From efdfb2f60aa5390472e41774f24c828e1b4284c0 Mon Sep 17 00:00:00 2001 From: cst8t <1810150+cst8t@users.noreply.github.com> Date: Sat, 3 Oct 2026 13:57:34 +0100 Subject: [PATCH 01/11] fix(git): improve merge tool handling and testing Make open_merge_tool asynchronous to avoid blocking the main thread, fix an argument issue in the CLI handler, and add comprehensive tests for merge tool failures and successful conflict resolution. --- src-tauri/src/commands/history.rs | 14 ++++--- src-tauri/src/git/cli.rs | 2 +- src-tauri/tests/git.rs | 62 +++++++++++++++++++++++++++++++ 3 files changed, 71 insertions(+), 7 deletions(-) diff --git a/src-tauri/src/commands/history.rs b/src-tauri/src/commands/history.rs index e465909..20c258c 100644 --- a/src-tauri/src/commands/history.rs +++ b/src-tauri/src/commands/history.rs @@ -900,12 +900,14 @@ pub fn conflict_accept_ours( } #[tauri::command] -pub fn open_merge_tool( +pub async fn open_merge_tool( request: FileRequest, - state: tauri::State<'_, AppState>, + app: tauri::AppHandle, ) -> Result { - state - .git_service - .open_merge_tool(request) - .map_err(|error| error.to_string()) + tauri::async_runtime::spawn_blocking(move || { + app.state::().git_service.open_merge_tool(request) + }) + .await + .map_err(|error| error.to_string())? + .map_err(|error| error.to_string()) } diff --git a/src-tauri/src/git/cli.rs b/src-tauri/src/git/cli.rs index 7e3b31d..c885f07 100644 --- a/src-tauri/src/git/cli.rs +++ b/src-tauri/src/git/cli.rs @@ -6406,7 +6406,7 @@ impl GitOperationHandler for CliGitHandler { &overrides, &args, Some(&repo_path), - &[1], + &[], ), &tool_name, )?; diff --git a/src-tauri/tests/git.rs b/src-tauri/tests/git.rs index e5bb924..15a3a80 100644 --- a/src-tauri/tests/git.rs +++ b/src-tauri/tests/git.rs @@ -155,6 +155,68 @@ fn handler() -> CliGitHandler { CliGitHandler } +fn repo_with_merge_tool_conflict(tool_command: &str) -> TempDir { + let dir = init_repo(); + write_file(dir.path(), "report conflict.txt", "base\n"); + git(dir.path(), &["add", "report conflict.txt"]); + git(dir.path(), &["commit", "-m", "base report"]); + git(dir.path(), &["switch", "-c", "report-update"]); + write_file(dir.path(), "report conflict.txt", "remote\n"); + git(dir.path(), &["commit", "-am", "remote report"]); + git(dir.path(), &["switch", "main"]); + write_file(dir.path(), "report conflict.txt", "local\n"); + git(dir.path(), &["commit", "-am", "local report"]); + let merge = Command::new("git") + .args(["merge", "--no-edit", "report-update"]) + .current_dir(dir.path()) + .output() + .expect("create merge conflict"); + assert_eq!(merge.status.code(), Some(1)); + assert!(!git_stdout(dir.path(), &["ls-files", "-u"]).is_empty()); + git(dir.path(), &["config", "merge.tool", "gitmun-test"]); + git( + dir.path(), + &["config", "mergetool.gitmun-test.cmd", tool_command], + ); + git( + dir.path(), + &["config", "mergetool.gitmun-test.trustExitCode", "true"], + ); + dir +} + +#[test] +fn open_merge_tool_reports_failure_and_preserves_conflict() { + let dir = repo_with_merge_tool_conflict("echo merge-tool-launch-failed >&2; exit 1"); + let content_before = read_file(dir.path(), "report conflict.txt"); + let index_before = git_stdout(dir.path(), &["ls-files", "-u"]); + + let error = handler() + .open_merge_tool(&file_request(&dir, "report conflict.txt")) + .expect_err("merge tool failure must reach the caller"); + + assert!(error.to_string().contains("merge-tool-launch-failed")); + assert_eq!(read_file(dir.path(), "report conflict.txt"), content_before); + assert_eq!(git_stdout(dir.path(), &["ls-files", "-u"]), index_before); +} + +#[test] +fn open_merge_tool_resolves_file_with_spaces_and_stages_result() { + let dir = repo_with_merge_tool_conflict("cp \"$REMOTE\" \"$MERGED\""); + + handler() + .open_merge_tool(&file_request(&dir, "report conflict.txt")) + .expect("open merge tool"); + + assert_eq!(read_file(dir.path(), "report conflict.txt"), "remote\n"); + assert!(git_stdout(dir.path(), &["ls-files", "-u"]).is_empty()); + assert_eq!( + git_stdout(dir.path(), &["show", ":report conflict.txt"]), + "remote" + ); + assert!(!dir.path().join("report conflict.txt.orig").exists()); +} + fn gix_handler() -> GixGitHandler { GixGitHandler::new() } From 7707e94c7aff3ec5ba01e15a343dfab1c6294ba0 Mon Sep 17 00:00:00 2001 From: cst8t <1810150+cst8t@users.noreply.github.com> Date: Sat, 3 Oct 2026 15:05:09 +0100 Subject: [PATCH 02/11] feat(git): expand GPG signature status reporting Introduce detailed signature statuses for unknown trust, expired signatures, expired keys, and revoked keys. Update the UI to display these as amber warnings with specific explanations and refine the log view's signature verification and revalidation logic. --- src-tauri/src/commands/history.rs | 127 ++++++++++++---- src-tauri/src/git/types.rs | 10 +- src/components/centre/CentrePanel.css | 10 ++ src/components/centre/LogView.test.tsx | 192 +++++++++++++++++++++++++ src/components/centre/LogView.tsx | 88 +++++++++--- src/i18n/locales/en/centre.json | 8 ++ src/types.ts | 11 +- 7 files changed, 394 insertions(+), 52 deletions(-) diff --git a/src-tauri/src/commands/history.rs b/src-tauri/src/commands/history.rs index 20c258c..402c878 100644 --- a/src-tauri/src/commands/history.rs +++ b/src-tauri/src/commands/history.rs @@ -235,7 +235,10 @@ fn verify_commit_signatures( let retry_results = verify_with_git(repo_path, &retry_hashes, runner)?; for retry_result in retry_results { - if retry_result.status != SignatureStatus::Verified { + if matches!( + retry_result.status, + SignatureStatus::None | SignatureStatus::Signed + ) { continue; } if let Some(result) = results @@ -324,9 +327,13 @@ fn parse_verification_output(stdout: &str, requested_hashes: &[String]) -> Vec SignatureStatus::Verified, + "G" => SignatureStatus::Verified, + "U" => SignatureStatus::UnknownTrust, + "X" => SignatureStatus::ExpiredSignature, + "Y" => SignatureStatus::ExpiredKey, + "R" => SignatureStatus::RevokedKey, "B" => SignatureStatus::Bad, - "U" | "E" => SignatureStatus::UnknownKey, + "E" => SignatureStatus::UnknownKey, _ => SignatureStatus::None, }; let signer = if signer_raw.is_empty() { @@ -536,31 +543,30 @@ mod tests { } #[test] - fn maps_existing_verification_statuses() { - let output = [ - "a\x1fG\x1fAlice\x1fFINGERPRINT\x1fKEY", - "b\x1fB\x1fBob\x1f\x1fBADKEY", - "c\x1fE\x1fCarol\x1f\x1fUNKNOWNKEY", - "d\x1fN\x1f\x1f\x1f", - ] - .join("\n"); - let results = parse_verification_output( - &output, - &[ - "a".to_string(), - "b".to_string(), - "c".to_string(), - "d".to_string(), - ], - ); + fn maps_and_serialises_all_verification_statuses() { + for (signature_status, expected_status, serialised_status) in [ + ("G", SignatureStatus::Verified, "verified"), + ("U", SignatureStatus::UnknownTrust, "unknownTrust"), + ("X", SignatureStatus::ExpiredSignature, "expiredSignature"), + ("Y", SignatureStatus::ExpiredKey, "expiredKey"), + ("R", SignatureStatus::RevokedKey, "revokedKey"), + ("B", SignatureStatus::Bad, "bad"), + ("E", SignatureStatus::UnknownKey, "unknownKey"), + ("N", SignatureStatus::None, "none"), + ] { + let output = format!("a\x1f{signature_status}\x1fAlice\x1fFINGERPRINT\x1fKEY"); + let results = parse_verification_output(&output, &["a".to_string()]); + + assert_eq!(results[0].status, expected_status); + assert_eq!(results[0].fingerprint.as_deref(), Some("FINGERPRINT")); + assert_eq!( + serde_json::to_value(&results[0]).expect("verification should serialise")["status"], + serialised_status + ); + } - assert_eq!(results[0].status, SignatureStatus::Verified); - assert_eq!(results[0].fingerprint.as_deref(), Some("FINGERPRINT")); - assert_eq!(results[1].status, SignatureStatus::Bad); - assert_eq!(results[1].fingerprint.as_deref(), Some("BADKEY")); - assert_eq!(results[2].status, SignatureStatus::UnknownKey); - assert_eq!(results[2].fingerprint.as_deref(), Some("UNKNOWNKEY")); - assert_eq!(results[3].status, SignatureStatus::None); + let results = parse_verification_output("a\x1fE\x1f\x1f\x1fUNKNOWNKEY", &["a".to_string()]); + assert_eq!(results[0].fingerprint.as_deref(), Some("UNKNOWNKEY")); } #[test] @@ -575,6 +581,73 @@ mod tests { assert_eq!(runner.verified_hashes.borrow().len(), 1); } + #[test] + fn warning_signatures_do_not_fetch_gpg_keys() { + for (signature_status, expected_status) in [ + ("U", SignatureStatus::UnknownTrust), + ("X", SignatureStatus::ExpiredSignature), + ("Y", SignatureStatus::ExpiredKey), + ("R", SignatureStatus::RevokedKey), + ] { + for enabled in [false, true] { + let output = format!("a\x1f{signature_status}\x1fAlice\x1fFINGERPRINT\x1fKEY"); + let runner = FakeRunner::new(vec![&output]).with_key_type("a", "gpg"); + let results = + verify_commit_signatures("/repo", &["a".to_string()], enabled, &runner) + .expect("verification should complete"); + + assert_eq!(results[0].status, expected_status); + assert_eq!(results[0].signer.as_deref(), Some("Alice")); + assert_eq!(results[0].fingerprint.as_deref(), Some("FINGERPRINT")); + assert!(runner.fetched_keys.borrow().is_empty()); + assert_eq!(runner.verified_hashes.borrow().len(), 1); + } + } + } + + #[test] + fn fetched_gpg_key_retry_applies_status_and_metadata() { + for (signature_status, expected_status) in [ + ("G", SignatureStatus::Verified), + ("U", SignatureStatus::UnknownTrust), + ("X", SignatureStatus::ExpiredSignature), + ("Y", SignatureStatus::ExpiredKey), + ("R", SignatureStatus::RevokedKey), + ("B", SignatureStatus::Bad), + ("E", SignatureStatus::UnknownKey), + ] { + let retry_output = format!("a\x1f{signature_status}\x1fAlice\x1fFINGERPRINT\x1fABC123"); + let runner = FakeRunner::new(vec!