[asdfghj1237890]

Summary

• rustls 0.23.45 → 0.23.46 in both web/steam-core/Cargo.lock and web/src-tauri/Cargo.lock.
  • Fixes RUSTSEC-2026-0346 (medium), plus -0347, -0348 and -0349 (low), all published 2026-10-14.
  • 0.23.46 is inside the 7-day cooldown. .github/dependabot.yml exempts security updates from it.
• source-map-js 1.2.1 → 1.2.2 in web/package-lock.json. It is a build-time dependency only.
  • Fixes GHSA-68fv-2mgg-jv7q (high).
  • It is the same bump as build(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /web #91, which this PR supersedes.
• tauri-plugin-updater now builds without its default zip feature: default-features = false, features = ["rustls-tls", "system-proxy"].
  • That removes zip 4.6.1 from the lockfile, together with arbitrary and derive_arbitrary. zip 4.6.1 has RUSTSEC-2026-0367 (high), -0368 and -0369 (critical).
  • No upgrade fixes it yet. Every updater release up to 2.14.0 (and 3.0.0-alpha.3) still requires zip ^4. Upstream merged zip 9 in chore(deps): update rust crate zip to v9 tauri-apps/plugins-workspace#3698 but hasn't released it.
  • The feature only unpacks .zip update bundles on Windows (and AppImage archives on Linux). With createUpdaterArtifacts: true, releases ship the signed NSIS -setup.exe and the macOS .app.tar.gz (see the v1.4.2 assets), and neither goes through it.
  • Behaviour change: a .zip update now fails with InvalidUpdaterFormat instead of being unpacked.
  • The app only calls tauri_plugin_updater::Builder::new().build(). Nothing it uses depends on the feature.
• Why every Dependabot PR is red: since these advisories came out, the frontend job (npm audit gate) and the Rust dependency audit job fail on all the open Dependabot PRs, and master would fail the same way.
  • The audit job checks steam-core's lockfile first and stops at the first failure. That is why the zip advisories never appeared in those runs.

Verification

Run locally on Windows with Node 24.18, Rust 1.96 and cargo-audit 0.22.2.

• npm ci, typecheck, lint, test:coverage (246/246, thresholds met) and build all pass.
• test:e2e passes 16/16 on Chromium. Firefox and WebKit aren't installed locally; CI covers them.
• test:rust, lint:rust (fmt and clippy -D warnings) and test:native (debug build and native worker smoke test) pass. They were re-run after the feature change.
• node scripts/audit-gate.mjs passes, and cargo audit --deny warnings is clean on both lockfiles (55 and 493 crates). The audit job's GTK-exception check also passes.
• Not verified here: the macOS build (CI's macOS job covers it) and a real in-app update, which only the next release can show.

After this merges, each of the other open Dependabot PRs needs an @dependabot rebase comment so its CI re-runs on top of this.

🤖 Generated with Claude Code