From 94aaef5bb1721eeb1f6c74ca1db983da0dc1e8e0 Mon Sep 17 00:00:00 2001 From: Tee8z Date: Tue, 20 Oct 2026 10:41:03 -0400 Subject: [PATCH] fix(deps): scope security exceptions and patch desktop archives Keep Mesh-LLM ZIP advisory exceptions in its smoke-only policy. Check runtime and desktop dependency graphs separately and include desktop Rust changes in the security gate. Upgrade desktop ZIP and pin the upstream updater ZIP fix. Verify that the desktop ringbuf exception remains an unused dependency of pinned NetEQ. Preserve the upstream dependency repairs and explicit bans on vulnerable trust roots. Signed-off-by: Tee8z --- .github/workflows/_ci-security.yml | 10 +- .github/workflows/ci.yml | 9 +- Cargo.lock | 34 +- SECURITY.md | 19 +- deny-desktop.toml | 139 +++++ deny-mesh.toml | 125 ++++ deny.toml | 22 + desktop/src-tauri/Cargo.lock | 559 ++++++++---------- desktop/src-tauri/Cargo.toml | 8 +- .../commands/agent_discovery/managed_node.rs | 10 +- .../agent_discovery/managed_node_tests.rs | 22 + .../check-desktop-dependency-exceptions.py | 102 ++++ scripts/ci-required-gates.test.mjs | 20 + 13 files changed, 743 insertions(+), 336 deletions(-) create mode 100644 deny-desktop.toml create mode 100644 deny-mesh.toml create mode 100644 scripts/check-desktop-dependency-exceptions.py diff --git a/.github/workflows/_ci-security.yml b/.github/workflows/_ci-security.yml index 29855e8f781..9d671f55ac5 100644 --- a/.github/workflows/_ci-security.yml +++ b/.github/workflows/_ci-security.yml @@ -25,8 +25,14 @@ jobs: steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - name: Dependency policy - run: cargo-deny check + - name: Runtime dependency policy + run: cargo-deny --exclude buzz-mesh-smoke check + - name: Mesh-LLM smoke dependency policy + run: cargo-deny --manifest-path crates/buzz-mesh-smoke/Cargo.toml check --config deny-mesh.toml + - name: Verify desktop dependency exceptions + run: python3 scripts/check-desktop-dependency-exceptions.py + - name: Desktop dependency policy + run: cargo-deny --manifest-path desktop/src-tauri/Cargo.toml check --config deny-desktop.toml results: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a1ff1c47fe6..935bc6b8e21 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,6 +57,9 @@ jobs: - 'scripts/test-postgres-test-discovery.sh' - 'scripts/test-postgres-test-wrapper.sh' - 'deny.toml' + - 'deny-mesh.toml' + - 'deny-desktop.toml' + - 'scripts/check-desktop-dependency-exceptions.py' - '.github/workflows/ci.yml' - '.github/workflows/_ci-*.yml' - 'docker-compose.yml' @@ -255,10 +258,10 @@ jobs: security-domain: name: Security Domain needs: [changes] - if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' + if: github.event_name == 'push' || (needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true') uses: ./.github/workflows/_ci-security.yml with: - rust: ${{ needs.changes.outputs.rust == 'true' }} + rust: ${{ (needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true') }} rust-lint: name: Rust Lint @@ -430,7 +433,7 @@ jobs: security: name: Security - if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true'))) + if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true'))) needs: [changes, security-domain] runs-on: ubuntu-latest timeout-minutes: 5 diff --git a/Cargo.lock b/Cargo.lock index 15b190f8aed..f1fc02f86a9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -507,7 +507,7 @@ dependencies = [ "serde", "serde_json", "url", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -2592,7 +2592,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" dependencies = [ "data-encoding", - "syn 2.0.117", + "syn 1.0.109", ] [[package]] @@ -4073,7 +4073,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower-service", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -4610,7 +4610,7 @@ dependencies = [ "tokio-websockets", "tracing", "url", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", "ws_stream_wasm", ] @@ -6212,9 +6212,9 @@ checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b" [[package]] name = "negentropy" -version = "0.5.0" +version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0efe882e02d206d8d279c20eb40e03baf7cb5136a1476dc084a324fbc3ec42d" +checksum = "a3d66662cb5ca384d4991509755ed5a42dd8e31c4282bf881938e506fc3146ec" [[package]] name = "netdev" @@ -8483,7 +8483,7 @@ dependencies = [ "wasm-bindgen-futures", "wasm-streams 0.4.2", "web-sys", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -8761,9 +8761,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -8826,9 +8826,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -9825,7 +9825,7 @@ dependencies = [ "tracing", "url", "uuid", - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] @@ -11556,9 +11556,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -11569,14 +11569,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.7", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/SECURITY.md b/SECURITY.md index add36efee42..7ace0928317 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -122,7 +122,24 @@ controllers. ### Dependency Management -We use `cargo audit` in CI to scan for known vulnerabilities in dependencies. +CI checks runtime, Mesh-LLM smoke, and desktop dependencies with separate +`cargo-deny` policies. The desktop policy checks every feature, including the +optional `mesh-llm` graph that release builds enable. Its ZIP advisory +exceptions cover only `zip` below 9 under `mesh-llm`. The guard script verifies +that the default desktop graph has no `zip` below 9, that `mesh-llm` is its +only consumer, and that `mesh-llm` never calls the affected extract APIs. It also +verifies that the `ringbuf` exception remains an unused dependency of the pinned +NetEQ source. + +Run the same checks locally from the repository root: + +```bash +cargo-deny --exclude buzz-mesh-smoke check +cargo-deny --manifest-path crates/buzz-mesh-smoke/Cargo.toml check --config deny-mesh.toml +python3 scripts/check-desktop-dependency-exceptions.py +cargo-deny --manifest-path desktop/src-tauri/Cargo.toml check --config deny-desktop.toml +``` + `#![deny(unsafe_code)]` is enforced across all crates — no unsafe Rust. --- diff --git a/deny-desktop.toml b/deny-desktop.toml new file mode 100644 index 00000000000..ab96182f133 --- /dev/null +++ b/deny-desktop.toml @@ -0,0 +1,139 @@ +# Desktop policy. Every feature is checked, including the Mesh-LLM graph that +# release builds enable. +[graph] +all-features = true + +[advisories] +ignore = [ + # zip 8.6.0 < 9: extraction keeps setuid/setgid bits (0367), creates + # symlinks that escape the destination (0368) and applies permissions through + # symlinks (0369). Only path: the optional mesh-llm feature → mesh-llm v0.76.2 + # → mesh-llm-host-runtime / mesh-llm-plugin-manager / mesh-llm-system → zip 8. + # No mesh-llm release uses zip 9 yet. Its readers copy entries through + # enclosed_name() and never call the affected extract APIs; + # check-desktop-dependency-exceptions.py verifies that, and that the default + # graph has no zip below 9. Remove on the mesh-llm bump that moves to zip 9. + { id = "RUSTSEC-2026-0367", reason = "zip 8.6.0 only via