["a\x1fE\x1f\x1f\x1fABC123", &retry_output]) + .with_key_type("a", "gpg") + .with_global_gpg_program("gpg"); + let results = verify_commit_signatures("/repo", &["a".to_string()], true, &runner) + .expect("verification should complete"); + + assert_eq!(results[0].status, expected_status); + assert_eq!(results[0].signer.as_deref(), Some("Alice")); + assert_eq!(results[0].fingerprint.as_deref(), Some("FINGERPRINT")); + assert_eq!( + runner.fetched_keys.borrow().as_slice(), + &["gpg ABC123".to_string()] + ); + assert_eq!(runner.verified_hashes.borrow().len(), 2); + } + } + + #[test] + fn missing_retry_row_preserves_initial_verification_result() { + let runner = + FakeRunner::new(vec!["a\x1fE\x1f\x1f\x1fABC123", ""]).with_key_type("a", "gpg"); + let results = verify_commit_signatures("/repo", &["a".to_string()], true, &runner) + .expect("verification should complete"); + + assert_eq!(results[0].status, SignatureStatus::UnknownKey); + assert_eq!(results[0].signer, None); + assert_eq!(results[0].fingerprint.as_deref(), Some("ABC123")); + assert_eq!(runner.fetched_keys.borrow().len(), 1); + assert_eq!(runner.verified_hashes.borrow().len(), 2); + } + #[test] fn enabled_keyserver_verification_fetches_unknown_gpg_key_and_retries() { let runner = FakeRunner::new(vec![ diff --git a/src-tauri/src/git/types.rs b/src-tauri/src/git/types.rs index 1bdefbd..e380ac2 100644 --- a/src-tauri/src/git/types.rs +++ b/src-tauri/src/git/types.rs @@ -1046,8 +1046,16 @@ pub enum SignatureStatus { /// gpgsig header present but we have not attempted verification yet /// (fast path from gix - no subprocess cost). Signed, - /// Signature cryptographically valid (G / U / X / Y / R from git %G?). + /// Signature cryptographically valid (G from git %G?). Verified, + /// Signature valid, but trust in the signer's identity is unknown (U). + UnknownTrust, + /// Signature cryptographically valid but expired (X). + ExpiredSignature, + /// Signature valid, but the signing key has expired (Y). + ExpiredKey, + /// Signature valid, but the signing key has been revoked (R). + RevokedKey, /// Signature present but key is not in the local keyring (E). UnknownKey, /// Signature is cryptographically bad (B). diff --git a/src/components/centre/CentrePanel.css b/src/components/centre/CentrePanel.css index 434d2a6..4ff63cd 100644 --- a/src/components/centre/CentrePanel.css +++ b/src/components/centre/CentrePanel.css @@ -1199,6 +1199,8 @@ cursor: pointer; background: none; font-family: var(--font-ui); + white-space: nowrap; + flex-shrink: 0; } .log-view__sig-badge--verified { @@ -1207,6 +1209,12 @@ border-color: var(--diff-add-border); } +.log-view__sig-badge--warning { + color: var(--yellow); + background: color-mix(in srgb, var(--yellow) 12%, transparent); + border-color: color-mix(in srgb, var(--yellow) 35%, transparent); +} + .log-view__sig-badge--unknown { color: var(--text-muted); background: var(--surface-2, rgba(128, 128, 128, 0.1)); @@ -1300,6 +1308,7 @@ } .sig-popover--verified { border-top: 2px solid var(--green); } +.sig-popover--warning { border-top: 2px solid var(--yellow); } .sig-popover--bad { border-top: 2px solid var(--red); } .sig-popover--unknown { border-top: 2px solid var(--border); } @@ -1333,6 +1342,7 @@ } .sig-popover--verified .sig-popover__header { color: var(--green); } +.sig-popover--warning .sig-popover__header { color: var(--yellow); } .sig-popover--bad .sig-popover__header { color: var(--red); } .sig-popover__header .log-view__sig-icon { diff --git a/src/components/centre/LogView.test.tsx b/src/components/centre/LogView.test.tsx index 2b77dd5..2cdc5d9 100644 --- a/src/components/centre/LogView.test.tsx +++ b/src/components/centre/LogView.test.tsx @@ -7,6 +7,7 @@ import "../../i18n"; import { LogView } from "./LogView"; import { addSshSigningKeyToAllowedSigners, + getSettings, getSshAllowedSignerStatus, verifyCommits, } from "../../api/commands"; @@ -56,6 +57,7 @@ vi.mock("@tauri-apps/plugin-dialog", () => ({ vi.mock("../../api/commands", () => ({ addSshSigningKeyToAllowedSigners: vi.fn(async () => ({ message: "Added", backendUsed: "git-cli" })), + getSettings: vi.fn(async () => settingsPayload), getSshAllowedSignerStatus: vi.fn(async () => ({ setupNeeded: false, targetPath: null, @@ -71,6 +73,7 @@ vi.mock("../../api/commands", () => ({ })); const mockAddSshSigningKeyToAllowedSigners = vi.mocked(addSshSigningKeyToAllowedSigners); +const mockGetSettings = vi.mocked(getSettings); const mockGetSshAllowedSignerStatus = vi.mocked(getSshAllowedSignerStatus); const mockVerifyCommits = vi.mocked(verifyCommits); @@ -344,6 +347,8 @@ describe("LogView commit selection", () => { virtuosoCallbacksEnabled.current = true; mockAddSshSigningKeyToAllowedSigners.mockReset(); mockAddSshSigningKeyToAllowedSigners.mockResolvedValue({ message: "Added", backendUsed: "git-cli" }); + mockGetSettings.mockReset(); + mockGetSettings.mockResolvedValue(settingsPayload); mockGetSshAllowedSignerStatus.mockReset(); mockGetSshAllowedSignerStatus.mockResolvedValue({ setupNeeded: false, @@ -893,6 +898,36 @@ describe("LogView commit selection", () => { expect(await screen.findByText("Verified")).toBeInTheDocument(); }); + it.each([ + ["unknownTrust", "Signature valid", "The cryptographic signature is valid, but the signer's identity trust is unknown."], + ["expiredSignature", "Expired signature", "The cryptographic signature is valid, but the signature has expired."], + ["expiredKey", "Expired key", "The cryptographic signature is valid, but the signing key has expired."], + ["revokedKey", "Revoked key", "The cryptographic signature is valid, but the signing key has been revoked."], + ] as const)("displays %s as an amber warning and retains its signature details", async (status, label, explanation) => { + const signedCommit = commit(1, { signatureStatus: "signed", keyType: "gpg" }); + mockVerifyCommits.mockResolvedValue([{ + hash: signedCommit.hash, + status, + signer: "Test Signer", + fingerprint: "SHA256:test", + }]); + + renderLog({ repoPath: "/repo", commits: [signedCommit] }); + + const badge = await screen.findByRole("button", { name: label }); + expect(badge).toHaveClass("log-view__sig-badge--warning"); + expect(badge.querySelector('path[d="M8 4.75v4.25M8 11.5h.01"]')).toBeInTheDocument(); + + fireEvent.click(badge); + expect(screen.getByText(explanation)).toBeInTheDocument(); + expect(screen.getByRole("dialog")).toHaveClass("sig-popover--warning"); + fireEvent.click(screen.getByRole("button", { name: "Copy signer" })); + fireEvent.click(screen.getByRole("button", { name: "Copy fingerprint" })); + + expect(writeText).toHaveBeenCalledWith("Test Signer"); + expect(writeText).toHaveBeenCalledWith("SHA256:test"); + }); + it("upgrades signed commits when the graph is hidden", async () => { const signedCommit = commit(1, { signatureStatus: "signed" }); mockVerifyCommits.mockResolvedValue([ @@ -935,6 +970,71 @@ describe("LogView commit selection", () => { expect(mockVerifyCommits).toHaveBeenCalledTimes(1); }); + it("revalidates once for the paired settings save events", async () => { + const signedCommit = commit(1, { signatureStatus: "signed", keyType: "gpg" }); + const secondVerification = deferred>>(); + const result = [{ hash: signedCommit.hash, status: "verified" as const, signer: "Test Signer", fingerprint: "ABC123" }]; + mockVerifyCommits.mockResolvedValueOnce(result) + .mockReturnValueOnce(secondVerification.promise) + .mockResolvedValue(result); + + renderLog({ repoPath: "/repo", commits: [signedCommit] }); + + await screen.findByText("Verified"); + await waitForSignatureSettingsListener(); + await waitFor(() => expect(eventListeners.get("settings-updated")?.length).toBe(1)); + + await act(async () => { + emitEvent("settings-updated", { ...settingsPayload, gpgKeyserverVerificationEnabled: true }); + await Promise.resolve(); + emitEvent("signature-settings-updated"); + }); + expect(mockVerifyCommits).toHaveBeenCalledTimes(2); + + await act(async () => { + secondVerification.resolve(result); + await secondVerification.promise; + }); + expect(mockVerifyCommits).toHaveBeenCalledTimes(2); + expect(screen.getByText("Verified")).toBeInTheDocument(); + }); + + it("queues one settings refresh behind an active verification", async () => { + const signedCommit = commit(1, { signatureStatus: "signed", keyType: "gpg" }); + const firstVerification = deferred>>(); + const secondVerification = deferred>>(); + const result = [{ hash: signedCommit.hash, status: "verified" as const, signer: "Test Signer", fingerprint: "ABC123" }]; + mockVerifyCommits.mockReturnValueOnce(firstVerification.promise) + .mockReturnValueOnce(secondVerification.promise) + .mockResolvedValue(result); + + renderLog({ repoPath: "/repo", commits: [signedCommit] }); + + await waitFor(() => expect(mockVerifyCommits).toHaveBeenCalledTimes(1)); + await waitForSignatureSettingsListener(); + await waitFor(() => expect(eventListeners.get("settings-updated")?.length).toBe(1)); + + await act(async () => { + emitEvent("settings-updated", { ...settingsPayload, gpgKeyserverVerificationEnabled: true }); + await Promise.resolve(); + emitEvent("signature-settings-updated"); + }); + expect(mockVerifyCommits).toHaveBeenCalledTimes(1); + + await act(async () => { + firstVerification.resolve(result); + await firstVerification.promise; + }); + expect(mockVerifyCommits).toHaveBeenCalledTimes(2); + expect(mockVerifyCommits).toHaveBeenLastCalledWith("/repo", [signedCommit.hash]); + + await act(async () => { + secondVerification.resolve(result); + await secondVerification.promise; + }); + expect(mockVerifyCommits).toHaveBeenCalledTimes(2); + }); + it("verifies signed commits again after signature settings change", async () => { const signedCommit = commit(1, { signatureStatus: "signed" }); const secondVerification = deferred>>(); @@ -1149,6 +1249,69 @@ describe("LogView