From 77d3dce93808b63703e50ab730d9eac2df61ae2e Mon Sep 17 00:00:00 2001 From: QuicksilverSlick Date: Thu, 17 Sep 2026 07:36:51 -0500 Subject: [PATCH 1/2] ci(security): run cargo-deny on the desktop Tauri workspace desktop/src-tauri is excluded from the root workspace and has its own Cargo.lock, so the Security job never checked it. Vulnerable h2 and rtrb, a yanked chacha20 and the rustls advisory sat there unnoticed. - Add a second cargo-deny step with --manifest-path desktop/src-tauri (runs even if the root step fails, so both reports show). - Start the Security domain and gate on desktop-rust changes too, or a desktop-only lockfile change never runs it. - Ignore the 8 desktop unmaintained advisories that have no safe upgrade (audiopus_sys, mach, proc-macro-error, unic-*), with reasons. Co-Authored-By: Claude Opus 5 --- .github/workflows/_ci-security.yml | 5 +++++ .github/workflows/ci.yml | 6 +++--- deny.toml | 13 +++++++++++++ 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/_ci-security.yml b/.github/workflows/_ci-security.yml index 29855e8f781..87c722c0ab9 100644 --- a/.github/workflows/_ci-security.yml +++ b/.github/workflows/_ci-security.yml @@ -27,6 +27,11 @@ jobs: - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - name: Dependency policy run: cargo-deny check + # desktop/src-tauri is excluded from the root workspace and has its own + # Cargo.lock; it uses the root deny.toml. + - name: Desktop dependency policy + if: ${{ !cancelled() }} + run: cargo-deny --manifest-path desktop/src-tauri/Cargo.toml check results: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a663ef957c5..b10b38a89bf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -234,10 +234,10 @@ jobs: security-domain: name: Security Domain needs: [changes] - if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' + if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true' uses: ./.github/workflows/_ci-security.yml with: - rust: ${{ needs.changes.outputs.rust == 'true' }} + rust: ${{ needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true' }} rust-lint: name: Rust Lint @@ -397,7 +397,7 @@ jobs: security: name: Security - if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true') + if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true') needs: [changes, security-domain] runs-on: ubuntu-latest timeout-minutes: 5 diff --git a/deny.toml b/deny.toml index d3c5fcd4bc7..be6dda2c4fc 100644 --- a/deny.toml +++ b/deny.toml @@ -15,6 +15,19 @@ ignore = [ # remove these when upstream catches up. { id = "RUSTSEC-2026-0194", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, { id = "RUSTSEC-2026-0195", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" }, + # Desktop workspace (desktop/src-tauri) — unmaintained crates with no safe upgrade. + # audiopus_sys: via `opus` 0.3 (huddle Opus decoder); fix is switching Opus bindings. + { id = "RUSTSEC-2026-0150", reason = "desktop: audiopus_sys via opus; no maintained replacement adopted yet" }, + # mach 0.1.2 / 0.3.2: via `user-idle` 0.6 (macOS idle detection). + { id = "RUSTSEC-2020-0168", reason = "desktop: mach via user-idle; no upstream fix available" }, + # proc-macro-error: via tauri → tray-icon → gtk 0.18 → glib-macros (Linux only). + { id = "RUSTSEC-2024-0370", reason = "desktop: proc-macro-error via tauri's gtk 0.18 stack; waits on tauri" }, + # unic-*: via tauri-utils → urlpattern 0.3. + { id = "RUSTSEC-2025-0075", reason = "desktop: unic-char-range via tauri-utils → urlpattern; waits on tauri" }, + { id = "RUSTSEC-2025-0080", reason = "desktop: unic-common via tauri-utils → urlpattern; waits on tauri" }, + { id = "RUSTSEC-2025-0081", reason = "desktop: unic-char-property via tauri-utils → urlpattern; waits on tauri" }, + { id = "RUSTSEC-2025-0098", reason = "desktop: unic-ucd-version via tauri-utils → urlpattern; waits on tauri" }, + { id = "RUSTSEC-2025-0100", reason = "desktop: unic-ucd-ident via tauri-utils → urlpattern; waits on tauri" }, ] [licenses] From fc8c2fa3c03543149530435617a5f5b154c46ebe Mon Sep 17 00:00:00 2001 From: QuicksilverSlick Date: Mon, 28 Sep 2026 11:39:12 -0500 Subject: [PATCH 2/2] ci(security): ignore RUSTSEC-2026-0293 (ringbuf via neteq, never called) The desktop cargo-deny check this PR adds caught RUSTSEC-2026-0293 (published 2026-09-21): a double free in ringbuf's Consumer::skip and Consumer::clear when an element's Drop panics, fixed in ringbuf 0.5.2. The desktop app gets ringbuf 0.3.3 only through neteq 0.8.3, and every neteq release up to 0.9.1 requires ringbuf ^0.3, so there is no upgrade path. neteq declares ringbuf but its source never calls it, so the affected functions are unreachable from Dreamforge. Ignored with that reason, like the other no-fix desktop advisories; drop the entry when neteq moves to ringbuf >= 0.5.2. cargo-deny 0.19.0: advisories ok for both the root and desktop workspaces. Co-Authored-By: Claude Opus 5.5 --- deny.toml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/deny.toml b/deny.toml index be6dda2c4fc..8971d8b63de 100644 --- a/deny.toml +++ b/deny.toml @@ -18,6 +18,10 @@ ignore = [ # Desktop workspace (desktop/src-tauri) — unmaintained crates with no safe upgrade. # audiopus_sys: via `opus` 0.3 (huddle Opus decoder); fix is switching Opus bindings. { id = "RUSTSEC-2026-0150", reason = "desktop: audiopus_sys via opus; no maintained replacement adopted yet" }, + # ringbuf 0.3.3: via `neteq` 0.8 (huddle jitter buffer). neteq declares ringbuf but its source never + # calls it, so Consumer::skip/clear (the affected functions) are unreachable; every neteq release, + # 0.9.1 included, still requires ringbuf ^0.3. Drop this when neteq moves to ringbuf >= 0.5.2. + { id = "RUSTSEC-2026-0293", reason = "desktop: ringbuf 0.3 via neteq, which never calls it; no neteq release allows >= 0.5.2" }, # mach 0.1.2 / 0.3.2: via `user-idle` 0.6 (macOS idle detection). { id = "RUSTSEC-2020-0168", reason = "desktop: mach via user-idle; no upstream fix available" }, # proc-macro-error: via tauri → tray-icon → gtk 0.18 → glib-macros (Linux only).