the optional mesh-llm feature; manual entry copy, never extracts; guard-verified" }, + { id = "RUSTSEC-2026-0368", reason = "zip 8.6.0 only via the optional mesh-llm feature; manual entry copy, never extracts; guard-verified" }, + { id = "RUSTSEC-2026-0369", reason = "zip 8.6.0 only via the optional mesh-llm feature; manual entry copy, never extracts; guard-verified" }, + # These desktop transitive dependencies have maintenance notices, not + # vulnerability reports. Remove when opus, user-idle, and GTK migrate. + { id = "RUSTSEC-2026-0150", reason = "audiopus_sys via opus; unmaintained with no safe upstream upgrade" }, + { id = "RUSTSEC-2020-0168", reason = "mach via user-idle; unmaintained with no safe upstream upgrade" }, + { id = "RUSTSEC-2024-0370", reason = "proc-macro-error via GTK glib-macros; unmaintained with no safe upstream upgrade" }, + # neteq 0.8.3 declares ringbuf but never uses it: its buffer is VecDeque. + # CI verifies the pinned source has no reference and no other graph parent. + # Remove when neteq drops its unused dependency or upgrades to ringbuf 0.5.2. + { id = "RUSTSEC-2026-0293", reason = "unused dependency of pinned neteq 0.8.3; check-desktop-dependency-exceptions.py verifies it stays unreachable" }, + # 0.26.11 contains no roots: it re-exports webpki-roots 1.x. Both lockfiles + # resolve that parent to 1.0.10, which removes the distrusted emSign root. + # The advisory also flags this compatibility wrapper. The bans below keep + # every other affected version forbidden while this false positive remains. + { id = "RUSTSEC-2026-0381", reason = "0.26.11 only re-exports the patched 1.0.10 roots; bans enforce patched versions for all other releases" }, + # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant. + # Will be resolved when nostr crate updates its dependencies. + { id = "RUSTSEC-2024-0384", reason = "transitive dep via nostr; no upstream fix available" }, + # paste 1.0.15 — unmaintained. Transitive dep: mesh-llm → iroh → netlink-* → paste. + # No safe upgrade available; tracked for upstream (iroh/netlink) replacement. + { id = "RUSTSEC-2024-0436", reason = "transitive dep via mesh-llm → iroh → netlink; no upstream fix available" }, + # quick-xml < 0.41: quadratic runtime on duplicate-attribute check (0194) and + # unbounded namespace-declaration allocation in NsReader (0195). Both DoS-class, + # requiring attacker-controlled XML. Our two locked versions only parse trusted + # input: 0.38.4 (rust-s3/aws-creds — responses from our own S3/MinIO endpoint) + # and 0.39.4 (mesh-llm → iroh → netdev → plist — local macOS system plists). + # Patched release (>= 0.41.0) is unreachable until rust-s3 and plist/netdev bump; + # remove these when upstream catches up. + { id = "RUSTSEC-2026-0194", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + { id = "RUSTSEC-2026-0195", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + # unsafe-libyaml 0.2.11 — unmaintained (repository archived 2024-03-25), not a + # vulnerability report. Transitive dep: serde_yaml → unsafe-libyaml. The serde_yaml_ng + # fork uses the same crate, so removing it means migrating YAML parsing in + # buzz-agent, buzz-persona, buzz-relay, buzz-workflow and desktop. + { id = "RUSTSEC-2024-0449", reason = "transitive via serde_yaml; unmaintained, not vulnerable; removal needs a YAML parser migration" }, + # zbus 5 D-Bus crates (zvariant, zbus_names, zvariant_derive) — unmaintained, + # not vulnerable. Only path: buzz-mesh-smoke → mesh-llm → keyring 4 → + # zbus-secret-service-keyring-store / secret-service 5 → zbus 5. + # Remove when mesh-llm's keyring stack moves off zbus 5. + { id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, +] + +[licenses] +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Unicode-3.0", + "Unicode-DFS-2016", + "Zlib", + "OpenSSL", + "CC0-1.0", + "CDLA-Permissive-2.0", + "MITNFA", + "MPL-2.0", + "BSL-1.0", + "Unlicense", + # minicbor's permissive, OSI-approved license. Used for strict App Attest + # assertion CBOR parsing and also transitively by appattest. + "BlueOak-1.0.0", + # bzip2/libbzip2's permissive BSD-like license. New via desktop zip/bzip2 + # transitive deps; compatible with Apache-2.0 distribution. + "bzip2-1.0.6", +] +confidence-threshold = 0.8 + +# mesh-llm workspace crates (pinned git dep) omit a per-crate `license` field in +# their manifests, so cargo-deny reports them as unlicensed. The mesh-llm repo is +# licensed "MIT OR Apache-2.0" (workspace Cargo.toml + top-level LICENSE = Apache-2.0); +# clarify each pulled-in member to that expression. Remove once mesh sets the field +# upstream (filed). +[[licenses.clarify]] +crate = "mesh-llm-config" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-gpu-bench" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-host-runtime" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-plugin" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-system" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-mixture-of-agents" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "buzz-desktop" +expression = "Apache-2.0" +license-files = [] + +[licenses.private] +ignore = true + +[bans] +# RUSTSEC-2026-0381: allow only the 0.26.11 re-export wrapper or patched roots. +deny = [ + { name = "webpki-roots", version = "<0.26.11" }, + { name = "webpki-roots", version = ">0.26.11, <1.0.10" }, +] +multiple-versions = "warn" +wildcards = "allow" diff --git a/deny-mesh.toml b/deny-mesh.toml new file mode 100644 index 00000000000..a6d6a978303 --- /dev/null +++ b/deny-mesh.toml @@ -0,0 +1,125 @@ +# Mesh-LLM smoke harness only. Desktop and runtime crates use deny.toml. +[advisories] +ignore = [ + # 0.26.11 contains no roots: it re-exports webpki-roots 1.x. Both lockfiles + # resolve that parent to 1.0.10, which removes the distrusted emSign root. + # The advisory also flags this compatibility wrapper. The bans below keep + # every other affected version forbidden while this false positive remains. + { id = "RUSTSEC-2026-0381", reason = "0.26.11 only re-exports the patched 1.0.10 roots; bans enforce patched versions for all other releases" }, + # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant. + # Will be resolved when nostr crate updates its dependencies. + { id = "RUSTSEC-2024-0384", reason = "transitive dep via nostr; no upstream fix available" }, + # paste 1.0.15 — unmaintained. Transitive dep: mesh-llm → iroh → netlink-* → paste. + # No safe upgrade available; tracked for upstream (iroh/netlink) replacement. + { id = "RUSTSEC-2024-0436", reason = "transitive dep via mesh-llm → iroh → netlink; no upstream fix available" }, + # quick-xml < 0.41: quadratic runtime on duplicate-attribute check (0194) and + # unbounded namespace-declaration allocation in NsReader (0195). Both DoS-class, + # requiring attacker-controlled XML. Our two locked versions only parse trusted + # input: 0.38.4 (rust-s3/aws-creds — responses from our own S3/MinIO endpoint) + # and 0.39.4 (mesh-llm → iroh → netdev → plist — local macOS system plists). + # Patched release (>= 0.41.0) is unreachable until rust-s3 and plist/netdev bump; + # remove these