commit selection", () => { expect(screen.queryByText("Signed")).not.toBeInTheDocument(); }); + it("replaces a verified signature with a newer warning result", async () => { + const signedCommit = commit(1, { signatureStatus: "signed" }); + mockVerifyCommits + .mockResolvedValueOnce([{ + hash: signedCommit.hash, + status: "verified", + signer: "Test Signer", + fingerprint: "SHA256:test", + }]) + .mockResolvedValueOnce([{ + hash: signedCommit.hash, + status: "revokedKey", + signer: "Test Signer", + fingerprint: "SHA256:test", + }]); + + renderLog({ repoPath: "/repo", commits: [signedCommit] }); + + expect(await screen.findByText("Verified")).toBeInTheDocument(); + fireEvent.click(screen.getByRole("button", { name: "Verified" })); + expect(screen.getByRole("dialog")).toHaveTextContent("This commit was signed with a verified signature."); + await waitForSignatureSettingsListener(); + act(() => { + emitEvent("signature-settings-updated"); + }); + + await waitFor(() => expect(screen.getByRole("dialog")).toHaveTextContent("Revoked key")); + expect(screen.getByRole("dialog")).toHaveTextContent("The cryptographic signature is valid, but the signing key has been revoked."); + expect(screen.queryByText("Verified")).not.toBeInTheDocument(); + }); + + it.each(["rejection", "missing result"] as const)("keeps a warning visible when a revalidation returns %s", async outcome => { + const signedCommit = commit(1, { signatureStatus: "signed" }); + mockVerifyCommits.mockResolvedValueOnce([{ + hash: signedCommit.hash, + status: "unknownTrust", + signer: "Test Signer", + fingerprint: "SHA256:test", + }]); + const revalidation = deferred>>(); + mockVerifyCommits.mockReturnValueOnce(revalidation.promise); + + renderLog({ repoPath: "/repo", commits: [signedCommit] }); + + expect(await screen.findByText("Signature valid")).toBeInTheDocument(); + await waitForSignatureSettingsListener(); + act(() => { + emitEvent("signature-settings-updated"); + }); + + await waitFor(() => expect(mockVerifyCommits).toHaveBeenCalledTimes(2)); + await act(async () => { + if (outcome === "rejection") { + revalidation.reject(new Error("verification failed")); + } else { + revalidation.resolve([]); + } + await revalidation.promise.catch(() => {}); + }); + expect(screen.getByRole("button", { name: "Signature valid" })).toHaveClass("log-view__sig-badge--warning"); + expect(screen.queryByText("Signed")).not.toBeInTheDocument(); + }); + it("caps visible verification batches at twenty commits", async () => { const signedCommits = Array.from({ length: 25 }, (_, index) => ( commit(index + 1, { @@ -1244,6 +1407,35 @@ describe("LogView commit selection", () => { }); }); + it("removes SSH repair when an open popover receives a warning result", async () => { + const signedCommit = commit(1, { signatureStatus: "signed", keyType: "ssh" }); + const metadata = { hash: signedCommit.hash, signer: "test@gitmun.test", fingerprint: "SHA256:test" }; + mockVerifyCommits.mockResolvedValueOnce([{ ...metadata, status: "unknownKey" }]) + .mockResolvedValueOnce([{ ...metadata, status: "revokedKey" }]); + mockGetSshAllowedSignerStatus.mockResolvedValue({ + setupNeeded: true, + targetPath: "/repo/.git/gitmun_allowed_signers", + blockingReason: null, + allowedSignersConfigured: false, + allowedSignersExists: false, + signingKeyPresent: true, + signingKeyTrusted: false, + resolvedPublicKeyFingerprint: null, + reason: "untrustedSigningKey", + }); + + renderLog({ repoPath: "/repo", commits: [signedCommit] }); + + fireEvent.click(await screen.findByRole("button", { name: "Signed" })); + await screen.findByRole("button", { name: "Add my SSH signing key" }); + await waitForSignatureSettingsListener(); + act(() => emitEvent("signature-settings-updated")); + + await waitFor(() => expect(screen.getByRole("dialog")).toHaveTextContent("Revoked key")); + expect(screen.queryByRole("button", { name: "Add my SSH signing key" })).not.toBeInTheDocument(); + expect(mockAddSshSigningKeyToAllowedSigners).not.toHaveBeenCalled(); + }); + it("does not offer arbitrary SSH commit trust without configured key material", async () => { const signedCommit = commit(1, { signatureStatus: "signed", keyType: "ssh" }); mockVerifyCommits.mockResolvedValue([{ diff --git a/src/components/centre/LogView.tsx b/src/components/centre/LogView.tsx index 810829e..5fdf0b7 100644 --- a/src/components/centre/LogView.tsx +++ b/src/components/centre/LogView.tsx @@ -52,6 +52,7 @@ function formatFingerprint(fingerprint: string): string { } type SigPopoverData = { + hash: string; rect: DOMRect; status: SignatureStatus; signer: string | null; @@ -61,11 +62,13 @@ type SigPopoverData = { }; function ShieldIcon({ status }: { status: SignatureStatus }) { + const warning = warningSignatureStatus(status); return ( ); } @@ -158,7 +161,7 @@ function SignaturePopover({ data, repoPath, onClose }: { data: SigPopoverData; r }, [keyType, repoPath, status]); const handleAddAllowedSigner = async () => { - if (!repoPath || !repairStatus) return; + if (!repoPath || status !== "unknownKey" || keyType !== "ssh" || !repairStatus) return; setRepairLoading(true); try { await addSshSigningKeyToAllowedSigners(repoPath, repairStatus.scope); @@ -177,16 +180,25 @@ function SignaturePopover({ data, repoPath, onClose }: { data: SigPopoverData; r const heading = status === "verified" ? t("log.signedVerified") : - status === "bad" ? t("log.signedBad") : + status === "unknownTrust" ? t("log.signatureValid") : + status === "expiredSignature" ? t("log.expiredSignature") : + status === "expiredKey" ? t("log.expiredKey") : + status === "revokedKey" ? t("log.revokedKey") : + status === "bad" ? t("log.signedBad") : status === "unknownKey" ? t("log.signedUnknownKey") : - t("log.signedUnverified"); - const explanation = status === "unknownKey" && keyType === "ssh" - ? repairStatus?.status.reason === "missingAllowedSignersFile" - ? t("log.sshAllowedSignersMissing") - : t("log.sshAllowedSignersUntrusted") - : null; - - const mod = status === "verified" ? "verified" : status === "bad" ? "bad" : "unknown"; + t("log.signedUnverified"); + const explanation = + status === "unknownTrust" ? t("log.unknownTrustExplanation") : + status === "expiredSignature" ? t("log.expiredSignatureExplanation") : + status === "expiredKey" ? t("log.expiredKeyExplanation") : + status === "revokedKey" ? t("log.revokedKeyExplanation") : + status === "unknownKey" && keyType === "ssh" + ? repairStatus?.status.reason === "missingAllowedSignersFile" + ? t("log.sshAllowedSignersMissing") + : t("log.sshAllowedSignersUntrusted") + : null; + + const mod = status === "verified" ? "verified" : status === "bad" ? "bad" : warningSignatureStatus(status) ? "warning" : "unknown"; return (
@@ -226,7 +238,7 @@ function SignaturePopover({ data, repoPath, onClose }: { data: SigPopoverData; r {t("log.date")} {new Date(date).toLocaleString()}
- {repairStatus && ( + {status === "unknownKey" && keyType === "ssh" && repairStatus && ( + ); } function repairableStatus(status: SshAllowedSignerStatus | null): boolean { @@ -215,7 +235,7 @@ function SignaturePopover({ data, repoPath, onClose }: { data: SigPopoverData; r {t("log.signer")} {signer} - + )} @@ -230,7 +250,7 @@ function SignaturePopover({ data, repoPath, onClose }: { data: SigPopoverData; r {t("log.fingerprint")} {formatFingerprint(fingerprint)} - + )} diff --git a/src/i18n/locales/en/centre.json b/src/i18n/locales/en/centre.json index 3aecaa9..8fa0bf7 100644 --- a/src/i18n/locales/en/centre.json +++ b/src/i18n/locales/en/centre.json @@ -99,6 +99,7 @@ "commitRefs": "Commit refs", "copyCommitHash": "Copy Commit Hash", "copyDetails": "Copy Details", + "copied": "Copied", "copyFingerprint": "Copy fingerprint", "copyShortHash": "Copy Short Hash", "copySigner": "Copy signer", From d8a5949f67a8f5ef7beeb380d24120dd7dcf1ad9 Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 16:09:16 +0000 Subject: [PATCH 04/11] fix(security): update open from 5.3.4 to 5.4.0 --- src-tauri/Cargo.lock | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 4c1aec5..48735de 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -4358,14 +4358,13 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe" [[package]] name = "open" -version = "5.3.4" +version = "5.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f3bab717c29a857abf75fcef718d441ec7cb2725f937343c734740a985d37fd" +checksum = "a0b3d059e795d52b8a72fef45658620edd4d9c359b338564aa14391ffa511ed5" dependencies = [ "dunce", "is-wsl", "libc", - "pathdiff", ] [[package]] @@ -4490,12 +4489,6 @@ dependencies = [ "windows-link 0.2.1", ] -[[package]] -name = "pathdiff" -version = "0.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3" - [[package]] name = "pci-info" version = "0.3.4" From 75e73e983dad33cab2ed548854088f070769645f Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 16:15:43 +0000 Subject: [PATCH 05/11] fix(security): update zerovec-derive from 0.11.3 to 0.11.5 --- src-tauri/Cargo.lock | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 4c1aec5..5b58f91 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -5819,6 +5819,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "syn" +version = "3.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + [[package]] name = "sync_wrapper" version = "1.0.2" @@ -8108,13 +8119,13 @@ dependencies = [ [[package]] name = "zerovec-derive" -version = "0.11.3" +version = "0.11.