chore(deps): bump openssl/rand/uuid/postcss for 8 dependabot alerts#188
Conversation
Closes the following advisories:
Rust (src-tauri/Cargo.lock)
- openssl 0.10.77 -> 0.10.79
GHSA-xp3w-r5p5-63rr high X509 OCSP-responder UB on non-UTF-8 URLs
GHSA-8c75-8mhr-p7r9 high AES key-wrap incorrect bounds assertion
GHSA-hppc-g8h3-xhp3 high PSK/cookie trampoline length leak
GHSA-ghm9-cr32-g9qj high MdCtxRef::digest_final OOB write
GHSA-pqf5-4pqq-29f5 high Deriver/PkeyCtxRef::derive overflow on 1.1.1
GHSA-xmgf-hq76-4vx2 low PEM password callback OOB read
- rand 0.8.5 -> 0.8.6
GHSA-cq8v-f236-94qc low Unsoundness with custom logger using rand::rng()
npm (package-lock.json)
- uuid 11.0.x -> 11.1.1
GHSA-w5hq-g745-h8pq medium Missing buffer bounds check in v3/v5/v6 with `buf`
- postcss 8.5.x -> 8.5.14
GHSA-qx2v-qp2m-jg93 medium XSS via unescaped </style> in CSS stringify
Two transitive alerts intentionally left for an upstream-driven follow-up:
- glib 0.18.5 (GHSA-wrw7-89jp-8q8g, medium): pinned by Tauri 2.10's
GTK 0.18 bindings; needs Tauri >= 2.11 to bump.
- rand 0.7.3 (GHSA-cq8v-f236-94qc, low): build-only dep via
selectors -> phf_codegen -> phf_generator; not in any runtime path.
Verified with `npm run build` and `cargo check` — both clean.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (2)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Automated deployment preview for the PR in the Cloudflare Pages. |
2 participants
Summary
Lockfile-only bumps that close 8 of the 10 open Dependabot alerts on this repo. No source changes.
opensslopensslopensslopensslopensslopenssluuidpostcssrand(0.8)Why one PR for everything
All bumps are SemVer-patch updates with no API breakage. Verified locally:
npm run build— cleancd src-tauri && cargo check— cleanIntentionally not in this PR
Two alerts can't be fixed with a lockfile bump:
glib 0.18.5(medium, GHSA-wrw7-89jp-8q8g) — pinned by Tauri 2.10's GTK 0.18 bindings (atk → gtk → muda → tauri). Needs Tauri to ship a release with GTK 0.20 before we can move; tracked upstream.rand 0.7.3(low, GHSA-cq8v-f236-94qc) — build-time only, pulled in viaselectors → phf_codegen → phf_generator. Not in any runtime code path; the runtimerandis the 0.8.6 covered above.Both leftover alerts will be revisited when their upstreams move.
Test plan
npm run android:releaseproduces a working APK