when upstream catches up. + { id = "RUSTSEC-2026-0194", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + { id = "RUSTSEC-2026-0195", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + # unsafe-libyaml 0.2.11 — unmaintained (repository archived 2024-03-25), not a + # vulnerability report. Transitive dep: serde_yaml → unsafe-libyaml. The serde_yaml_ng + # fork uses the same crate, so removing it means migrating YAML parsing in + # buzz-agent, buzz-persona, buzz-relay, buzz-workflow and desktop. + { id = "RUSTSEC-2024-0449", reason = "transitive via serde_yaml; unmaintained, not vulnerable; removal needs a YAML parser migration" }, + # zip 8.6.0 < 9: extraction keeps setuid/setgid bits (0367), creates + # symlinks that escape the destination (0368) and applies permissions through + # symlinks (0369). Only path: buzz-mesh-smoke → mesh-llm v0.76.2 → + # mesh-llm-host-runtime / mesh-llm-plugin-manager / mesh-llm-system → zip 8. + # mesh-llm's zip readers copy entries manually and never call + # ZipArchive::extract; recheck if that changes. Remove on the mesh-llm bump + # that ships Mesh-LLM/mesh-llm#2471. + { id = "RUSTSEC-2026-0367", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" }, + { id = "RUSTSEC-2026-0368", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" }, + { id = "RUSTSEC-2026-0369", reason = "zip 8.6.0 via buzz-mesh-smoke → mesh-llm v0.76.2; manual entry copy, never extracts; fix in unreleased mesh-llm#2471" }, + # zbus 5 D-Bus crates (zvariant, zbus_names, zvariant_derive) — unmaintained, + # not vulnerable. Only path: buzz-mesh-smoke → mesh-llm → keyring 4 → + # zbus-secret-service-keyring-store / secret-service 5 → zbus 5. + # Remove when mesh-llm's keyring stack moves off zbus 5. + { id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, +] + +[licenses] +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Unicode-3.0", + "Unicode-DFS-2016", + "Zlib", + "OpenSSL", + "CC0-1.0", + "CDLA-Permissive-2.0", + "MITNFA", + "MPL-2.0", + "BSL-1.0", + "Unlicense", + # minicbor's permissive, OSI-approved license. Used for strict App Attest + # assertion CBOR parsing and also transitively by appattest. + "BlueOak-1.0.0", + # bzip2/libbzip2's permissive BSD-like license. New via desktop zip/bzip2 + # transitive deps; compatible with Apache-2.0 distribution. + "bzip2-1.0.6", +] +confidence-threshold = 0.8 + +# mesh-llm workspace crates (pinned git dep) omit a per-crate `license` field in +# their manifests, so cargo-deny reports them as unlicensed. The mesh-llm repo is +# licensed "MIT OR Apache-2.0" (workspace Cargo.toml + top-level LICENSE = Apache-2.0); +# clarify each pulled-in member to that expression. Remove once mesh sets the field +# upstream (filed). +[[licenses.clarify]] +crate = "mesh-llm-config" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-gpu-bench" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-host-runtime" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-plugin" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-llm-system" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "mesh-mixture-of-agents" +expression = "MIT OR Apache-2.0" +license-files = [] + +[[licenses.clarify]] +crate = "buzz-desktop" +expression = "Apache-2.0" +license-files = [] + +[licenses.private] +ignore = true + +[bans] +# RUSTSEC-2026-0381: allow only the 0.26.11 re-export wrapper or patched roots. +deny = [ + { name = "webpki-roots", version = "<0.26.11" }, + { name = "webpki-roots", version = ">0.26.11, <1.0.10" }, +] +multiple-versions = "warn" +wildcards = "allow" diff --git a/deny.toml b/deny.toml index d3c5fcd4bc7..322d0f34eea 100644 --- a/deny.toml +++ b/deny.toml @@ -1,5 +1,10 @@ [advisories] ignore = [ + # 0.26.11 contains no roots: it re-exports webpki-roots 1.x. Both lockfiles + # resolve that parent to 1.0.10, which removes the distrusted emSign root. + # The advisory also flags this compatibility wrapper. The bans below keep + # every other affected version forbidden while this false positive remains. + { id = "RUSTSEC-2026-0381", reason = "0.26.11 only re-exports the patched 1.0.10 roots; bans enforce patched versions for all other releases" }, # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant. # Will be resolved when nostr crate updates its dependencies. { id = "RUSTSEC-2024-0384", reason = "transitive dep via nostr; no upstream fix available" }, @@ -15,6 +20,18 @@ ignore = [ # remove these when upstream catches up. { id = "RUSTSEC-2026-0194", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, { id = "RUSTSEC-2026-0195", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + # unsafe-libyaml 0.2.11 — unmaintained (repository archived 2024-03-25), not a + # vulnerability report. Transitive dep: serde_yaml → unsafe-libyaml. The serde_yaml_ng + # fork uses the same crate, so removing it means migrating YAML parsing in + # buzz-agent, buzz-persona, buzz-relay, buzz-workflow and desktop. + { id = "RUSTSEC-2024-0449", reason = "transitive via serde_yaml; unmaintained, not vulnerable; removal needs a YAML parser migration" }, + # zbus 5 D-Bus crates (zvariant, zbus_names, zvariant_derive) — unmaintained, + # not vulnerable. Only path: buzz-mesh-smoke → mesh-llm → keyring 4 → + # zbus-secret-service-keyring-store / secret-service 5 → zbus 5. + # Remove when mesh-llm's keyring stack moves off zbus 5. + { id = "RUSTSEC-2026-0370", reason = "zvariant via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive via buzz-mesh-smoke → mesh-llm → keyring 4 → secret-service 5 → zbus 5; unmaintained, not vulnerable" }, ] [licenses] @@ -88,5 +105,10 @@ license-files = [] ignore = true [bans] +# RUSTSEC-2026-0381: allow only the 0.26.11 re-export wrapper or patched roots. +deny = [ + { name = "webpki-roots", version = "<0.26.11" }, + { name = "webpki-roots", version = ">0.26.11, <1.0.10" }, +] multiple-versions = "warn" wildcards = "allow" diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 3d8cfd0313d..9985f63cde9 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -134,15 +134,15 @@ dependencies = [ [[package]] name = "alloc-no-stdlib" -version = "2.0.4" +version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3" +checksum = "c2fb6cfd47bf496ff64095c20eaba0c201404ee38714d4142fcfa1dc334fcc7a" [[package]] name = "alloc-stdlib" -version = "0.2.4" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195" +checksum = "0b5c1865780388bfa186411ab5f247819487fc4864c6e9c3106611fa347586e1" dependencies = [ "alloc-no-stdlib", ] @@ -220,7 +220,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -231,7 +231,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -260,15 +260,6 @@ dependencies = [ "num-traits", ] -[[package]] -name = "arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "arboard" version = "3.6.1" @@ -558,7 +549,7 @@ dependencies = [ "serde", "serde_json", "url", - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", ] [[package]] @@ -927,7 +918,7 @@ dependencies = [ "arrayvec", "cc", "cfg-if 1.0.4", - "constant_time_eq", + "constant_time_eq 0.4.2", "cpufeatures 0.3.0", ] @@ -1012,7 +1003,7 @@ version = "3.9.