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" +checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9" dependencies = [ "proc-macro2", "quote", - "syn 2.0.117", + "syn 3.0.6", ] [[package]] From bfdffc901373ed6280aa73c141e6cc21fb2565e4 Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 16:20:09 +0000 Subject: [PATCH 06/11] fix(security): update tauri from 2.11.1 to 2.11.6 --- src-tauri/Cargo.lock | 401 ++++++++++++++++++++++++------------------- 1 file changed, 226 insertions(+), 175 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 4c1aec5..9f72e0e 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -30,15 +30,15 @@ dependencies = [ [[package]] name = "alloc-no-stdlib" -version = "2.0.4" +version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3" +checksum = "c2fb6cfd47bf496ff64095c20eaba0c201404ee38714d4142fcfa1dc334fcc7a" [[package]] name = "alloc-stdlib" -version = "0.2.2" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece" +checksum = "0b5c1865780388bfa186411ab5f247819487fc4864c6e9c3106611fa347586e1" dependencies = [ "alloc-no-stdlib", ] @@ -579,9 +579,9 @@ dependencies = [ [[package]] name = "brotli" -version = "8.0.2" +version = "9.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4bd8b9603c7aa97359dbd97ecf258968c95f3adddd6db2f7e7a5bef101c84560" +checksum = "f8b851b75c23ca7873623d612fe49bd1989aeb03d08fb9432187eb253d3d4c6b" dependencies = [ "alloc-no-stdlib", "alloc-stdlib", @@ -590,9 +590,9 @@ dependencies = [ [[package]] name = "brotli-decompressor" -version = "5.0.0" +version = "6.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "874bb8112abecc98cbd6d81ea4fa7e94fb9449648c93cc89aa40c81c24d7de03" +checksum = "941cd9bd4ddab83cb46fa5a2d428f1c857b24ac78cb876cf7beb710840934bd7" dependencies = [ "alloc-no-stdlib", "alloc-stdlib", @@ -720,12 +720,13 @@ dependencies = [ [[package]] name = "cargo_toml" -version = "0.22.3" +version = "1.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "374b7c592d9c00c1f4972ea58390ac6b18cbb6ab79011f3bdc90a0b82ca06b77" +checksum = "82f4b26e751e711a5302649417f2da046dce6391b2ea30a4820f37462314f0b9" dependencies = [ + "semver", "serde", - "toml 0.9.12+spec-1.1.0", + "toml 1.1.2+spec-1.1.0", ] [[package]] @@ -766,6 +767,17 @@ dependencies = [ "uuid", ] +[[package]] +name = "cfb" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a347dcabdae9c31b0825fd6a8bed285ec9c2acb89c47827126d52fa4f59cece3" +dependencies = [ + "fnv", + "uuid", + "web-time", +] + [[package]] name = "cfg-expr" version = "0.15.8" @@ -1038,9 +1050,9 @@ dependencies = [ [[package]] name = "cssparser" -version = "0.36.0" +version = "0.37.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2" +checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98" dependencies = [ "cssparser-macros", "dtoa-short", @@ -1051,9 +1063,9 @@ dependencies = [ [[package]] name = "cssparser-macros" -version = "0.6.1" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331" +checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a" dependencies = [ "quote", "syn 2.0.117", @@ -1061,19 +1073,9 @@ dependencies = [ [[package]] name = "ctor" -version = "0.8.0" +version = "1.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "352d39c2f7bef1d6ad73db6f5160efcaed66d94ef8c6c573a8410c00bf909a98" -dependencies = [ - "ctor-proc-macro", - "dtor", -] - -[[package]] -name = "ctor-proc-macro" -version = "0.0.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1" +checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d" [[package]] name = "ctutils" @@ -1217,6 +1219,15 @@ dependencies = [ "dirs-sys", ] +[[package]] +name = "dirs" +version = "7.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f" +dependencies = [ + "dirs-sys", +] + [[package]] name = "dirs-sys" version = "0.5.0" @@ -1286,9 +1297,9 @@ dependencies = [ [[package]] name = "dom_query" -version = "0.27.0" +version = "0.28.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89" +checksum = "fac5fca71e65e94cc718a6e2af65d6e0f9c6027751c2aa562fbb5087fda639bc" dependencies = [ "bit-set", "cssparser", @@ -1329,21 +1340,6 @@ dependencies = [ "dtoa", ] -[[package]] -name = "dtor" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1057d6c64987086ff8ed0fd3fbf377a6b7d205cc7715868cd401705f715cbe4" -dependencies = [ - "dtor-proc-macro", -] - -[[package]] -name = "dtor-proc-macro" -version = "0.0.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5" - [[package]] name = "dunce" version = "1.0.5" @@ -1886,7 +1882,7 @@ dependencies = [ "getrandom 0.3.4", "gix", "gtk", - "infer", + "infer 0.19.0", "keyring", "linux-terminal-launch", "md5", @@ -1913,7 +1909,7 @@ dependencies = [ "url", "webkit2gtk", "windows 0.61.3", - "windows-future", + "windows-future 0.2.1", ] [[package]] @@ -3095,9 +3091,9 @@ dependencies = [ [[package]] name = "html5ever" -version = "0.38.0" +version = "0.39.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1054432bae2f14e0061e33d23402fbaa67a921d319d56adc6bcf887ddad1cbc2" +checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8" dependencies = [ "log", "markup5ever", @@ -3250,7 +3246,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.58.0", + "windows-core 0.61.2", ] [[package]] @@ -3416,7 +3412,16 @@ version = "0.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7" dependencies = [ - "cfb", + "cfb 0.7.3", +] + +[[package]] +name = "infer" +version = "0.22.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4200d433cbd5178df7797c9c2e75b348b728e39631cf14520d1e2fc424201f4" +dependencies = [ + "cfb 0.14.0", ] [[package]] @@ -3658,21 +3663,21 @@ dependencies = [ [[package]] name = "json-patch" -version = "3.0.1" +version = "4.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08" +checksum = "7421438de105a0827e44fadd05377727847d717c80ce29a229f85fd04c427b72" dependencies = [ "jsonptr", "serde", "serde_json", - "thiserror 1.0.69", + "thiserror 2.0.18", ] [[package]] name = "jsonptr" -version = "0.6.3" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70" +checksum = "a5a3cc660ba5d72bce0b3bb295bf20847ccbb40fd423f3f05b61273672e561fe" dependencies = [ "serde", "serde_json", @@ -3846,9 +3851,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" [[package]] name = "markup5ever" -version = "0.38.0" +version = "0.39.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8983d30f2915feeaaab2d6babdd6bc7e9ed1a00b66b5e6d74df19aa9c0e91862" +checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de" dependencies = [ "log", "tendril", @@ -3976,6 +3981,12 @@ dependencies = [ "thiserror 1.0.69", ] +[[package]] +name = "ndk-context" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b" + [[package]] name = "ndk-sys" version = "0.6.0+11769913" @@ -5337,9 +5348,9 @@ dependencies = [ [[package]] name = "selectors" -version = "0.36.1" +version = "0.38.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c" +checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d" dependencies = [ "bitflags 2.11.1", "cssparser", @@ -5789,9 +5800,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" [[package]] name = "swift-rs" -version = "1.0.7" +version = "1.0.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4057c98e2e852d51fdcfca832aac7b571f6b351ad159f9eda5db1655f8d0c4d7" +checksum = "e45c444e496845d3f2a351146bff59aae4975b2280238df1dfaa0c7d1846f38e" dependencies = [ "base64 0.21.7", "serde", @@ -5863,9 +5874,9 @@ dependencies = [ [[package]] name = "tao" -version = "0.35.2" +version = "0.37.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a33f7f9e486ade65fcf1e45c440f9236c904f5c1002cdc7fc6ae582777345ce4" +checksum = "f37f381f4e048e6cdf038b5705f8cf14ad108279d46eb968140a7b291aba9400" dependencies = [ "bitflags 2.11.1", "block2", @@ -5883,29 +5894,29 @@ dependencies = [ "libc", "log", "ndk", + "ndk-context", "ndk-sys", "objc2", "objc2-app-kit", "objc2-foundation", "objc2-ui-kit", - "once_cell", "parking_lot", "percent-encoding", "raw-window-handle", "tao-macros", "unicode-segmentation", "url", - "windows 0.61.3", - "windows-core 0.61.2", + "windows 0.62.2", + "windows-core 0.62.2", "windows-version", "x11-dl", ] [[package]] name = "tao-macros" -version = "0.1.3" +version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f4e16beb8b2ac17db28eab8bca40e62dbfbb34c0fcdc6d9826b11b7b5d047dfd" +checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849" dependencies = [ "proc-macro2", "quote", @@ -5931,14 +5942,14 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1" [[package]] name = "tauri" -version = "2.11.1" +version = "2.11.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b93bd86d231f0a8138f11a02a584769fe4b703dc36ae133d783228dbc4801405" +checksum = "6fa5bacdb9bbad5954af3d1bd6cf6ae9192cab1b2e270f4a07f904610b9e85f4" dependencies = [ "anyhow", "bytes", "cookie", - "dirs", + "dirs 6.0.0", "dunce", "embed_plist", "getrandom 0.3.4", @@ -5975,20 +5986,20 @@ dependencies = [ "tray-icon", "url", "webkit2gtk", - "webview2-com", + "webview2-com 0.38.2", "window-vibrancy", "windows 0.61.3", ] [[package]] name = "tauri-build" -version = "2.6.1" +version = "2.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3a318b234cc2dea65f575467bafcfb76286bce228ebc3778e337d61d03213007" +checksum = "59563ca5b331fd97f27ee9672ec8d36d33bb3c9e2c9f6710a1a5687256052e45" dependencies = [ "anyhow", "cargo_toml", - "dirs", + "dirs 7.0.0", "glob", "heck 0.5.0", "json-patch", @@ -6003,16 +6014,16 @@ dependencies = [ [[package]] name = "tauri-codegen" -version = "2.6.1" +version = "2.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6bd11644962add2549a60b7e7c6800f17d7020156e02f516021d8103e80cc528" +checksum = "e50213e463086ecc283d7e9f51c30cc0fd304ad457425158018be26dbf0d0a80" dependencies = [ "base64 0.22.1", "brotli", "ico", "json-patch", "plist", - "png 0.17.16", + "png 0.18.1", "proc-macro2", "quote", "semver", @@ -6030,9 +6041,9 @@ dependencies = [ [[package]] name = "tauri-macros" -version = "2.6.1" +version = "2.