deps: bump gpui/gpui-component past async-tar CVE + wrap long tooltips#65
Merged
Conversation
Dependabot alert #17: async-tar < 0.6.1 PAX extension-header desync (GHSA-35rm-7j9c-2f7m), pulled in transitively via zed's http_client. Newer zed drops async-tar from http_client entirely, so the crate leaves the lockfile rather than just moving past the vulnerable range. gpui-component's pin moves in lockstep (2d2524d -> 3c270ed) because its tip tracks gpui's git tip — the old rev doesn't compile against current gpui (BoxShadow gained `inset`, etc.). Note: this breaks the "same commit Baudrun uses" pin alignment noted in Cargo.toml — Baudrun needs the same bump to re-unify build caches. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
SliderEvent gained a Release variant upstream — the log-level subscriber now ignores it (the level already applied live on the last Change during drag). Long button tooltips (Copy as JSON, BPF helper, Npcap, update pill) rendered single-line via gpui-component's Tooltip::new and clipped at the window edge. New with_wrapping_tooltip helper wraps the button in an id'd div carrying a fixed-width Tooltip::element so the text wraps — same trick log_level_label already used, now shared. History trigger keeps the plain tooltip: it's a Popover trigger and its string is short. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security (Dependabot alert #17).
async-tar < 0.6.1PAX extension-header desync (GHSA-35rm-7j9c-2f7m), transitive via zed'shttp_client. Newer zed drops async-tar from http_client entirely — the crate leaves the lockfile. gpui-component moves in lockstep (2d2524d→3c270ed) since its tip tracks gpui's git tip and the old rev doesn't compile against current gpui.API churn absorbed:
SliderEventgained aReleasevariant — the log-level subscriber ignores it (level applies live onChangeduring drag).Tooltip clipping fix. Long button tooltips (Copy as JSON, BPF helper, Npcap, update pill) rendered single-line via gpui-component's
Tooltip::newand clipped at the window edge. Newwith_wrapping_tooltiphelper wraps the button in an id'd div carrying a fixed-widthTooltip::elementso text wraps — the same tricklog_level_labelalready used, now shared.Notes
winget/history-trigger tooltips left as-is (short strings / Popover trigger plumbing).Test plan
cargo buildcleancargo clippy --all-targets -- -D warningscleancargo test— 20 passed🤖 Generated with Claude Code