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6dee98b0db6a962de883bf5d20362dee4d7ca0d12fe39a7c6c73c844e1cd7c1f" dependencies = [ - "darling 0.23.0", + "darling 0.20.11", "ident_case", "prettyplease", "proc-macro2", @@ -1023,9 +1014,9 @@ dependencies = [ [[package]] name = "brotli" -version = "8.0.4" +version = "9.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3" +checksum = "f8b851b75c23ca7873623d612fe49bd1989aeb03d08fb9432187eb253d3d4c6b" dependencies = [ "alloc-no-stdlib", "alloc-stdlib", @@ -1034,9 +1025,9 @@ dependencies = [ [[package]] name = "brotli-decompressor" -version = "5.0.3" +version = "6.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583" +checksum = "941cd9bd4ddab83cb46fa5a2d428f1c857b24ac78cb876cf7beb710840934bd7" dependencies = [ "alloc-no-stdlib", "alloc-stdlib", @@ -1076,7 +1067,7 @@ dependencies = [ "async-trait", "axum", "base64 0.22.1", - "dirs", + "dirs 6.0.0", "fs2", "getrandom 0.4.3", "hex", @@ -1139,7 +1130,7 @@ dependencies = [ "bzip2 0.6.1", "chrono", "ctrlc", - "dirs", + "dirs 6.0.0", "earshot", "ed25519-dalek", "flate2", @@ -1147,7 +1138,7 @@ dependencies = [ "getrandom 0.2.17", "hex", "image", - "infer", + "infer 0.19.0", "iroh", "keyring 3.6.3", "libc", @@ -1205,10 +1196,10 @@ dependencies = [ "user-idle", "uuid", "webkit2gtk", - "window-vibrancy", + "window-vibrancy 0.6.0", "windows-sys 0.61.2", "zeroize", - "zip 8.6.0", + "zip 9.0.5", ] [[package]] @@ -1225,7 +1216,7 @@ dependencies = [ "hex", "image", "imagesize", - "infer", + "infer 0.19.0", "mp4", "nostr 0.44.7", "quick-xml 0.38.4", @@ -1427,12 +1418,13 @@ dependencies = [ [[package]] name = "cargo_toml" -version = "0.22.3" +version = "1.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "374b7c592d9c00c1f4972ea58390ac6b18cbb6ab79011f3bdc90a0b82ca06b77" +checksum = "82f4b26e751e711a5302649417f2da046dce6391b2ea30a4820f37462314f0b9" dependencies = [ + "semver", "serde", - "toml 0.9.12+spec-1.1.0", + "toml 1.1.2+spec-1.1.0", ] [[package]] @@ -1491,6 +1483,17 @@ dependencies = [ "uuid", ] +[[package]] +name = "cfb" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a347dcabdae9c31b0825fd6a8bed285ec9c2acb89c47827126d52fa4f59cece3" +dependencies = [ + "fnv", + "uuid", + "web-time", +] + [[package]] name = "cfg-expr" version = "0.15.8" @@ -1700,7 +1703,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] @@ -1809,6 +1812,15 @@ version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b" +[[package]] +name = "constant_time_eq" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9" +dependencies = [ + "rustversion", +] + [[package]] name = "convert_case" version = "0.10.0" @@ -1938,7 +1950,7 @@ dependencies = [ "wasm-bindgen", "wasm-bindgen-futures", "web-sys", - "windows 0.62.2", + "windows 0.61.3", ] [[package]] @@ -2110,9 +2122,9 @@ dependencies = [ [[package]] name = "cssparser" -version = "0.36.0" +version = "0.37.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2" +checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98" dependencies = [ "cssparser-macros", "dtoa-short", @@ -2123,12 +2135,12 @@ dependencies = [ [[package]] name = "cssparser-macros" -version = "0.6.1" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331" +checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a" dependencies = [ "quote", - "syn 2.0.118", + "syn 3.0.3", ] [[package]] @@ -2141,16 +2153,6 @@ dependencies = [ "quote", ] -[[package]] -name = "ctor" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "352d39c2f7bef1d6ad73db6f5160efcaed66d94ef8c6c573a8410c00bf909a98" -dependencies = [ - "ctor-proc-macro", - "dtor", -] - [[package]] name = "ctor" version = "1.0.8" @@ -2161,12 +2163,6 @@ dependencies = [ "linktime-proc-macro", ] -[[package]] -name = "ctor-proc-macro" -version = "0.0.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1" - [[package]] name = "ctr" version = "0.9.2" @@ -2387,7 +2383,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" dependencies = [ "data-encoding", - "syn 1.0.109", + "syn 2.0.118", ] [[package]] @@ -2452,17 +2448,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "derive_arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.118", -] - [[package]] name = "derive_builder" version = "0.20.2" @@ -2556,6 +2541,15 @@ dependencies = [ "dirs-sys", ] +[[package]] +name = "dirs" +version = "7.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f" +dependencies = [ + "dirs-sys", +] + [[package]] name = "dirs-sys" version = "0.5.0" @@ -2565,7 +2559,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -2634,9 +2628,9 @@ dependencies = [ [[package]] name = "dom_query" -version = "0.27.0" +version = "0.28.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89" +checksum = "fac5fca71e65e94cc718a6e2af65d6e0f9c6027751c2aa562fbb5087fda639bc" dependencies = [ "bit-set 0.8.0", "cssparser", @@ -2677,21 +2671,6 @@ dependencies = [ "dtoa", ] -[[package]] -name = "dtor" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1057d6c64987086ff8ed0fd3fbf377a6b7d205cc7715868cd401705f715cbe4" -dependencies = [ - "dtor-proc-macro", -] - -[[package]] -name = "dtor-proc-macro" -version = "0.0.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5" - [[package]] name = "dunce" version = "1.0.5" @@ -2846,7 +2825,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3374,8 +3353,8 @@ dependencies = [ "libc", "log", "rustversion", - "windows-link 0.2.1", - "windows-result 0.4.1", + "windows-link 0.1.3", + "windows-result 0.3.4", ] [[package]] @@ -3570,7 +3549,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8c386b0a4a70cb2d39fffd74480f985b6f0bfbcb934b6a6b6b7e630e448f242e" dependencies = [ "crossbeam-channel", - "keyboard-types", + "keyboard-types 0.7.0", "objc2", "objc2-app-kit", "once_cell", @@ -3671,9 +3650,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.15" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", @@ -3976,9 +3955,9 @@ dependencies = [ [[package]] name = "html5ever" -version = "0.38.0" +version = "0.39.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1054432bae2f14e0061e33d23402fbaa67a921d319d56adc6bcf887ddad1cbc2" +checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8" dependencies = [ "log", "markup5ever", @@ -4079,7 +4058,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower-service", - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", ] [[package]] @@ -4117,7 +4096,7 @@ dependencies = [ "tokio", "tower-service", "tracing", - "windows-registry 0.6.1", + "windows-registry 0.5.3", ] [[package]] @@ -4132,7 +4111,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.62.2", + "windows-core 0.61.2", ] [[package]] @@ -4372,7 +4351,16 @@ version = "0.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7" dependencies = [ - "cfb", + "cfb 0.7.3", +] + +[[package]] +name = "infer" +version = "0.22.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4200d433cbd5178df7797c9c2e75b348b728e39631cf14520d1e2fc424201f4" +dependencies = [ + "cfb 0.14.0", ] [[package]] @@ -4604,7 +4592,7 @@ dependencies = [ "tokio-websockets", "tracing", "url", - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", "ws_stream_wasm", ] @@ -4768,21 +4756,21 @@ dependencies = [ [[package]] name = "json-patch" -version = "3.0.1" +version = "4.