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fed9d3742a37a355d2e47c9af924e9fbc112abb76f9835d35d4780e318419502" +checksum = "8129fb43bb6e0d6b73ad3315cd172beaab17cd28899c594b1b32c80edbbfd99c" dependencies = [ "heck 0.5.0", "proc-macro2", @@ -6168,11 +6179,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af" dependencies = [ "base64 0.22.1", - "dirs", + "dirs 6.0.0", "flate2", "futures-util", "http 1.4.0", - "infer", + "infer 0.19.0", "log", "minisign-verify", "osakit", @@ -6196,9 +6207,9 @@ dependencies = [ [[package]] name = "tauri-runtime" -version = "2.11.1" +version = "2.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fef478ba1d2ac21c2d528740b24d0cb315e1e8b1111aae53fafac34804371fc" +checksum = "c2a57a2a9b8c8b7fc00d35b510fe808ded7f9f1b44fc1cdda6aee38632ea5413" dependencies = [ "cookie", "dpi", @@ -6215,15 +6226,15 @@ dependencies = [ "thiserror 2.0.18", "url", "webkit2gtk", - "webview2-com", - "windows 0.61.3", + "webview2-com 0.39.1", + "windows 0.62.2", ] [[package]] name = "tauri-runtime-wry" -version = "2.11.1" +version = "2.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a3989df2ae1c476404fe0a2e8ffc4cfbde97e51efd613c2bb5355fbc9ab52cf0" +checksum = "7f9e7e0c9f80a5130773cfabb6df4dc924518fb1b2c923726966804634b57d22" dependencies = [ "gtk", "http 1.4.0", @@ -6240,16 +6251,16 @@ dependencies = [ "tauri-utils", "url", "webkit2gtk", - "webview2-com", - "windows 0.61.3", + "webview2-com 0.39.1", + "windows 0.62.2", "wry", ] [[package]] name = "tauri-utils" -version = "2.9.1" +version = "2.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d57200389a2f82b4b0a40ae29ca19b6978116e8f4d4e974c3234ce40c0ffbdec" +checksum = "2ff55a614843b9a3f010f211df637c94df2607175b8d0f6e0f4a7c19e18621ee" dependencies = [ "anyhow", "brotli", @@ -6259,7 +6270,7 @@ dependencies = [ "dunce", "glob", "http 1.4.0", - "infer", + "infer 0.22.0", "json-patch", "log", "memchr", @@ -6476,21 +6487,6 @@ dependencies = [ "toml_edit 0.22.27", ] -[[package]] -name = "toml" -version = "0.9.12+spec-1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863" -dependencies = [ - "indexmap 2.14.0", - "serde_core", - "serde_spanned 1.1.1", - "toml_datetime 0.7.5+spec-1.1.0", - "toml_parser", - "toml_writer", - "winnow 0.7.15", -] - [[package]] name = "toml" version = "1.1.2+spec-1.1.0" @@ -6515,15 +6511,6 @@ dependencies = [ "serde", ] -[[package]] -name = "toml_datetime" -version = "0.7.5+spec-1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347" -dependencies = [ - "serde_core", -] - [[package]] name = "toml_datetime" version = "1.1.1+spec-1.1.0" @@ -6680,12 +6667,12 @@ dependencies = [ [[package]] name = "tray-icon" -version = "0.23.1" +version = "0.24.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "15edbb0d80583e85ee8df283410038e17314df5cba30da2087a54a85216c0773" +checksum = "045979e3f037cd18ad1cb2a419dfda133c5c29c9f3453370079f2255d46c257e" dependencies = [ "crossbeam-channel", - "dirs", + "dirs 6.0.0", "libappindicator", "muda", "objc2", @@ -6738,47 +6725,6 @@ dependencies = [ "arrayvec", ] -[[package]] -name = "unic-char-property" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221" -dependencies = [ - "unic-char-range", -] - -[[package]] -name = "unic-char-range" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc" - -[[package]] -name = "unic-common" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc" - -[[package]] -name = "unic-ucd-ident" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987" -dependencies = [ - "unic-char-property", - "unic-char-range", - "unic-ucd-version", -] - -[[package]] -name = "unic-ucd-version" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4" -dependencies = [ - "unic-common", -] - [[package]] name = "unicase" version = "2.9.0" @@ -6845,13 +6791,13 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" [[package]] name = "urlpattern" -version = "0.3.0" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d" +checksum = "df16f50ef4cc145211879a3867ba757076b25dfee812040dcb0658bd9ae7904b" dependencies = [ + "icu_properties", "regex", "serde", - "unic-ucd-ident", "url", ] @@ -7220,13 +7166,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7130243a7a5b33c54a444e54842e6a9e133de08b5ad7b5861cd8ed9a6a5bc96a" dependencies = [ "webview2-com-macros", - "webview2-com-sys", + "webview2-com-sys 0.38.2", "windows 0.61.3", "windows-core 0.61.2", "windows-implement 0.60.2", "windows-interface 0.59.3", ] +[[package]] +name = "webview2-com" +version = "0.39.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6" +dependencies = [ + "webview2-com-macros", + "webview2-com-sys 0.39.1", + "windows 0.62.2", + "windows-core 0.62.2", +] + [[package]] name = "webview2-com-macros" version = "0.8.1" @@ -7249,6 +7207,17 @@ dependencies = [ "windows-core 0.61.2", ] +[[package]] +name = "webview2-com-sys" +version = "0.39.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b3a07132775117d6065853d9d1178157b8c90e228de47129d6bce2c7edebedfb" +dependencies = [ + "thiserror 2.0.18", + "windows 0.62.2", + "windows-core 0.62.2", +] + [[package]] name = "winapi" version = "0.3.9" @@ -7311,11 +7280,23 @@ version = "0.61.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893" dependencies = [ - "windows-collections", + "windows-collections 0.2.0", "windows-core 0.61.2", - "windows-future", + "windows-future 0.2.1", "windows-link 0.1.3", - "windows-numerics", + "windows-numerics 0.2.0", +] + +[[package]] +name = "windows" +version = "0.62.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580" +dependencies = [ + "windows-collections 0.3.2", + "windows-core 0.62.2", + "windows-future 0.3.2", + "windows-numerics 0.3.1", ] [[package]] @@ -7327,6 +7308,15 @@ dependencies = [ "windows-core 0.61.2", ] +[[package]] +name = "windows-collections" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610" +dependencies = [ + "windows-core 0.62.2", +] + [[package]] name = "windows-core" version = "0.58.0" @@ -7353,6 +7343,19 @@ dependencies = [ "windows-strings 0.4.2", ] +[[package]] +name = "windows-core" +version = "0.62.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" +dependencies = [ + "windows-implement 0.60.2", + "windows-interface 0.59.3", + "windows-link 0.2.1", + "windows-result 0.4.1", + "windows-strings 0.5.1", +] + [[package]] name = "windows-future" version = "0.2.1" @@ -7361,7 +7364,18 @@ checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e" dependencies = [ "windows-core 0.61.2", "windows-link 0.1.3", - "windows-threading", + "windows-threading 0.1.0", +] + +[[package]] +name = "windows-future" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb" +dependencies = [ + "windows-core 0.62.2", + "windows-link 0.2.1", + "windows-threading 0.2.1", ] [[package]] @@ -7443,6 +7457,16 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-numerics" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26" +dependencies = [ + "windows-core 0.62.2", + "windows-link 0.2.1", +] + [[package]] name = "windows-result" version = "0.2.0" @@ -7461,6 +7485,15 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-result" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" +dependencies = [ + "windows-link 0.2.1", +] + [[package]] name = "windows-strings" version = "0.1.0" @@ -7480,6 +7513,15 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-strings" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" +dependencies = [ + "windows-link 0.2.1", +] + [[package]] name = "windows-sys" version = "0.45.0" @@ -7582,6 +7624,15 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-threading" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37" +dependencies = [ + "windows-link 0.2.1", +] + [[package]] name = "windows-version" version = "0.1.7" @@ -7868,15 +7919,15 @@ checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" [[package]] name = "wry" -version = "0.55.1" +version = "0.57.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "186f9871daa55fd9c016578b810d149de58367113db7fb72b462d2323ce19514" +checksum = "a819957a01b3119af85e638a38d242af76dbc87d130dca67bfd0441072e21ff0" dependencies = [ "base64 0.22.1", "block2", "cookie", "crossbeam-channel", - "dirs", + "dirs 7.0.0", "dom_query", "dpi", "dunce", @@ -7903,9 +7954,9 @@ dependencies = [ "url", "webkit2gtk", "webkit2gtk-sys", - "webview2-com", - "windows 0.61.3", - "windows-core 0.61.2", + "webview2-com 0.39.1", + "windows 0.62.2", + "windows-core 0.62.2", "windows-version", "x11-dl", ] From e4cd6ebe095f241bf7542f2994133b96825487dd Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 16:26:04 +0000 Subject: [PATCH 07/11] fix(security): update dependencies --- src-tauri/Cargo.lock | 192 +++++++++++++++++++++++++++++-------------- 1 file changed, 129 insertions(+), 63 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 1fe21e5..71eb371 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -385,7 +385,7 @@ dependencies = [ "hex", "hmac 0.13.0", "http 0.2.12", - "http 1.4.0", + "http 1.4.1", "percent-encoding", "sha2 0.11.0", "time", @@ -415,7 +415,7 @@ dependencies = [ "bytes-utils", "futures-core", "futures-util", - "http 1.4.0", + "http 1.4.1", "http-body 1.0.1", "http-body-util", "percent-encoding", @@ -435,7 +435,7 @@ dependencies = [ "aws-smithy-types", "bytes", "http 0.2.12", - "http 1.4.0", + "http 1.4.1", "pin-project-lite", "tokio", "tracing", @@ -463,7 +463,7 @@ dependencies = [ "bytes", "bytes-utils", "http 0.2.12", - "http 1.4.0", + "http 1.4.1", "http-body 0.4.6", "http-body 1.0.1", "http-body-util", @@ -488,6 +488,12 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "base64" +version = "0.23.