Skip to content

chore(infra): dep-update sweep cleanup (Phase 10, partial) #569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Detair merged 1 commit into from
May 13, 2026
Merged

chore(infra): dep-update sweep cleanup (Phase 10, partial) #569

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions client/src-tauri/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,9 +71,11 @@ nnnoiseless = { version = "0.5", default-features = false }
# adapts the Linux backend to the new enum structure plus a Windows typo fix.
#
# Upstream tracking:
# - CapSoftware/scap#178 — broader fix, open since 2025-10-26, no updates
# - Last re-check 2026-04-12: upstream main HEAD still fails Linux build
# (see closed PR #520 for the test run)
# - CapSoftware/scap#178 — broader fix, still open (last upstream update
# 2025-10-26)
# - Last re-check 2026-05-13: upstream latest release is still v0.1.0-beta.1
# (2025-08-04). No new releases or merged Linux Frame enum fixes.
# - Previous re-check 2026-04-12: see closed PR #520 for the test run
# - Issue #521 tracks periodic re-checks — drop this git dep when upstream
# publishes a new release with the Linux fix
scap = { git = "https://github.com/Detair/scap.git", branch = "fix/linux-frame-enum" }
Expand Down
21 changes: 12 additions & 9 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,18 @@ unmaintained = "workspace"
ignore = [
# rsa crate Marvin Attack - no safe upgrade available, used by openidconnect
"RUSTSEC-2023-0071",
# rand 0.8.5 unsoundness with custom `log` logger - not exploitable in Kaiku
# because we use `tracing`/`tracing-subscriber`, not the `log` facade.
# The exploitable configuration requires a `log::Log` implementation that
# calls `rand::thread_rng()` during logging, which does not exist in this
# codebase. Transitive deps (fred, jsonwebtoken, openidconnect, webrtc,
# sqlx-postgres, vodozemac, etc.) pin rand 0.8, so the crate will stay in
# the tree until upstreams migrate to 0.9. Bumping our direct deps to 0.9
# would not remove the transitive 0.8.5 and would require breaking API
# changes (thread_rng → rng, gen_range → random_range).
# rand unsoundness with custom `log` logger — flagged against rand 0.7.3,
# 0.8.5, 0.9.2, AND 0.10.0 (all versions; the underlying API contract
# hasn't changed). Not exploitable in Kaiku because we use `tracing` /
# `tracing-subscriber`, not the `log` facade. The exploitable
# configuration requires a `log::Log` implementation that calls
# `rand::thread_rng()` (or its v0.9+ equivalent `rand::rng()`) during
# logging, which does not exist in this codebase. Transitive deps (fred,
# jsonwebtoken, openidconnect, webrtc, sqlx-postgres, vodozemac, etc.)
# pin various rand majors across the tree; bumping our direct rand
# version wouldn't drop the transitive copies. The ignore stays
# version-agnostic because the rationale (no log facade in our code) is
# invariant across rand majors.
"RUSTSEC-2026-0097",
]

Expand Down
Loading