Skip to content

Commit a435e65

Browse files
louistruelouistrue
authored
chore(security): resolve 42 dependabot alerts via overrides + cargo bumps (#675)
Bump npm + rust deps to patched versions and migrate `fast-float` to its maintained fork `fast-float2`. Vite jump (5/6/7 → 7.3.3) forced a vitest jump (1.6 → 3.2.4) for module-evaluator compatibility. NPM (resolved 39): esbuild 0.25, protobufjs 8.3, protocol-buffers-schema 3.6.1, postcss 8.5.14, dompurify 3.4.3, vite 7.3.3 (single), lodash 4.18, picomatch 2.3.2/4.0.4, tar 7.5.15, rollup 4.60.3, vitest 3.2.4. Rust (resolved 3): tauri 2.10.3 → 2.11.1, `cargo update` removed rand 0.7.3 (phf_generator 0.8 → 0.13), fast-float → fast-float2 0.2.3. Unfixed (2, no upstream patch): glib 0.18.5 via gtk-rs 0.18 under Tauri/wry, thrift 0.17.0 via parquet 53/58. Both should be dismissed with "Tolerable risk" until upstream lands a fix.
1 parent 933ec2a commit a435e65

18 files changed

Lines changed: 873 additions & 1788 deletions

File tree

‎Cargo.lock‎

Lines changed: 309 additions & 593 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apps/desktop/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
"class-variance-authority": "^0.7.1",
4545
"clsx": "^2.1.1",
4646
"lucide-react": "^0.562.0",
47-
"postcss": "^8.5.6",
47+
"postcss": "^8.5.10",
4848
"react": "^18.2.0",
4949
"react-dom": "^18.2.0",
5050
"react-resizable-panels": "^4.4.0",
@@ -59,6 +59,6 @@
5959
"@types/react-dom": "^18.2.0",
6060
"@vitejs/plugin-react": "^4.2.0",
6161
"typescript": "^5.3.0",
62-
"vite": "^5.0.0"
62+
"vite": "^7.3.2"
6363
}
6464
}

‎apps/desktop/src-tauri/gen/schemas/acl-manifests.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎apps/desktop/src-tauri/gen/schemas/desktop-schema.json‎