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" + [[package]] name = "base64-simd" version = "0.8.0" @@ -935,6 +941,16 @@ dependencies = [ "version_check", ] +[[package]] +name = "core-foundation" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "core-foundation" version = "0.10.1" @@ -958,7 +974,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97" dependencies = [ "bitflags 2.11.1", - "core-foundation", + "core-foundation 0.10.1", "core-graphics-types", "foreign-types", "libc", @@ -971,7 +987,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb" dependencies = [ "bitflags 2.11.1", - "core-foundation", + "core-foundation 0.10.1", "libc", ] @@ -1226,7 +1242,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -1442,7 +1458,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -2486,9 +2502,9 @@ dependencies = [ [[package]] name = "gix-packetline" -version = "0.21.3" +version = "0.21.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "362246df440ee691699f0664cbf7006a6ece477db6734222be95e4198e5656e6" +checksum = "b217dd0ee0c4021ecf169a4a519b1b4f80d15e3f3765f3dc466223dc0ac891d7" dependencies = [ "bstr", "faster-hex", @@ -2724,9 +2740,9 @@ dependencies = [ [[package]] name = "gix-trace" -version = "0.1.19" +version = "0.1.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f23569e55f2ffaf958617353b9734a7d52a7c19c439eeaa5e3efc217fd2270e" +checksum = "be3eb81d9dc914335923e50d52829c551feefd6a72d176c4130c546b67a60814" [[package]] name = "gix-transport" @@ -2977,7 +2993,7 @@ dependencies = [ "fnv", "futures-core", "futures-sink", - "http 1.4.0", + "http 1.4.1", "indexmap 2.14.0", "slab", "tokio", @@ -3116,9 +3132,9 @@ dependencies = [ [[package]] name = "http" -version = "1.4.0" +version = "1.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a" +checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0" dependencies = [ "bytes", "itoa", @@ -3142,7 +3158,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184" dependencies = [ "bytes", - "http 1.4.0", + "http 1.4.1", ] [[package]] @@ -3153,7 +3169,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a" dependencies = [ "bytes", "futures-core", - "http 1.4.0", + "http 1.4.1", "http-body 1.0.1", "pin-project-lite", ] @@ -3190,7 +3206,7 @@ dependencies = [ "futures-channel", "futures-core", "h2", - "http 1.4.0", + "http 1.4.1", "http-body 1.0.1", "httparse", "itoa", @@ -3206,7 +3222,7 @@ version = "0.27.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f" dependencies = [ - "http 1.4.0", + "http 1.4.1", "hyper", "hyper-util", "rustls", @@ -3225,7 +3241,7 @@ dependencies = [ "bytes", "futures-channel", "futures-util", - "http 1.4.0", + "http 1.4.1", "http-body 1.0.1", "hyper", "ipnet", @@ -3233,9 +3249,11 @@ dependencies = [ "percent-encoding", "pin-project-lite", "socket2", + "system-configuration", "tokio", "tower-service", "tracing", + "windows-registry", ] [[package]] @@ -3250,7 +3268,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.58.0", + "windows-core 0.61.2", ] [[package]] @@ -3531,7 +3549,7 @@ dependencies = [ "portable-atomic", "portable-atomic-util", "serde_core", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4412,7 +4430,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.45.0", ] [[package]] @@ -4495,7 +4513,7 @@ version = "0.3.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0bc6202d1ceb565869d3d339c184a7db3682806ba15ba19b0b024a9dc5268ae1" dependencies = [ - "core-foundation", + "core-foundation 0.10.1", "libc", "windows 0.58.0", ] @@ -4596,13 +4614,13 @@ checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6" [[package]] name = "plist" -version = "1.9.0" +version = "1.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "092791278e026273c1b65bbdcfbba3a300f2994c896bd01ab01da613c29c46f1" +checksum = "2896bade328c13f7042a297ea5ac5b0951f6cf989dea5f32c2fd98da398195cb" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "indexmap 2.14.0", - "quick-xml", + "quick-xml 0.42.0", "serde", "time", ] @@ -4789,6 +4807,15 @@ dependencies = [ "memchr", ] +[[package]] +name = "quick-xml" +version = "0.42.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b" +dependencies = [ + "memchr", +] + [[package]] name = "quinn" version = "0.11.9" @@ -4811,9 +4838,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "aws-lc-rs", "bytes", @@ -4843,7 +4870,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.60.2", + "windows-sys 0.59.0", ] [[package]] @@ -5019,7 +5046,7 @@ dependencies = [ "futures-core", "futures-util", "h2", - "http 1.4.0", + "http 1.4.1", "http-body 1.0.1", "http-body-util", "hyper", @@ -5114,7 +5141,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5160,7 +5187,7 @@ version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0" dependencies = [ - "core-foundation", + "core-foundation 0.10.1", "core-foundation-sys", "jni 0.22.4", "log", @@ -5172,7 +5199,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5312,7 +5339,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" dependencies = [ "bitflags 2.11.1", - "core-foundation", + "core-foundation 0.10.1", "core-foundation-sys", "libc", "security-framework-sys", @@ -5812,17 +5839,6 @@ dependencies = [ "unicode-ident", ] -[[package]] -name = "syn" -version = "3.0.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" -dependencies = [ - "proc-macro2", - "quote", - "unicode-ident", -] - [[package]] name = "sync_wrapper" version = "1.0.2" @@ -5852,6 +5868,27 @@ dependencies = [ "libc", ] +[[package]] +name = "system-configuration" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b" +dependencies = [ + "bitflags 2.11.1", + "core-foundation 0.9.4", + "system-configuration-sys", +] + +[[package]] +name = "system-configuration-sys" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "system-deps" version = "6.2.2" @@ -5873,7 +5910,7 @@ checksum = "a33f7f9e486ade65fcf1e45c440f9236c904f5c1002cdc7fc6ae582777345ce4" dependencies = [ "bitflags 2.11.1", "block2", - "core-foundation", + "core-foundation 0.10.1", "core-graphics", "crossbeam-channel", "dbus", @@ -5949,7 +5986,7 @@ dependencies = [ "glob", "gtk", "heck 0.5.0", - "http 1.4.0", + "http 1.4.1", "jni 0.21.1", "libc", "log", @@ -6167,15 +6204,15 @@ dependencies = [ [[package]] name = "tauri-plugin-updater" -version = "2.10.1" +version = "2.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af" +checksum = "7a5cad8ed5948d988e1018ecd31e27cacedbf72ce3fb972940c3e4bf51639e4b" dependencies = [ "base64 0.22.1", "dirs", "flate2", "futures-util", - "http 1.4.0", + "http 1.4.1", "infer", "log", "minisign-verify", @@ -6207,7 +6244,7 @@ dependencies = [ "cookie", "dpi", "gtk", - "http 1.4.0", + "http 1.4.1", "jni 0.21.1", "objc2", "objc2-ui-kit", @@ -6230,7 +6267,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a3989df2ae1c476404fe0a2e8ffc4cfbde97e51efd613c2bb5355fbc9ab52cf0" dependencies = [ "gtk", - "http 1.4.0", + "http 1.4.1", "jni 0.21.1", "log", "objc2", @@ -6262,7 +6299,7 @@ dependencies = [ "dom_query", "dunce", "glob", - "http 1.4.0", + "http 1.4.1", "infer", "json-patch", "log", @@ -6308,7 +6345,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -6630,7 +6667,7 @@ dependencies = [ "bitflags 2.11.1", "bytes", "futures-util", - "http 1.4.0", + "http 1.4.1", "http-body 1.0.1", "pin-project-lite", "tower", @@ -7117,7 +7154,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9c324a910fd86ebdc364a3e61ec1f11737d3b1d6c273c0239ee8ff4bc0d24b4a" dependencies = [ "proc-macro2", - "quick-xml", + "quick-xml 0.39.3", "quote", ] @@ -7275,7 +7312,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -7447,6 +7484,17 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-registry" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720" +dependencies = [ + "windows-link 0.2.1", + "windows-result 0.4.1", + "windows-strings 0.5.1", +] + [[package]] name = "windows-result" version = "0.2.0" @@ -7465,6 +7513,15 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-result" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" +dependencies = [ + "windows-link 0.2.1", +] + [[package]] name = "windows-strings" version = "0.1.0" @@ -7484,6 +7541,15 @@ dependencies = [ "windows-link 0.1.3", ] +[[package]] +name = "windows-strings" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" +dependencies = [ + "windows-link 0.2.1", +] + [[package]] name = "windows-sys" version = "0.45.0" @@ -7886,7 +7952,7 @@ dependencies = [ "dunce", "gdkx11", "gtk", - "http 1.4.0", + "http 1.4.1", "javascriptcore-rs", "jni 0.21.1", "libc", @@ -8112,13 +8178,13 @@ dependencies = [ [[package]] name = "zerovec-derive" -version = "0.11.5" +version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9" +checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 2.0.117", ] [[package]] From d35d3bdc747f771eadb03b5eeb5055aed4e609b0 Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 16:29:53 +0000 Subject: [PATCH 08/11] fix(security): update zerovec from 0.11.6 to 0.11.8 --- src-tauri/Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 1fe21e5..7d4edc2 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -7947,9 +7947,9 @@ dependencies = [ [[package]] name = "yoke" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca" +checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5" dependencies = [ "stable_deref_trait", "yoke-derive", @@ -8101,9 +8101,9 @@ dependencies = [ [[package]] name = "zerovec" -version = "0.11.6" +version = "0.11.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239" +checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8" dependencies = [ "yoke", "zerofrom", From 40ff685355079f051fd077e5e7f3f06cd00a8937 Mon Sep 17 00:00:00 2001 From: cst8t <1810150+cst8t@users.noreply.github.com> Date: Sun, 4 Oct 2026 17:46:18 +0100 Subject: [PATCH 09/11] fix(deps): align Tauri internals with the patched 2.11 release Keep Tauri 2.11.6 for the IPC channel security fix and use compatible runtime, macro and build crates. Restrict direct Tauri requirements to their current minor series to avoid pulling incompatible platform APIs into this update. --- src-tauri/Cargo.lock | 354 ++++++++++++++++++++----------------------- src-tauri/Cargo.toml | 6 +- 2 files changed, 170 insertions(+), 190 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 9f72e0e..947ecb9 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -30,15 +30,15 @@ dependencies = [ [[package]] name = "alloc-no-stdlib" -version = "3.0.0" +version = "2.