Skip to content

Bump dependencies to resolve 33 Dependabot security alerts - #8

Merged
jasonsmithio merged 1 commit into
mainfrom
deps/cargo-update-security
May 13, 2026
Merged

Bump dependencies to resolve 33 Dependabot security alerts#8
jasonsmithio merged 1 commit into
mainfrom
deps/cargo-update-security

Conversation

@jasonsmithio

@jasonsmithio jasonsmithio commented May 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

cargo update against main, plus two small fixes to keep the workspace compiling. Closes 33 of 44 open Dependabot alerts on this repo, including both criticals (wasmtime aarch64 sandbox escapes).

Resolved (33 alerts)

Crate Old → New Alerts
wasmtime (+ siblings) 36.0.6 → 36.0.9 10 (incl. #24 critical, #28 critical)
openssl 0.10.x → 0.10.79 6
aws-lc-sys → 0.41.0 5
rustls-webpki (0.103 branch) → 0.103.13 1 of 4
quinn-proto → 0.11.14 1
rand → 0.9.4 / 0.8.6 2
rpassword → 7.5.2 1
aws-sdk-sso / ssooidc / sts bumped 3

Code changes

  • tooling/compliance/src/github.rs — octocrab::Octocrab::graphql<R> now requires R: DeserializeOwned. Added the bound to OctocrabClient::graphql.
  • jupyter-websocket-client pinned to 1.0.0 in the lockfile. 1.1.0 added a protocol_mode field to JupyterWebSocket and pulled async-tungstenite 0.34, which conflicts with the workspace pin at 0.31. Not a security fix, so we hold the line rather than rewrite crates/repl/src/kernels/remote_kernels.rs.

Not resolved (6 Rust alerts, deferred)

Each is pinned by a transitive dep that needs a bigger bump:

Crate Pinned by Alerts
rustls-webpki 0.101.7 aws-config → aws-smithy-http-client → rustls 0.21 #31, #32, #41
grid 0.18.0 taffy 0.9.0 (gpui layout) #40
lru 0.12.5 aws-sdk-s3 #2
glib 0.18.5 wry / webkit2gtk (Linux WebView) #1

These should be handled in follow-up PRs that bump taffy, aws-sdk-*, and wry, or with [patch] overrides if upstream is slow.

npm alerts

The 5 alerts in script/danger/pnpm-lock.yaml are in Zed's Danger.js CI tooling — not shipped to users. Easy follow-up: pnpm update inside script/danger.

Test plan

  • cargo check --workspace passes
  • ./script/clippy (run in CI)
  • Smoke-test launching the app and opening a project
  • Smoke-test the REPL feature (jupyter-websocket-client was pinned)

Release Notes:

  • N/A

@jasonsmithio
jasonsmithio merged commit 98fa8b1 into main May 13, 2026
22 of 23 checks passed
@jasonsmithio
jasonsmithio deleted the deps/cargo-update-security branch May 16, 2026 23:26
jasonsmithio added a commit that referenced this pull request May 20, 2026
@jasonsmithio @claude
PR #37 workspace green: clusters #7 + #8 (agent_ui history bridge + p…
3a592ef 
…addleboard)

Final two clusters of the PR #37 upstream-merge cleanup. Workspace went
from 27 errors (in cluster #7 start) to 0 errors across all crates.
`cargo check --workspace` now finishes successfully.

Cluster #7 (agent_ui): Instead of restoring PB-main's full ActiveView
state machine (~1000 LOC), bridged PB's history-panel feature to
upstream's new BaseView + OverlayView layered model. PB's history view
slots into OverlayView::History alongside the existing Configuration
overlay, getting "back to previous view" semantics for free via
clear_overlay().