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08" +checksum = "7421438de105a0827e44fadd05377727847d717c80ce29a229f85fd04c427b72" dependencies = [ "jsonptr", "serde", "serde_json", - "thiserror 1.0.69", + "thiserror 2.0.18", ] [[package]] name = "jsonptr" -version = "0.6.3" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70" +checksum = "a5a3cc660ba5d72bce0b3bb295bf20847ccbb40fd423f3f05b61273672e561fe" dependencies = [ "serde", "serde_json", @@ -4810,6 +4798,16 @@ dependencies = [ "unicode-segmentation", ] +[[package]] +name = "keyboard-types" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d" +dependencies = [ + "bitflags 2.13.0", + "serde", +] + [[package]] name = "keyring" version = "3.6.3" @@ -5095,9 +5093,9 @@ dependencies = [ [[package]] name = "lzma-rust2" -version = "0.16.5" +version = "0.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b" +checksum = "7277c9742229dc25243236d578b6471a798c554512c6f6a04365ec2e87c2a3bb" dependencies = [ "sha2 0.11.0", ] @@ -5177,9 +5175,9 @@ checksum = "fc04a4c58212d57930a24bf47d3fa87485264a3a054e9c10e042eb373573ad3c" [[package]] name = "markup5ever" -version = "0.38.0" +version = "0.39.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8983d30f2915feeaaab2d6babdd6bc7e9ed1a00b66b5e6d74df19aa9c0e91862" +checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de" dependencies = [ "log", "tendril", @@ -5332,7 +5330,7 @@ version = "0.76.2" source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.76.2#a0c1e66b0ac037dd56544b9e2d94969ea43d694f" dependencies = [ "anyhow", - "dirs", + "dirs 6.0.0", "mesh-llm-native-runtime", "mesh-llm-types", "semver", @@ -5442,7 +5440,7 @@ dependencies = [ "clap", "crossterm", "crypto_box", - "dirs", + "dirs 6.0.0", "ed25519-dalek", "flate2", "futures-util", @@ -5535,7 +5533,7 @@ dependencies = [ "chacha20poly1305 0.11.0", "chrono", "crypto_box", - "dirs", + "dirs 6.0.0", "ed25519-dalek", "hex", "keyring 4.2.0", @@ -5614,7 +5612,7 @@ version = "0.76.2" source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.76.2#a0c1e66b0ac037dd56544b9e2d94969ea43d694f" dependencies = [ "anyhow", - "dirs", + "dirs 6.0.0", "flate2", "futures-util", "hex", @@ -5667,7 +5665,7 @@ version = "0.76.2" source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.76.2#a0c1e66b0ac037dd56544b9e2d94969ea43d694f" dependencies = [ "anyhow", - "dirs", + "dirs 6.0.0", "flate2", "futures-util", "hex", @@ -5705,7 +5703,7 @@ version = "0.76.2" source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.76.2#a0c1e66b0ac037dd56544b9e2d94969ea43d694f" dependencies = [ "anyhow", - "dirs", + "dirs 6.0.0", "serde", "serde_json", ] @@ -5718,7 +5716,7 @@ dependencies = [ "anyhow", "chrono", "clap", - "dirs", + "dirs 6.0.0", "hex", "libc", "libloading 0.9.0", @@ -5839,9 +5837,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a" [[package]] name = "minisign-verify" -version = "0.2.5" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e" +checksum = "871285dc19d8d0ebe0eef3d0e99a205f2a71363b122632cbbfa4a6c370a960ce" [[package]] name = "miniz_oxide" @@ -5871,7 +5869,7 @@ version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "536bfad37a309d62069485248eeaba1e8d9853aaf951caaeaed0585a95346f08" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -5893,7 +5891,7 @@ dependencies = [ "anyhow", "async-trait", "chrono", - "dirs", + "dirs 6.0.0", "hex", "libc", "mesh-llm-hf-hub", @@ -6018,14 +6016,14 @@ dependencies = [ [[package]] name = "muda" -version = "0.19.3" +version = "0.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1dd04e60bc0b07438a6771710ee1698f98f6ebbc7f89b61264af1563b8aeb878" +checksum = "cca139e57da4383727f189e43e66e84fa372347027fc996f9f1a007ec0a37996" dependencies = [ "crossbeam-channel", "dpi", "gtk", - "keyboard-types", + "keyboard-types 0.8.3", "objc2", "objc2-app-kit", "objc2-core-foundation", @@ -6034,7 +6032,7 @@ dependencies = [ "png 0.18.1", "serde", "thiserror 2.0.18", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -6143,9 +6141,9 @@ dependencies = [ [[package]] name = "negentropy" -version = "0.5.0" +version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0efe882e02d206d8d279c20eb40e03baf7cb5136a1476dc084a324fbc3ec42d" +checksum = "a3d66662cb5ca384d4991509755ed5a42dd8e31c4282bf881938e506fc3146ec" [[package]] name = "netdev" @@ -6530,7 +6528,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -6677,6 +6675,7 @@ dependencies = [ "objc2-core-foundation", "objc2-core-graphics", "objc2-foundation", + "objc2-quartz-core", ] [[package]] @@ -7235,7 +7234,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] @@ -7860,9 +7859,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" [[package]] name = "ppmd-rust" -version = "1.4.0" +version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24" +checksum = "494b4379484fc92217cc7d9e3a532375b1d01a61889ec8333025dc3b0377af56" [[package]] name = "ppv-lite86" @@ -8292,7 +8291,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -8695,7 +8694,7 @@ dependencies = [ "wasm-bindgen-futures", "wasm-streams 0.4.2", "web-sys", - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", ] [[package]] @@ -8927,9 +8926,9 @@ dependencies = [ [[package]] name = "rtrb" -version = "0.3.4" +version = "0.3.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ade083ccbb4bf536df69d1f6432cc23deb7acccff86b183f3923a6fd56a1153" +checksum = "fae8ee26b0371a29a77d2b2d6b3ae13aa81def6f9bf1b1b92a32d279a5e709b7" [[package]] name = "rubato" @@ -9046,7 +9045,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -9062,9 +9061,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -9116,7 +9115,7 @@ dependencies = [ "security-framework 3.7.0", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -9127,9 +9126,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -9415,14 +9414,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] name = "selectors" -version = "0.36.1" +version = "0.38.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c" +checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d" dependencies = [ "bitflags 2.13.0", "cssparser", @@ -9782,7 +9781,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32824fab5e16e6c4d86dc1ba84489390419a39f97699852b66480bb87d297ed8" dependencies = [ "bstr", - "dirs", + "dirs 6.0.0", "os_str_bytes", ] @@ -10077,7 +10076,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -10219,6 +10218,12 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" +[[package]] +name = "static_vcruntime" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ff7589a1859b09232522bb9edf076ca7fcf14ded96685d3fa629db73023ffbb7" + [[package]] name = "statrs" version = "0.18.0" @@ -10303,9 +10308,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" [[package]] name = "swift-rs" -version = "1.0.7" +version = "1.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4057c98e2e852d51fdcfca832aac7b571f6b351ad159f9eda5db1655f8d0c4d7" +checksum = "cefd87076fd385308ee4aff597256c902f1fbb4d031de1558efc12f8ffefadd9" dependencies = [ "base64 0.21.7", "serde", @@ -10608,9 +10613,9 @@ checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417" [[package]] name = "tao" -version = "0.35.3" +version = "0.37.