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2fb6cfd47bf496ff64095c20eaba0c201404ee38714d4142fcfa1dc334fcc7a" +checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3" [[package]] name = "alloc-stdlib" -version = "0.3.0" +version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b5c1865780388bfa186411ab5f247819487fc4864c6e9c3106611fa347586e1" +checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195" dependencies = [ "alloc-no-stdlib", ] @@ -579,9 +579,9 @@ dependencies = [ [[package]] name = "brotli" -version = "9.0.0" +version = "8.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8b851b75c23ca7873623d612fe49bd1989aeb03d08fb9432187eb253d3d4c6b" +checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3" dependencies = [ "alloc-no-stdlib", "alloc-stdlib", @@ -590,9 +590,9 @@ dependencies = [ [[package]] name = "brotli-decompressor" -version = "6.0.1" +version = "5.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "941cd9bd4ddab83cb46fa5a2d428f1c857b24ac78cb876cf7beb710840934bd7" +checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583" dependencies = [ "alloc-no-stdlib", "alloc-stdlib", @@ -720,13 +720,12 @@ dependencies = [ [[package]] name = "cargo_toml" -version = "1.0.1" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "82f4b26e751e711a5302649417f2da046dce6391b2ea30a4820f37462314f0b9" +checksum = "374b7c592d9c00c1f4972ea58390ac6b18cbb6ab79011f3bdc90a0b82ca06b77" dependencies = [ - "semver", "serde", - "toml 1.1.2+spec-1.1.0", + "toml 0.9.12+spec-1.1.0", ] [[package]] @@ -767,17 +766,6 @@ dependencies = [ "uuid", ] -[[package]] -name = "cfb" -version = "0.14.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a347dcabdae9c31b0825fd6a8bed285ec9c2acb89c47827126d52fa4f59cece3" -dependencies = [ - "fnv", - "uuid", - "web-time", -] - [[package]] name = "cfg-expr" version = "0.15.8" @@ -1050,9 +1038,9 @@ dependencies = [ [[package]] name = "cssparser" -version = "0.37.0" +version = "0.36.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98" +checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2" dependencies = [ "cssparser-macros", "dtoa-short", @@ -1063,9 +1051,9 @@ dependencies = [ [[package]] name = "cssparser-macros" -version = "0.7.1" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a" +checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331" dependencies = [ "quote", "syn 2.0.117", @@ -1073,9 +1061,19 @@ dependencies = [ [[package]] name = "ctor" -version = "1.0.13" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "352d39c2f7bef1d6ad73db6f5160efcaed66d94ef8c6c573a8410c00bf909a98" +dependencies = [ + "ctor-proc-macro", + "dtor", +] + +[[package]] +name = "ctor-proc-macro" +version = "0.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d" +checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1" [[package]] name = "ctutils" @@ -1219,15 +1217,6 @@ dependencies = [ "dirs-sys", ] -[[package]] -name = "dirs" -version = "7.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f" -dependencies = [ - "dirs-sys", -] - [[package]] name = "dirs-sys" version = "0.5.0" @@ -1297,9 +1286,9 @@ dependencies = [ [[package]] name = "dom_query" -version = "0.28.0" +version = "0.27.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fac5fca71e65e94cc718a6e2af65d6e0f9c6027751c2aa562fbb5087fda639bc" +checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89" dependencies = [ "bit-set", "cssparser", @@ -1340,6 +1329,21 @@ dependencies = [ "dtoa", ] +[[package]] +name = "dtor" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1057d6c64987086ff8ed0fd3fbf377a6b7d205cc7715868cd401705f715cbe4" +dependencies = [ + "dtor-proc-macro", +] + +[[package]] +name = "dtor-proc-macro" +version = "0.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5" + [[package]] name = "dunce" version = "1.0.5" @@ -1882,7 +1886,7 @@ dependencies = [ "getrandom 0.3.4", "gix", "gtk", - "infer 0.19.0", + "infer", "keyring", "linux-terminal-launch", "md5", @@ -1909,7 +1913,7 @@ dependencies = [ "url", "webkit2gtk", "windows 0.61.3", - "windows-future 0.2.1", + "windows-future", ] [[package]] @@ -3091,9 +3095,9 @@ dependencies = [ [[package]] name = "html5ever" -version = "0.39.0" +version = "0.38.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8" +checksum = "1054432bae2f14e0061e33d23402fbaa67a921d319d56adc6bcf887ddad1cbc2" dependencies = [ "log", "markup5ever", @@ -3246,7 +3250,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.61.2", + "windows-core 0.62.2", ] [[package]] @@ -3412,16 +3416,7 @@ version = "0.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7" dependencies = [ - "cfb 0.7.3", -] - -[[package]] -name = "infer" -version = "0.22.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f4200d433cbd5178df7797c9c2e75b348b728e39631cf14520d1e2fc424201f4" -dependencies = [ - "cfb 0.14.0", + "cfb", ] [[package]] @@ -3663,21 +3658,21 @@ dependencies = [ [[package]] name = "json-patch" -version = "4.2.0" +version = "3.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7421438de105a0827e44fadd05377727847d717c80ce29a229f85fd04c427b72" +checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08" dependencies = [ "jsonptr", "serde", "serde_json", - "thiserror 2.0.18", + "thiserror 1.0.69", ] [[package]] name = "jsonptr" -version = "0.7.1" +version = "0.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a5a3cc660ba5d72bce0b3bb295bf20847ccbb40fd423f3f05b61273672e561fe" +checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70" dependencies = [ "serde", "serde_json", @@ -3851,9 +3846,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" [[package]] name = "markup5ever" -version = "0.39.0" +version = "0.38.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de" +checksum = "8983d30f2915feeaaab2d6babdd6bc7e9ed1a00b66b5e6d74df19aa9c0e91862" dependencies = [ "log", "tendril", @@ -3981,12 +3976,6 @@ dependencies = [ "thiserror 1.0.69", ] -[[package]] -name = "ndk-context" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b" - [[package]] name = "ndk-sys" version = "0.6.0+11769913" @@ -5348,9 +5337,9 @@ dependencies = [ [[package]] name = "selectors" -version = "0.38.0" +version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d" +checksum = "c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c" dependencies = [ "bitflags 2.11.1", "cssparser", @@ -5874,9 +5863,9 @@ dependencies = [ [[package]] name = "tao" -version = "0.37.1" +version = "0.35.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f37f381f4e048e6cdf038b5705f8cf14ad108279d46eb968140a7b291aba9400" +checksum = "d1c93047acf68669466a34690ac58cca7010bd1b201e1ec86f1fd0a75d3dd4a9" dependencies = [ "bitflags 2.11.1", "block2", @@ -5894,20 +5883,20 @@ dependencies = [ "libc", "log", "ndk", - "ndk-context", "ndk-sys", "objc2", "objc2-app-kit", "objc2-foundation", "objc2-ui-kit", + "once_cell", "parking_lot", "percent-encoding", "raw-window-handle", "tao-macros", "unicode-segmentation", "url", - "windows 0.62.2", - "windows-core 0.62.2", + "windows 0.61.3", + "windows-core 0.61.2", "windows-version", "x11-dl", ] @@ -5949,7 +5938,7 @@ dependencies = [ "anyhow", "bytes", "cookie", - "dirs 6.0.0", + "dirs", "dunce", "embed_plist", "getrandom 0.3.4", @@ -5986,20 +5975,20 @@ dependencies = [ "tray-icon", "url", "webkit2gtk", - "webview2-com 0.38.2", + "webview2-com", "window-vibrancy", "windows 0.61.3", ] [[package]] name = "tauri-build" -version = "2.7.1" +version = "2.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59563ca5b331fd97f27ee9672ec8d36d33bb3c9e2c9f6710a1a5687256052e45" +checksum = "bc9ce40b16101cb6ea63d3e221567affd1c3a9205f95d7bc574941a10636b632" dependencies = [ "anyhow", "cargo_toml", - "dirs 7.0.0", + "dirs", "glob", "heck 0.5.0", "json-patch", @@ -6014,16 +6003,16 @@ dependencies = [ [[package]] name = "tauri-codegen" -version = "2.7.1" +version = "2.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e50213e463086ecc283d7e9f51c30cc0fd304ad457425158018be26dbf0d0a80" +checksum = "08279169ff42f8fc45a1dbc9dcae888893ba95288142e5880c59b93a26d2cfc5" dependencies = [ "base64 0.22.1", "brotli", "ico", "json-patch", "plist", - "png 0.18.1", + "png 0.17.16", "proc-macro2", "quote", "semver", @@ -6041,9 +6030,9 @@ dependencies = [ [[package]] name = "tauri-macros" -version = "2.7.1" +version = "2.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8129fb43bb6e0d6b73ad3315cd172beaab17cd28899c594b1b32c80edbbfd99c" +checksum = "e8b394794f399a421811d06966343e7933fcae92d59f5180b9388d1174497a45" dependencies = [ "heck 0.5.0", "proc-macro2", @@ -6179,11 +6168,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af" dependencies = [ "base64 0.22.1", - "dirs 6.0.0", + "dirs", "flate2", "futures-util", "http 1.4.0", - "infer 0.19.0", + "infer", "log", "minisign-verify", "osakit", @@ -6207,9 +6196,9 @@ dependencies = [ [[package]] name = "tauri-runtime" -version = "2.12.1" +version = "2.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2a57a2a9b8c8b7fc00d35b510fe808ded7f9f1b44fc1cdda6aee38632ea5413" +checksum = "b0b4bc95aed361b0019067d189a1174a603d460d0f6c72606512d59fc9c12ec8" dependencies = [ "cookie", "dpi", @@ -6226,15 +6215,15 @@ dependencies = [ "thiserror 2.0.18", "url", "webkit2gtk", - "webview2-com 0.39.1", - "windows 0.62.2", + "webview2-com", + "windows 0.61.3", ] [[package]] name = "tauri-runtime-wry" -version = "2.12.1" +version = "2.11.