Repository navigation
Desktop lockfile, move rmcp to 3.9.0 - #146
Merged
Merged
Conversation
The desktop's mesh-llm build compiles rmcp 3.2.0, which RUSTSEC-2026-0457, 0461 and 0462 cover. The steward's default-feature check does not see it, but --all-features does. rmcp 3.9.0 fixes all three, and the id-level ignore of 0462 in deny.toml is only safe while every 3.x copy stays at 3.9.0 or later. Lockfile only: rmcp 3.9 needs process-wrap 10, which sits beside the 9.1.0 that rmcp 1.8.0 keeps. Claude-Account: russelledeming@gmail.com Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
QuicksilverSlick
added
the
lane:ready
QuicksilverSlick
changed the base branch from
fix/deny-rmcp-sqlite-advisories
to
main
November 9, 2026 19:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #145, the security hotfix
fix/deny-rmcp-sqlite-advisories, because cargo-deny fails on main without that PR'sdeny.toml. It stays out of the hotfix on purpose: this file is underdesktop/and needs a launch check, and the hotfix shouldn't wait for one. Once the hotfix merges, the kit retargets this PR to main and it can share the next train's launch check.One file,
desktop/src-tauri/Cargo.lock:rmcpandrmcp-macros3.2.0 to 3.9.0, andprocess-wrap10.0.1 added because rmcp 3.7 and later requires it.rmcp1.8.0 keepsprocess-wrap9.1.0. No other crate moved, and noCargo.tomlchanged.This clears RUSTSEC-2026-0457, 0461 and 0462 for the desktop's 3.x copy. That copy compiles only with the
mesh-llmfeature, which Dreamforge release builds don't enable, so this mainly keeps--all-featuresclean and removes a copy the hotfix's id-level 0462 ignore would otherwise hide.Checked:
--all-features: all pass on advisory database 899077d9.cargo metadata --lockedleaves the file byte-identical.cargo check --lockedfor the desktop passes with default features and with--features mesh-llm.Factory-Task: security/advisories-rustsec-2026-0459-0462
Built-by: claude-code/claude-opus-5-5
Claude-Account: russelledeming@gmail.com
Undo: revert this PR. The desktop's mesh-llm build goes back to rmcp 3.2.0 and
--all-featurescargo-deny fails again. Default builds aren't affected.🤖 Generated with Claude Code