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d1c93047acf68669466a34690ac58cca7010bd1b201e1ec86f1fd0a75d3dd4a9" +checksum = "f37f381f4e048e6cdf038b5705f8cf14ad108279d46eb968140a7b291aba9400" dependencies = [ "bitflags 2.13.0", "block2", @@ -10628,29 +10633,29 @@ dependencies = [ "libc", "log", "ndk", + "ndk-context", "ndk-sys", "objc2", "objc2-app-kit", "objc2-foundation", "objc2-ui-kit", - "once_cell", "parking_lot", "percent-encoding", "raw-window-handle", "tao-macros", "unicode-segmentation", "url", - "windows 0.61.3", - "windows-core 0.61.2", + "windows 0.62.2", + "windows-core 0.62.2", "windows-version", "x11-dl", ] [[package]] name = "tao-macros" -version = "0.1.3" +version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f4e16beb8b2ac17db28eab8bca40e62dbfbb34c0fcdc6d9826b11b7b5d047dfd" +checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849" dependencies = [ "proc-macro2", "quote", @@ -10676,14 +10681,14 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1" [[package]] name = "tauri" -version = "2.11.5" +version = "2.12.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "667b20e2726d572dea2de7370da16e188eb06008faf9a92fab7cdc46791190b5" +checksum = "f316751027fc2644221d1a448564d519efb07067fda584879d9cda966391d212" dependencies = [ "anyhow", "bytes", "cookie", - "dirs", + "dirs 7.0.0", "dunce", "embed_plist", "getrandom 0.3.4", @@ -10721,19 +10726,19 @@ dependencies = [ "url", "webkit2gtk", "webview2-com", - "window-vibrancy", - "windows 0.61.3", + "window-vibrancy 0.8.1", + "windows 0.62.2", ] [[package]] name = "tauri-build" -version = "2.6.3" +version = "2.7.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc9ce40b16101cb6ea63d3e221567affd1c3a9205f95d7bc574941a10636b632" +checksum = "641dd5fd297c99ab92717b0428cca5b9c6f960b2ac96ca131b3eebc9d70b8ddc" dependencies = [ "anyhow", "cargo_toml", - "dirs", + "dirs 7.0.0", "glob", "heck 0.5.0", "json-patch", @@ -10741,6 +10746,8 @@ dependencies = [ "semver", "serde", "serde_json", + "static_vcruntime", + "strsim", "tauri-utils", "tauri-winres", "walkdir", @@ -10748,16 +10755,16 @@ dependencies = [ [[package]] name = "tauri-codegen" -version = "2.6.3" +version = "2.7.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "08279169ff42f8fc45a1dbc9dcae888893ba95288142e5880c59b93a26d2cfc5" +checksum = "a6585c5b536c00f039d12ce70a9755172d5423bbcfd3969863baa70314c3e02f" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "brotli", "ico", "json-patch", "plist", - "png 0.17.16", + "png 0.18.1", "proc-macro2", "quote", "semver", @@ -10775,9 +10782,9 @@ dependencies = [ [[package]] name = "tauri-macros" -version = "2.6.3" +version = "2.7.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8b394794f399a421811d06966343e7933fcae92d59f5180b9388d1174497a45" +checksum = "e2e83a0cfa1bae376e8fbbdc0b1692707aed50cd6072ce85cae4789af5d6c19f" dependencies = [ "heck 0.5.0", "proc-macro2", @@ -10789,9 +10796,9 @@ dependencies = [ [[package]] name = "tauri-plugin" -version = "2.6.3" +version = "2.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "74be5dd4bed9afbd145e5716b5fa2ec28cbc29c34ffa61c258c9273d896c8020" +checksum = "67fb21a77e8f94e8beb3325e583102488659365af0a3948b7ea244c5b779c291" dependencies = [ "anyhow", "glob", @@ -10950,16 +10957,16 @@ dependencies = [ [[package]] name = "tauri-plugin-updater" -version = "2.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af" +version = "2.14.0" +source = "git+https://github.com/tauri-apps/plugins-workspace?rev=ba98bfadc4c868c9a7e1a226c83af528e1f11b89#ba98bfadc4c868c9a7e1a226c83af528e1f11b89" dependencies = [ "base64 0.22.1", - "dirs", + "dirs 7.0.0", "flate2", "futures-util", "http", - "infer", + "infer 0.22.0", + "libc", "log", "minisign-verify", "osakit", @@ -10977,8 +10984,8 @@ dependencies = [ "time", "tokio", "url", - "windows-sys 0.60.2", - "zip 4.6.1", + "windows-sys 0.61.2", + "zip 9.0.5", ] [[package]] @@ -10998,9 +11005,9 @@ dependencies = [ [[package]] name = "tauri-runtime" -version = "2.11.3" +version = "2.12.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b0b4bc95aed361b0019067d189a1174a603d460d0f6c72606512d59fc9c12ec8" +checksum = "7c55766d99cea69055904d1735b93c2049302b2e09effd462120deb5581d78e9" dependencies = [ "cookie", "dpi", @@ -11018,14 +11025,14 @@ dependencies = [ "url", "webkit2gtk", "webview2-com", - "windows 0.61.3", + "windows 0.62.2", ] [[package]] name = "tauri-runtime-wry" -version = "2.11.4" +version = "2.12.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4e6fac707727b7a2f48e4ded90976324267371073edbb415ffb73bb0458d203f" +checksum = "8d61892587aea2a85245bcaec98c6fe46268874c0a0deae5535fb71ca7b93eae" dependencies = [ "gtk", "http", @@ -11043,25 +11050,25 @@ dependencies = [ "url", "webkit2gtk", "webview2-com", - "windows 0.61.3", + "windows 0.62.2", "wry", ] [[package]] name = "tauri-utils" -version = "2.9.3" +version = "2.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e176a18e67764923c4f1ce66f25ae4abe5f688384d5eb1a0fa6c77f3d90f887" +checksum = "362ab21cd4cc713f2a02b1a9b5688198b1541cfb6907c4281e9190e0f0ef4aa3" dependencies = [ "anyhow", "brotli", "cargo_metadata", - "ctor 0.8.0", + "ctor", "dom_query", "dunce", "glob", "http", - "infer", + "infer 0.22.0", "json-patch", "log", "memchr", @@ -11114,10 +11121,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -11139,7 +11146,7 @@ dependencies = [ "parking_lot", "rustix", "signal-hook 0.3.18", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -11556,21 +11563,6 @@ dependencies = [ "toml_edit 0.20.2", ] -[[package]] -name = "toml" -version = "0.9.12+spec-1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863" -dependencies = [ - "indexmap 2.14.0", - "serde_core", - "serde_spanned 1.1.1", - "toml_datetime 0.7.5+spec-1.1.0", - "toml_parser", - "toml_writer", - "winnow 0.7.15", -] - [[package]] name = "toml" version = "1.1.2+spec-1.1.0" @@ -11595,15 +11587,6 @@ dependencies = [ "serde", ] -[[package]] -name = "toml_datetime" -version = "0.7.5+spec-1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347" -dependencies = [ - "serde_core", -] - [[package]] name = "toml_datetime" version = "1.1.1+spec-1.1.0" @@ -11854,12 +11837,12 @@ dependencies = [ [[package]] name = "tray-icon" -version = "0.24.1" +version = "0.25.