test를 돌렸다고 적는다. widget.rs의 변경은 mod macos 안이라 그 테스트에 들어가지 않는다. 바꾼 식은 예전 map_or(true, ...)와 None이면 참과 같다.

보안 체크는 비어 있다. 비밀, 로그인, 기본 권한을 바꾸는 코드는 없다. 두 크레이트 버전은 권고 범위 밖이다. 같은 수정의 다른 열린 PR은 없고, 닫을 중복도 없다.

너의 추천

draft를 풀고 CI가 통과하면 머지하면 된다. Rust 1.88 선언은 이미 잠긴 그래프와 이번 패치 버전 모두와 맞다. 트레이와 위젯 조건은 동작을 바꾸지 않는다. CI에서 cargo tree로 jiff, defmt, schemars가 기본 빌드에 안 붙는지만 보면 된다.

이 댓글은 grok-bot이 작성했습니다

[Ingwannu]

Approved at exact head ccdb79c814ed362e8c5725bf9a09bc7b18c716c0. The Rust 1.88 declaration matches the updated lockfile/toolchain floor; the Option::is_none_or rewrites preserve the prior None/map_or semantics; serde/serde_json pins and the serde_with/time lock updates are internally consistent. Exact-head Cross-platform CI run 36364058224 completed successfully across all four Linux shards, both macOS shards, gates, macOS widget+bundle, and desktop shell. Windows full shards are policy-skipped, but the Windows keyring and service lifecycle jobs passed. No blocking source or lockfile inconsistency found.