Key changes:
- Add OverlayView::History { view: Entity<ThreadHistoryView> } and
  parallel VisibleSurface::History plumbing (focus, title, render).
- Rewrite open_history against the overlay model.
- background_threads → retained_threads for all_conversation_views().
- AgentConnectionEntry::history() stub returning None (followup: wire
  per-agent history when AcpConnection backends support it).
- ConversationView::{workspace, delete_history_entry, navigate_to_session}
  — workspace is a real getter; the other two are stubs while
  AgentConnectionEntry::history() is disabled.
- gpui::Corner → gpui::Anchor (with alias to preserve callsites).
- Restored RemoveHistory action; dropped dead WorktreeCreationStatus
  re-export and AgentV2FeatureFlag import; renamed OpenAcpOnboardingModal
  → OpenOnboardingModal.
- Match-arm exhaustiveness: AgentIdOrLegacyAgent::LegacyAgent(Gemini)
  falls back to NativeAgent.id(); EditPredictionProvider::Experimental(_)
  hides edit-prediction namespace (same as None).
- supports_delete() gained a &App arg (passed through at all 4 callsites).
- Expanded thread_import re-exports for sidebar crate.

Cluster #8 (paddleboard binary, 3 errors → 0):
- Added `Error` and `editor::Editor` to imports.
- EditPredictionProvider::Experimental(_) match arm.
- Mapped tasks-future results through `.map(|_| ())` to match the
  Vec<Result<(), Error>> type.

Followups captured in RECAPS:
- Per-agent thread history (AgentConnectionEntry::history) re-enable.
- load_agent_thread bridge for ThreadHistoryViewEvent::Open callsites.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
jasonsmithio added a commit that referenced this pull request May 31, 2026
@jasonsmithio
Merge pull request #8 from jasonsmithio/deps/cargo-update-security
3148091 
Bump dependencies to resolve 33 Dependabot security alerts
jasonsmithio added a commit that referenced this pull request May 31, 2026
@jasonsmithio @claude
PR #37 workspace green: clusters #7 + #8 (agent_ui history bridge + p…
bd467db 
…addleboard)

Final two clusters of the PR #37 upstream-merge cleanup. Workspace went
from 27 errors (in cluster #7 start) to 0 errors across all crates.
`cargo check --workspace` now finishes successfully.

Cluster #7 (agent_ui): Instead of restoring PB-main's full ActiveView
state machine (~1000 LOC), bridged PB's history-panel feature to
upstream's new BaseView + OverlayView layered model. PB's history view
slots into OverlayView::History alongside the existing Configuration
overlay, getting "back to previous view" semantics for free via
clear_overlay().

Key changes:
- Add OverlayView::History { view: Entity<ThreadHistoryView> } and
  parallel VisibleSurface::History plumbing (focus, title, render).
- Rewrite open_history against the overlay model.
- background_threads → retained_threads for all_conversation_views().
- AgentConnectionEntry::history() stub returning None (followup: wire
  per-agent history when AcpConnection backends support it).
- ConversationView::{workspace, delete_history_entry, navigate_to_session}
  — workspace is a real getter; the other two are stubs while
  AgentConnectionEntry::history() is disabled.
- gpui::Corner → gpui::Anchor (with alias to preserve callsites).
- Restored RemoveHistory action; dropped dead WorktreeCreationStatus
  re-export and AgentV2FeatureFlag import; renamed OpenAcpOnboardingModal
  → OpenOnboardingModal.
- Match-arm exhaustiveness: AgentIdOrLegacyAgent::LegacyAgent(Gemini)
  falls back to NativeAgent.id(); EditPredictionProvider::Experimental(_)
  hides edit-prediction namespace (same as None).
- supports_delete() gained a &App arg (passed through at all 4 callsites).
- Expanded thread_import re-exports for sidebar crate.

Cluster #8 (paddleboard binary, 3 errors → 0):
- Added `Error` and `editor::Editor` to imports.
- EditPredictionProvider::Experimental(_) match arm.
- Mapped tasks-future results through `.map(|_| ())` to match the
  Vec<Result<(), Error>> type.

Followups captured in RECAPS:
- Per-agent thread history (AgentConnectionEntry::history) re-enable.
- load_agent_thread bridge for ThreadHistoryViewEvent::Open callsites.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jasonsmithio