Lines changed: 54 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2217,10 +2217,10 @@
22172217
"markdownDescription": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`"
22182218
},
22192219
{
2220-
"description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`",
2220+
"description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`\n- `allow-supports-multiple-windows`",
22212221
"type": "string",
22222222
"const": "core:app:default",
2223-
"markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`"
2223+
"markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-version`\n- `allow-name`\n- `allow-tauri-version`\n- `allow-identifier`\n- `allow-bundle-type`\n- `allow-register-listener`\n- `allow-remove-listener`\n- `allow-supports-multiple-windows`"
22242224
},
22252225
{
22262226
"description": "Enables the app_hide command without any pre-configured scope.",
@@ -2294,6 +2294,12 @@
22942294
"const": "core:app:allow-set-dock-visibility",
22952295
"markdownDescription": "Enables the set_dock_visibility command without any pre-configured scope."
22962296
},
2297+
{
2298+
"description": "Enables the supports_multiple_windows command without any pre-configured scope.",
2299+
"type": "string",
2300+
"const": "core:app:allow-supports-multiple-windows",
2301+
"markdownDescription": "Enables the supports_multiple_windows command without any pre-configured scope."
2302+
},
22972303
{
22982304
"description": "Enables the tauri_version command without any pre-configured scope.",
22992305
"type": "string",
@@ -2378,6 +2384,12 @@
23782384
"const": "core:app:deny-set-dock-visibility",
23792385
"markdownDescription": "Denies the set_dock_visibility command without any pre-configured scope."
23802386
},
2387+
{
2388+
"description": "Denies the supports_multiple_windows command without any pre-configured scope.",
2389+
"type": "string",
2390+
"const": "core:app:deny-supports-multiple-windows",
2391+
"markdownDescription": "Denies the supports_multiple_windows command without any pre-configured scope."
2392+
},
23812393
{
23822394
"description": "Denies the tauri_version command without any pre-configured scope.",
23832395
"type": "string",
@@ -2901,10 +2913,10 @@
29012913
"markdownDescription": "Denies the close command without any pre-configured scope."
29022914
},
29032915
{
2904-
"description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`",
2916+
"description": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-icon-with-as-template`\n- `allow-set-show-menu-on-left-click`",
29052917
"type": "string",
29062918
"const": "core:tray:default",
2907-
"markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-show-menu-on-left-click`"
2919+
"markdownDescription": "Default permissions for the plugin, which enables all commands.\n#### This default permission set includes:\n\n- `allow-new`\n- `allow-get-by-id`\n- `allow-remove-by-id`\n- `allow-set-icon`\n- `allow-set-menu`\n- `allow-set-tooltip`\n- `allow-set-title`\n- `allow-set-visible`\n- `allow-set-temp-dir-path`\n- `allow-set-icon-as-template`\n- `allow-set-icon-with-as-template`\n- `allow-set-show-menu-on-left-click`"
29082920
},
29092921
{
29102922
"description": "Enables the get_by_id command without any pre-configured scope.",
@@ -2936,6 +2948,12 @@
29362948
"const": "core:tray:allow-set-icon-as-template",
29372949
"markdownDescription": "Enables the set_icon_as_template command without any pre-configured scope."
29382950
},
2951+
{
2952+
"description": "Enables the set_icon_with_as_template command without any pre-configured scope.",
2953+
"type": "string",
2954+
"const": "core:tray:allow-set-icon-with-as-template",
2955+
"markdownDescription": "Enables the set_icon_with_as_template command without any pre-configured scope."
2956+
},
29392957
{
29402958
"description": "Enables the set_menu command without any pre-configured scope.",
29412959
"type": "string",
@@ -3002,6 +3020,12 @@
30023020
"const": "core:tray:deny-set-icon-as-template",
30033021
"markdownDescription": "Denies the set_icon_as_template command without any pre-configured scope."
30043022
},
3023+
{
3024+
"description": "Denies the set_icon_with_as_template command without any pre-configured scope.",
3025+
"type": "string",
3026+
"const": "core:tray:deny-set-icon-with-as-template",
3027+
"markdownDescription": "Denies the set_icon_with_as_template command without any pre-configured scope."
3028+
},
30053029
{
30063030
"description": "Denies the set_menu command without any pre-configured scope.",
30073031
"type": "string",
@@ -3261,10 +3285,16 @@
32613285
"markdownDescription": "Denies the webview_size command without any pre-configured scope."
32623286
},
32633287
{
3264-
"description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`",
3288+
"description": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-activity-name`\n- `allow-scene-identifier`\n- `allow-internal-toggle-maximize`",
32653289
"type": "string",
32663290
"const": "core:window:default",
3267-
"markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-internal-toggle-maximize`"
3291+
"markdownDescription": "Default permissions for the plugin.\n#### This default permission set includes:\n\n- `allow-get-all-windows`\n- `allow-scale-factor`\n- `allow-inner-position`\n- `allow-outer-position`\n- `allow-inner-size`\n- `allow-outer-size`\n- `allow-is-fullscreen`\n- `allow-is-minimized`\n- `allow-is-maximized`\n- `allow-is-focused`\n- `allow-is-decorated`\n- `allow-is-resizable`\n- `allow-is-maximizable`\n- `allow-is-minimizable`\n- `allow-is-closable`\n- `allow-is-visible`\n- `allow-is-enabled`\n- `allow-title`\n- `allow-current-monitor`\n- `allow-primary-monitor`\n- `allow-monitor-from-point`\n- `allow-available-monitors`\n- `allow-cursor-position`\n- `allow-theme`\n- `allow-is-always-on-top`\n- `allow-activity-name`\n- `allow-scene-identifier`\n- `allow-internal-toggle-maximize`"
3292+
},
3293+
{
3294+
"description": "Enables the activity_name command without any pre-configured scope.",
3295+
"type": "string",
3296+
"const": "core:window:allow-activity-name",
3297+
"markdownDescription": "Enables the activity_name command without any pre-configured scope."
32683298
},
32693299
{
32703300
"description": "Enables the available_monitors command without any pre-configured scope.",
@@ -3458,6 +3488,12 @@
34583488
"const": "core:window:allow-scale-factor",
34593489
"markdownDescription": "Enables the scale_factor command without any pre-configured scope."
34603490
},
3491+
{
3492+
"description": "Enables the scene_identifier command without any pre-configured scope.",
3493+
"type": "string",
3494+
"const": "core:window:allow-scene-identifier",
3495+
"markdownDescription": "Enables the scene_identifier command without any pre-configured scope."
3496+
},
34613497
{
34623498
"description": "Enables the set_always_on_bottom command without any pre-configured scope.",
34633499
"type": "string",
@@ -3722,6 +3758,12 @@
37223758
"const": "core:window:allow-unminimize",
37233759
"markdownDescription": "Enables the unminimize command without any pre-configured scope."
37243760
},
3761+
{
3762+
"description": "Denies the activity_name command without any pre-configured scope.",
3763+
"type": "string",
3764+
"const": "core:window:deny-activity-name",
3765+
"markdownDescription": "Denies the activity_name command without any pre-configured scope."
3766+
},
37253767
{
37263768
"description": "Denies the available_monitors command without any pre-configured scope.",
37273769
"type": "string",
@@ -3914,6 +3956,12 @@
39143956
"const": "core:window:deny-scale-factor",
39153957
"markdownDescription": "Denies the scale_factor command without any pre-configured scope."
39163958
},
3959+
{
3960+
"description": "Denies the scene_identifier command without any pre-configured scope.",
3961+
"type": "string",
3962+
"const": "core:window:deny-scene-identifier",
3963+
"markdownDescription": "Denies the scene_identifier command without any pre-configured scope."
3964+
},
39173965
{
39183966
"description": "Denies the set_always_on_bottom command without any pre-configured scope.",
39193967
"type": "string",

0 commit comments

Comments
 (0)