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "65ba1e5f6b9ef9fd87e21b9c6f351554dbd717960089168fcfdef854686961dc" +checksum = "b2b9c52859a94554803ccd4a24b98f74148ebc73b90676d783f3490b1bff9d72" dependencies = [ "crossbeam-channel", - "dirs", + "dirs 7.0.0", "libappindicator", "muda", "objc2", @@ -11871,7 +11854,7 @@ dependencies = [ "png 0.18.1", "serde", "thiserror 2.0.18", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -11972,7 +11955,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e" dependencies = [ "memoffset", "tempfile", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -11991,47 +11974,6 @@ version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94" -[[package]] -name = "unic-char-property" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221" -dependencies = [ - "unic-char-range", -] - -[[package]] -name = "unic-char-range" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc" - -[[package]] -name = "unic-common" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc" - -[[package]] -name = "unic-ucd-ident" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987" -dependencies = [ - "unic-char-property", - "unic-char-range", - "unic-ucd-version", -] - -[[package]] -name = "unic-ucd-version" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4" -dependencies = [ - "unic-common", -] - [[package]] name = "unicase" version = "2.9.0" @@ -12178,13 +12120,13 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" [[package]] name = "urlpattern" -version = "0.3.0" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d" +checksum = "df16f50ef4cc145211879a3867ba757076b25dfee812040dcb0658bd9ae7904b" dependencies = [ + "icu_properties", "regex", "serde", - "unic-ucd-ident", "url", ] @@ -12616,9 +12558,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -12629,30 +12571,28 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] [[package]] name = "webview2-com" -version = "0.38.2" +version = "0.39.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7130243a7a5b33c54a444e54842e6a9e133de08b5ad7b5861cd8ed9a6a5bc96a" +checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6" dependencies = [ "webview2-com-macros", "webview2-com-sys", - "windows 0.61.3", - "windows-core 0.61.2", - "windows-implement", - "windows-interface", + "windows 0.62.2", + "windows-core 0.62.2", ] [[package]] @@ -12668,13 +12608,13 @@ dependencies = [ [[package]] name = "webview2-com-sys" -version = "0.38.2" +version = "0.39.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "381336cfffd772377d291702245447a5251a2ffa5bad679c99e61bc48bacbf9c" +checksum = "b3a07132775117d6065853d9d1178157b8c90e228de47129d6bce2c7edebedfb" dependencies = [ "thiserror 2.0.18", - "windows 0.61.3", - "windows-core 0.61.2", + "windows 0.62.2", + "windows-core 0.62.2", ] [[package]] @@ -12796,7 +12736,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] @@ -12820,6 +12760,22 @@ dependencies = [ "windows-version", ] +[[package]] +name = "window-vibrancy" +version = "0.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "111e51caca442cafd9bab396628ac4d814880eaea4e63dfd76a12e9f342b5580" +dependencies = [ + "objc2", + "objc2-app-kit", + "objc2-core-foundation", + "objc2-foundation", + "objc2-quartz-core", + "raw-window-handle", + "windows-sys 0.60.2", + "windows-version", +] + [[package]] name = "windowfunctions" version = "0.1.1" @@ -13378,12 +13334,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "winnow" -version = "0.7.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945" - [[package]] name = "winnow" version = "1.0.3" @@ -13447,8 +13397,8 @@ dependencies = [ "log", "serde", "thiserror 2.0.18", - "windows 0.62.2", - "windows-core 0.62.2", + "windows 0.61.3", + "windows-core 0.61.2", ] [[package]] @@ -13459,15 +13409,15 @@ checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" [[package]] name = "wry" -version = "0.55.1" +version = "0.57.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "186f9871daa55fd9c016578b810d149de58367113db7fb72b462d2323ce19514" +checksum = "a819957a01b3119af85e638a38d242af76dbc87d130dca67bfd0441072e21ff0" dependencies = [ "base64 0.22.1", "block2", "cookie", "crossbeam-channel", - "dirs", + "dirs 7.0.0", "dom_query", "dpi", "dunce", @@ -13495,8 +13445,8 @@ dependencies = [ "webkit2gtk", "webkit2gtk-sys", "webview2-com", - "windows 0.61.3", - "windows-core 0.61.2", + "windows 0.62.2", + "windows-core 0.62.2", "windows-version", "x11-dl", ] @@ -13694,8 +13644,8 @@ dependencies = [ "chrono", "colored", "const-str", - "ctor 1.0.8", - "dirs", + "ctor", + "dirs 6.0.0", "futures", "git-version", "humantime", @@ -13991,25 +13941,27 @@ dependencies = [ [[package]] name = "zip" -version = "4.6.1" +version = "8.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1" +checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" dependencies = [ - "arbitrary", "crc32fast", + "flate2", "indexmap 2.14.0", "memchr", + "typed-path", + "zopfli", ] [[package]] name = "zip" -version = "8.6.0" +version = "9.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e" dependencies = [ "aes 0.9.1", "bzip2 0.6.1", - "constant_time_eq", + "constant_time_eq 0.6.1", "crc32fast", "deflate64", "flate2", @@ -14018,6 +13970,7 @@ dependencies = [ "indexmap 2.14.0", "lzma-rust2", "memchr", + "nix 0.31.3", "pbkdf2 0.13.0", "ppmd-rust", "sha1 0.11.0", @@ -14054,27 +14007,27 @@ dependencies = [ [[package]] name = "zstd" -version = "0.13.3" +version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" +checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70" dependencies = [ "zstd-safe", ] [[package]] name = "zstd-safe" -version = "7.2.4" +version = "8.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d" +checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b" dependencies = [ "zstd-sys", ] [[package]] name = "zstd-sys" -version = "2.0.16+zstd.1.5.7" +version = "2.1.2+zstd.1.5.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748" +checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3" dependencies = [ "cc", "pkg-config", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index b7b1ceed125..ba50b8be378 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -83,7 +83,8 @@ tauri-plugin-opener = "2" tauri-plugin-single-instance = { version = "2", features = ["deep-link"] } tauri-plugin-window-state = "2" tauri-plugin-dialog = "2" -tauri-plugin-updater = "2" +# Pin the upstream ZIP 9 security fix until the next updater release includes it. +tauri-plugin-updater = { git = "https://github.com/tauri-apps/plugins-workspace", rev = "ba98bfadc4c868c9a7e1a226c83af528e1f11b89" } tauri-plugin-process = "2" infer = "0.19" hex = "0.4" @@ -94,7 +95,8 @@ tokio-util = { version = "0.7", features = ["rt"] } bytes = "1" futures-util = "0.3" opus = "0.3" -neteq = { version = "0.8", default-features = false } +# The desktop advisory exception is audited against this exact source. +neteq = { version = "=0.8.3", default-features = false } serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yaml = "0.9" @@ -140,7 +142,7 @@ png = "0.18" # target-gated inside arboard; at runtime X11 sessions still fall back to X11. arboard = { version = "3", features = ["wayland-data-control"] } image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif"] } -zip = "8" +zip = "9" flate2 = "1" sherpa-onnx = "1.12" regex = "1" diff --git a/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs b/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs index fbfb068c0e5..6d80e0115ae 100644 --- a/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs +++ b/desktop/src-tauri/src/commands/agent_discovery/managed_node.rs @@ -472,7 +472,8 @@ fn validate_managed_node_zip_entries( for i in 0..archive.len() { let name = archive .name_for_index(i) - .ok_or_else(|| format!("Node.js zip entry {i}: missing name"))?; + .ok_or_else(|| format!("Node.js zip entry {i}: missing name"))? + .map_err(|error| format!("Node.js zip entry {i}: {error}"))?; // Absolute-path checks (platform-neutral). if name.starts_with('/') || name.starts_with('\\') { @@ -506,12 +507,7 @@ fn extract_managed_node_zip( .map_err(|e| format!