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f9e7e0c9f80a5130773cfabb6df4dc924518fb1b2c923726966804634b57d22" +checksum = "4e6fac707727b7a2f48e4ded90976324267371073edbb415ffb73bb0458d203f" dependencies = [ "gtk", "http 1.4.0", @@ -6251,16 +6240,16 @@ dependencies = [ "tauri-utils", "url", "webkit2gtk", - "webview2-com 0.39.1", - "windows 0.62.2", + "webview2-com", + "windows 0.61.3", "wry", ] [[package]] name = "tauri-utils" -version = "2.10.1" +version = "2.9.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2ff55a614843b9a3f010f211df637c94df2607175b8d0f6e0f4a7c19e18621ee" +checksum = "3e176a18e67764923c4f1ce66f25ae4abe5f688384d5eb1a0fa6c77f3d90f887" dependencies = [ "anyhow", "brotli", @@ -6270,7 +6259,7 @@ dependencies = [ "dunce", "glob", "http 1.4.0", - "infer 0.22.0", + "infer", "json-patch", "log", "memchr", @@ -6487,6 +6476,21 @@ dependencies = [ "toml_edit 0.22.27", ] +[[package]] +name = "toml" +version = "0.9.12+spec-1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863" +dependencies = [ + "indexmap 2.14.0", + "serde_core", + "serde_spanned 1.1.1", + "toml_datetime 0.7.5+spec-1.1.0", + "toml_parser", + "toml_writer", + "winnow 0.7.15", +] + [[package]] name = "toml" version = "1.1.2+spec-1.1.0" @@ -6511,6 +6515,15 @@ dependencies = [ "serde", ] +[[package]] +name = "toml_datetime" +version = "0.7.5+spec-1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347" +dependencies = [ + "serde_core", +] + [[package]] name = "toml_datetime" version = "1.1.1+spec-1.1.0" @@ -6672,7 +6685,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "045979e3f037cd18ad1cb2a419dfda133c5c29c9f3453370079f2255d46c257e" dependencies = [ "crossbeam-channel", - "dirs 6.0.0", + "dirs", "libappindicator", "muda", "objc2", @@ -6725,6 +6738,47 @@ dependencies = [ "arrayvec", ] +[[package]] +name = "unic-char-property" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221" +dependencies = [ + "unic-char-range", +] + +[[package]] +name = "unic-char-range" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc" + +[[package]] +name = "unic-common" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc" + +[[package]] +name = "unic-ucd-ident" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987" +dependencies = [ + "unic-char-property", + "unic-char-range", + "unic-ucd-version", +] + +[[package]] +name = "unic-ucd-version" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4" +dependencies = [ + "unic-common", +] + [[package]] name = "unicase" version = "2.9.0" @@ -6791,13 +6845,13 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" [[package]] name = "urlpattern" -version = "0.6.0" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df16f50ef4cc145211879a3867ba757076b25dfee812040dcb0658bd9ae7904b" +checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d" dependencies = [ - "icu_properties", "regex", "serde", + "unic-ucd-ident", "url", ] @@ -7166,25 +7220,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7130243a7a5b33c54a444e54842e6a9e133de08b5ad7b5861cd8ed9a6a5bc96a" dependencies = [ "webview2-com-macros", - "webview2-com-sys 0.38.2", + "webview2-com-sys", "windows 0.61.3", "windows-core 0.61.2", "windows-implement 0.60.2", "windows-interface 0.59.3", ] -[[package]] -name = "webview2-com" -version = "0.39.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6" -dependencies = [ - "webview2-com-macros", - "webview2-com-sys 0.39.1", - "windows 0.62.2", - "windows-core 0.62.2", -] - [[package]] name = "webview2-com-macros" version = "0.8.1" @@ -7207,17 +7249,6 @@ dependencies = [ "windows-core 0.61.2", ] -[[package]] -name = "webview2-com-sys" -version = "0.39.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b3a07132775117d6065853d9d1178157b8c90e228de47129d6bce2c7edebedfb" -dependencies = [ - "thiserror 2.0.18", - "windows 0.62.2", - "windows-core 0.62.2", -] - [[package]] name = "winapi" version = "0.3.9" @@ -7280,23 +7311,11 @@ version = "0.61.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893" dependencies = [ - "windows-collections 0.2.0", + "windows-collections", "windows-core 0.61.2", - "windows-future 0.2.1", + "windows-future", "windows-link 0.1.3", - "windows-numerics 0.2.0", -] - -[[package]] -name = "windows" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580" -dependencies = [ - "windows-collections 0.3.2", - "windows-core 0.62.2", - "windows-future 0.3.2", - "windows-numerics 0.3.1", + "windows-numerics", ] [[package]] @@ -7308,15 +7327,6 @@ dependencies = [ "windows-core 0.61.2", ] -[[package]] -name = "windows-collections" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610" -dependencies = [ - "windows-core 0.62.2", -] - [[package]] name = "windows-core" version = "0.58.0" @@ -7364,18 +7374,7 @@ checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e" dependencies = [ "windows-core 0.61.2", "windows-link 0.1.3", - "windows-threading 0.1.0", -] - -[[package]] -name = "windows-future" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb" -dependencies = [ - "windows-core 0.62.2", - "windows-link 0.2.1", - "windows-threading 0.2.1", + "windows-threading", ] [[package]] @@ -7457,16 +7456,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "windows-numerics" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26" -dependencies = [ - "windows-core 0.62.2", - "windows-link 0.2.1", -] - [[package]] name = "windows-result" version = "0.2.0" @@ -7624,15 +7613,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "windows-threading" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37" -dependencies = [ - "windows-link 0.2.1", -] - [[package]] name = "windows-version" version = "0.1.7" @@ -7919,15 +7899,15 @@ checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" [[package]] name = "wry" -version = "0.57.0" +version = "0.55.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a819957a01b3119af85e638a38d242af76dbc87d130dca67bfd0441072e21ff0" +checksum = "186f9871daa55fd9c016578b810d149de58367113db7fb72b462d2323ce19514" dependencies = [ "base64 0.22.1", "block2", "cookie", "crossbeam-channel", - "dirs 7.0.0", + "dirs", "dom_query", "dpi", "dunce", @@ -7954,9 +7934,9 @@ dependencies = [ "url", "webkit2gtk", "webkit2gtk-sys", - "webview2-com 0.39.1", - "windows 0.62.2", - "windows-core 0.62.2", + "webview2-com", + "windows 0.61.3", + "windows-core 0.61.2", "windows-version", "x11-dl", ] diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 26e9406..8d560d8 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -12,13 +12,13 @@ name = "gitmun_lib" crate-type = ["staticlib", "cdylib", "rlib"] [build-dependencies] -tauri-build = { version = "2.6", features = [] } +tauri-build = { version = "~2.6.3", features = [] } [dependencies] gix = { version = "0.83.0", features = ["blocking-http-transport-reqwest-rust-tls"] } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" -tauri = { version = "2.11", features = [] } +tauri = { version = "~2.11.6", features = [] } tauri-plugin-dialog = { version = "2.7", default-features = false, features = ["xdg-portal"] } tauri-plugin-opener = "2.5" tauri-plugin-os = "2.3" @@ -38,7 +38,7 @@ clap_complete = "4.5" notify = "8" mime_guess = "2.0" infer = "0.19" -tauri-utils = "2.8.3" +tauri-utils = "~2.9.3" toml = "0.8" toml_edit = "0.22" tempfile = "3" From c3f4419f1c6c34ea4544dd310f3f269d0af4e28a Mon Sep 17 00:00:00 2001 From: cst8t <1810150+cst8t@users.noreply.github.com> Date: Sun, 4 Oct 2026 18:16:36 +0100 Subject: [PATCH 10/11] test(avatar): make accepted mock connections blocking Windows accepts connections with the listener non-blocking mode inherited. Explicitly switch the test connection to blocking mode so the existing read timeout waits for request data instead of intermittently failing with WouldBlock. --- src-tauri/src/avatar/gitlab.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/src-tauri/src/avatar/gitlab.rs b/src-tauri/src/avatar/gitlab.rs index 52a1e96..f683c00 100644 --- a/src-tauri/src/avatar/gitlab.rs +++ b/src-tauri/src/avatar/gitlab.rs @@ -408,6 +408,7 @@ mod tests { Err(error) => panic!("{error}"), } }; + stream.set_nonblocking(false).unwrap(); stream .set_read_timeout(Some(std::time::Duration::from_secs(5))) .unwrap(); From 0ddafda925ad45b35d8ac36957d5631306eb5b04 Mon Sep 17 00:00:00 2001 From: cst8t <1810150+cst8t@users.noreply.github.com> Date: Sun, 4 Oct 2026 18:34:39 +0100 Subject: [PATCH 11/11] chore(deps): bump @tauri-apps/plugin-updater to 2.12.0 --- package-lock.json | 10 +++++----- package.json | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index b6ec72a..2bede4f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -17,7 +17,7 @@ "@tauri-apps/plugin-opener": "^2.5.4", "@tauri-apps/plugin-os": "^2.3.2", "@tauri-apps/plugin-shell": "^2.3.5", - "@tauri-apps/plugin-updater": "^2.10.1", + "@tauri-apps/plugin-updater": "^2.12.0", "i18next": "^26.0.8", "react": "^19.2.4", "react-diff-view": "^3.3.2", @@ -1411,12 +1411,12 @@ } }, "node_modules/@tauri-apps/plugin-updater": { - "version": "2.10.1", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.10.1.tgz", - "integrity": "sha512-NFYMg+tWOZPJdzE/PpFj2qfqwAWwNS3kXrb1tm1gnBJ9mYzZ4WDRrwy8udzWoAnfGCHLuePNLY1WVCNHnh3eRA==", + "version": "2.12.0", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.12.0.tgz", + "integrity": "sha512-74+g7rSIHXQje3ttR6tYap3FJP/UtZqqYxGVF9EE0Kpz0YADxHX2Ynw/eIlNPMy9D1aG+F8oBosT+6nphSa8Og==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.10.1" + "@tauri-apps/api": "^2.11.0" } }, "node_modules/@testing-library/dom": { diff --git a/package.json b/package.json index 03fa665..dcb5650 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "@tauri-apps/plugin-opener": "^2.5.4", "@tauri-apps/plugin-shell": "^2.3.5", "@tauri-apps/plugin-os": "^2.3.2", - "@tauri-apps/plugin-updater": "^2.10.1", + "@tauri-apps/plugin-updater": "^2.12.0", "i18next": "^26.0.8", "react": "^19.2.4", "react-diff-view": "^3.3.2",