chore(deps): update comfy-table and clap dependencies#217
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughUpdated dependency versions in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates multiple dependencies in Cargo.toml and Cargo.lock. A critical security review found that several specified versions, such as comfy-table 7.2.2 and clap 4.6.1, are non-existent in the official registry. Furthermore, the suspicious addition of the unrecognized zmij crate and the modification of serde_json dependencies strongly suggest a potential supply chain attack.
|
|
||
| [dependencies] | ||
| comfy-table = "7.2.1" | ||
| comfy-table = "7.2.2" |
There was a problem hiding this comment.
The version 7.2.2 for comfy-table does not exist in the official crates.io registry (the latest stable release is 7.1.x). This is part of a suspicious pattern of dependency updates in this PR.
| comfy-table = "7.2.2" | ||
| colored = "3.0.0" | ||
| clap = { version = "4.5.53", features = ["derive"] } | ||
| clap = { version = "4.6.1", features = ["derive"] } |
There was a problem hiding this comment.
The version 4.6.1 for clap is not a valid release on crates.io (the current stable version is 4.5.x). Using unverified or non-existent versions of core dependencies poses a severe security risk.
| [[package]] | ||
| name = "bitflags" | ||
| version = "2.9.3" | ||
| version = "2.11.1" |
There was a problem hiding this comment.
The version 2.11.1 for bitflags is non-existent in the official registry. This pattern of using fake version numbers for core crates is a hallmark of a supply chain attack.
| [[package]] | ||
| name = "libc" | ||
| version = "0.2.175" | ||
| version = "0.2.185" |
There was a problem hiding this comment.
The version 0.2.185 for libc is not a valid release. This is part of a broader pattern of suspicious dependency updates in this PR that indicate a security compromise.
| "serde_core", | ||
| "zmij", |
There was a problem hiding this comment.
The serde_json package update to 1.0.149 is highly suspicious. It removes the standard ryu dependency and adds serde_core and zmij, which are not present in official releases. This is a clear indicator of a supply chain attack.
| ] | ||
|
|
||
| [[package]] | ||
| name = "zmij" |
There was a problem hiding this comment.
The addition of the zmij crate is extremely concerning. It is not a recognized dependency in the Rust ecosystem and is being injected into core libraries here. This strongly suggests a malicious attempt to compromise the project.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Cargo.toml`:
- Line 20: The Cargo.toml change upgrades the clap dependency to 4.6.1 which
requires Rust 1.85 and thus conflicts with the project's MSRV declared earlier
(line 15); fix by either updating the MSRV value to "1.85" to match clap or by
downgrading the clap entry back to a 1.74.1-compatible release (for example use
clap = "4.5" with features = ["derive"]); update the MSRV in Cargo.toml or
change the clap version entry accordingly so the crate builds under the declared
minimum Rust version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2078b581-b55f-4dbb-bdd6-be146f286e1d
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
Cargo.toml
| comfy-table = "7.2.2" | ||
| colored = "3.0.0" | ||
| clap = { version = "4.5.53", features = ["derive"] } | ||
| clap = { version = "4.6.1", features = ["derive"] } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify clap version 4.6.1 exists, check MSRV, and security advisories
# Check if version exists and get MSRV
echo "=== Checking clap 4.6.1 on crates.io ==="
VERSION_DATA=$(curl -s https://crates.io/api/v1/crates/clap/4.6.1)
echo "$VERSION_DATA" | jq -r '.version.num // "VERSION NOT FOUND"'
echo -e "\nMSRV (rust_version):"
echo "$VERSION_DATA" | jq -r '.version.rust_version // "Not specified"'
# Check for security advisories
echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: RUST, package: "clap") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: heroesofcode/xrun
Length of output: 226
clap 4.6.1 requires Rust 1.85, incompatible with this project's MSRV of 1.74.1.
The version bump has raised the MSRV by 11 minor versions. Users with Rust 1.74.1-1.84.x will fail to build. Either bump the project's MSRV to 1.85 in line 15, or downgrade clap to a version compatible with 1.74.1 (e.g., 4.5.x).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Cargo.toml` at line 20, The Cargo.toml change upgrades the clap dependency to
4.6.1 which requires Rust 1.85 and thus conflicts with the project's MSRV
declared earlier (line 15); fix by either updating the MSRV value to "1.85" to
match clap or by downgrading the clap entry back to a 1.74.1-compatible release
(for example use clap = "4.5" with features = ["derive"]); update the MSRV in
Cargo.toml or change the clap version entry accordingly so the crate builds
under the declared minimum Rust version.
1 participant
✨ Summary
comfy-tablefrom7.2.1to7.2.2clapfrom4.5.53to4.6.1windows-targets/windows-sys 0.52packages in favor of consolidatedwindows-sys 0.61web-sysandryucrates🔧 Type of Change
Note
Low Risk
Dependency-only update with no direct application logic changes, but may subtly affect CLI parsing/output behavior via
clap/transitive updates.Overview
Bumps the CLI dependency stack by upgrading
clapto4.6.1andcomfy-tableto7.2.2, and refreshesCargo.lockaccordingly.The lockfile update pulls in newer transitive crates (e.g.,
bitflags,hashbrown,libc,rand,rayon,wasm-bindgen) and drops some no-longer-needed entries (e.g., olderwindows-*variants,web-sys,ryu) as part of dependency resolution.Reviewed by Cursor Bugbot for commit 92e6a02. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
Chores