("Node.js zip entry {i}: {e}"))?; let outpath = match entry.enclosed_name() { Some(p) => dest_dir.join(p), - None => { - return Err(format!( - "Node.js zip contains unsafe path: {}", - entry.name() - )) - } + None => return Err(format!("Node.js zip entry {i} contains unsafe path")), }; if entry.is_dir() { std::fs::create_dir_all(&outpath) diff --git a/desktop/src-tauri/src/commands/agent_discovery/managed_node_tests.rs b/desktop/src-tauri/src/commands/agent_discovery/managed_node_tests.rs index a8e1d7f4c81..dc69b1d0dbc 100644 --- a/desktop/src-tauri/src/commands/agent_discovery/managed_node_tests.rs +++ b/desktop/src-tauri/src/commands/agent_discovery/managed_node_tests.rs @@ -83,6 +83,28 @@ fn test_validate_zip_accepts_normal_entries() { assert!(validate_managed_node_zip_entries(&archive).is_ok()); } +#[test] +fn test_validate_zip_rejects_cp437_path_traversal() { + let tmp = make_zip_with_entries(&["node/../é.exe"]); + let mut bytes = std::fs::read(tmp.path()).unwrap(); + let name = "node/../é.exe".as_bytes(); + let positions: Vec<_> = bytes + .windows(name.len()) + .enumerate() + .filter_map(|(index, candidate)| (candidate == name).then_some(index)) + .collect(); + assert_eq!(positions.len(), 2, "local and central ZIP entry names"); + // ZIP falls back to CP437 for non-UTF-8 names. The decoded path must + // still pass through the traversal guard. + for position in positions { + bytes[position + 8] = 0xff; + } + std::fs::write(tmp.path(), bytes).unwrap(); + let archive = zip::ZipArchive::new(std::fs::File::open(tmp.path()).unwrap()).unwrap(); + let error = validate_managed_node_zip_entries(&archive).unwrap_err(); + assert!(error.contains("path traversal"), "{error}"); +} + #[test] fn test_validate_zip_rejects_absolute_path() { let tmp = make_zip_with_entries(&["/etc/passwd"]); diff --git a/scripts/check-desktop-dependency-exceptions.py b/scripts/check-desktop-dependency-exceptions.py new file mode 100644 index 00000000000..f9408e358ee --- /dev/null +++ b/scripts/check-desktop-dependency-exceptions.py @@ -0,0 +1,102 @@ +#!/usr/bin/env python3 +"""Keep the desktop advisory exceptions bound to the code paths they excuse. + +- ringbuf: an unused dependency of neteq 0.8.3. +- zip < 9: reachable only through the optional mesh-llm feature, whose + readers never call the affected extract APIs. +""" + +import json +from pathlib import Path +import re +import subprocess + + +def validate(metadata): + packages = {package["id"]: package for package in metadata["packages"]} + nodes = metadata["resolve"]["nodes"] + affected = [ + package + for package in packages.values() + if package["name"] == "ringbuf" + ] + if len(affected) != 1 or affected[0]["version"] != "0.3.3": + raise ValueError("reassess the ringbuf exception: expected exactly version 0.3.3") + consumers = [ + packages[node["id"]] + for node in nodes + if affected[0]["id"] in node["dependencies"] + ] + if len(consumers) != 1: + raise ValueError("the ringbuf exception requires neteq to be its only consumer") + neteq = consumers[0] + if (neteq["name"], neteq["version"]) != ("neteq", "0.8.3"): + raise ValueError("reassess the ringbuf exception for the new consumer") + if not (neteq["source"] or "").startswith("registry+"): + raise ValueError("reassess the ringbuf exception for the patched neteq source") + dependency = next(dep for dep in neteq["dependencies"] if dep["name"] == "ringbuf") + if dependency["rename"] is not None: + raise ValueError("neteq must not alias the unused ringbuf dependency") + if any("custom-build" in target["kind"] for target in neteq["targets"]): + raise ValueError("reassess neteq source generation before allowing ringbuf") + sources = list(Path(neteq["manifest_path"]).parent.joinpath("src").rglob("*.rs")) + if not sources or any(re.search(r"\bringbuf\b", path.read_text()) for path in sources): + raise ValueError("neteq must not reference ringbuf in its Rust source") + + +# The extract APIs that RUSTSEC-2026-0367/0368/0369 affect. +ZIP_EXTRACT = re.compile(r"\bZipStreamReader\b|\.extract(_unwrapped_root_dir)?\s*\(") +MESH_LLM_SOURCE = "git+https://github.com/Mesh-LLM/mesh-llm.git" + + +def vulnerable_zips(metadata): + return [ + package + for package in metadata["packages"] + if package["name"] == "zip" and int(package["version"].split(".")[0]) < 9 + ] + + +def validate_zip(default_metadata, all_features_metadata): + if vulnerable_zips(default_metadata): + raise ValueError("the default desktop graph must not contain zip below 9") + packages = {package["id"]: package for package in all_features_metadata["packages"]} + nodes = all_features_metadata["resolve"]["nodes"] + for affected in vulnerable_zips(all_features_metadata): + consumers = [ + packages[node["id"]] + for node in nodes + if affected["id"] in node["dependencies"] + ] + if not consumers: + raise ValueError("reassess the zip exception: zip below 9 has no consumer") + for consumer in consumers: + if not (consumer["source"] or "").startswith(MESH_LLM_SOURCE): + raise ValueError( + f"zip {affected['version']} reached by {consumer['name']}; " + "the exception covers only mesh-llm" + ) + sources = Path(consumer["manifest_path"]).parent.joinpath("src").rglob("*.rs") + for path in sources: + if ZIP_EXTRACT.search(path.read_text()): + raise ValueError(f"{path} calls a zip extract API the advisories affect") + + +def cargo_metadata(*flags): + return json.loads( + subprocess.check_output( + [ + "cargo", "metadata", "--format-version", "1", "--locked", *flags, + "--manifest-path", "desktop/src-tauri/Cargo.toml", + ], + text=True, + ) + ) + + +if __name__ == "__main__": + all_features = cargo_metadata("--all-features") + validate(all_features) + validate_zip(cargo_metadata(), all_features) + print("Desktop ringbuf exception remains confined to neteq 0.8.3's unused dependency") + print("Desktop zip < 9 remains confined to mesh-llm, which never calls the affected extract APIs") diff --git a/scripts/ci-required-gates.test.mjs b/scripts/ci-required-gates.test.mjs index db0bb38480d..df3fd2f2fd0 100644 --- a/scripts/ci-required-gates.test.mjs +++ b/scripts/ci-required-gates.test.mjs @@ -23,6 +23,26 @@ const gates = [ "mobile", "security", ]; +test("desktop Rust changes select security and its required gate", () => { + for (const job of ["security-domain", "security"]) { + const body = workflow.match( + new RegExp(`^ ${job}:\\n([\\s\\S]*?)(?=^ [\\w-]+:|$(?![\\s\\S]))`, "m"), + )[1]; + const condition = body.match(/^ {4}if: (.+)$/m)[1]; + for (const desktopRust of [true, false]) { + const expression = condition + .replace(/always\(\)/g, "true") + .replace(/github\.event_name/g, '"pull_request"') + .replace(/needs\.changes\.result/g, '"success"') + .replace( + /needs\.changes\.outputs\.desktop-rust/g, + JSON.stringify(String(desktopRust)), + ) + .replace(/needs\.changes\.outputs\.rust/g, '"false"'); + assert.equal(runInNewContext(expression), desktopRust, job); + } + } +}); for (const gate of gates) { const body = workflow.match( new RegExp(`^ ${gate}:\\n([\\s\\S]*?)(?=^ [\\w-]+:|$(?![\\s\\S]))`, "m"),