Skip to content

Commit afb1af1

Browse files
authored
fix(deps): resolve all RUSTSEC security advisories (#561)
Update dependencies to fix security vulnerabilities: - wasmtime v29 → v41: Fixes RUSTSEC-2025-0118 (shared memory API), RUSTSEC-2025-0046 (fd_renumber panic), RUSTSEC-2026-0006 (f64.copysign segfault), RUSTSEC-2025-0057 (fxhash unmaintained), RUSTSEC-2024-0436 (paste unmaintained) - scraper v0.22 → v0.25: Removes fxhash transitive dependency - ratatui v0.29 → v0.30: Fixes RUSTSEC-2026-0002 (lru unsound iteration) - crossterm v0.28 → v0.29: Required for ratatui v0.30 compatibility - tui-textarea: Updated to git version for ratatui v0.30 support All RUSTSEC ignore entries removed from .cargo/audit.toml. Code changes: Updated MockBackend trait impl and lifetime annotations for ratatui v0.30 API changes.
1 parent 682bca8 commit afb1af1

8 files changed

Lines changed: 1110 additions & 495 deletions

File tree

.cargo/audit.toml

Lines changed: 2 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -6,42 +6,8 @@
66
# easily upgraded, typically due to deep dependency chains (e.g., wasmtime).
77

88
[advisories]
9-
# These advisories are either:
10-
# 1. False positives for our use case
11-
# 2. In transitive dependencies we cannot easily update
12-
# 3. Low severity issues being tracked for future resolution
13-
#
14-
# All wasmtime issues are due to using v29.0.1 via cortex-plugins.
15-
# Upgrading wasmtime is a significant effort tracked separately.
16-
ignore = [
17-
# wasmtime v29.0.1 - Unsound API access to WebAssembly shared linear memory
18-
# Severity: low (1.8)
19-
# We don't expose raw WebAssembly memory APIs to untrusted code
20-
"RUSTSEC-2025-0118",
21-
22-
# wasmtime v29.0.1 - Host panic with fd_renumber WASIp1 function
23-
# Severity: low (3.3)
24-
# Limited exposure - panic doesn't compromise security
25-
"RUSTSEC-2025-0046",
26-
27-
# wasmtime v29.0.1 - Segfault with f64.copysign operator on x86-64
28-
# Severity: medium (4.1)
29-
# Tracked for wasmtime upgrade
30-
"RUSTSEC-2026-0006",
31-
32-
# fxhash v0.2.1 - unmaintained
33-
# Transitive dependency via selectors/scraper and wasmtime
34-
"RUSTSEC-2025-0057",
35-
36-
# paste v1.0.15 - unmaintained
37-
# Transitive dependency via wasmtime and ratatui
38-
"RUSTSEC-2024-0436",
39-
40-
# lru v0.12.5 - unsound IterMut implementation
41-
# Transitive dependency via ratatui
42-
# We don't use LRU cache iteration mutably
43-
"RUSTSEC-2026-0002",
44-
]
9+
# No longer needed - wasmtime updated to v41, ratatui to v0.30
10+
ignore = []
4511

4612
# Warn on informational advisories (unmaintained, unsound, etc.)
4713
informational_warnings = ["unmaintained", "unsound", "notice"]

0 commit comments

Comments
 (0)