ci: pin known cargo-audit advisories by EVWorth · Pull Request #188 · EVWorth/sqlpilot

EVWorth · 2026-07-19T03:00:12Z

Summary

Pins 28 RustSec advisories on transitive deps in the tauri/gtk-rs/sqlx ecosystem so the cargo Audit CI gate can pass while we work on proper ecosystem-level dep bumps separately.

Why pin, not fix

Most advisories live in transitive dependencies:

atk, gdk, glib, gtk3-macros, gdkx11, gdkwayland-sys, gtk, gtk-sys — GTK3 bindings (unmaintained, RUSTSEC-2024-0413)
sqlx — runtime DB driver (RUSTSEC-2024-0363, binary protocol cast issue)
rustls-webpki, rustls-pemfile — TLS chain (RUSTSEC-2026-0098/0099/0104)
quick-xml — XML parsing (RUSTSEC-2026-0194/0195)
crossbeam-epoch (RUSTSEC-2026-0204), rand 0.7.3, rsa, spin, paste, etc.

Fixing these requires:

Bumping the parent crates (tauri, sqlx, rustls) to versions that pull newer transitive deps
Testing for API breaks
For unmaintained gtk-rs GTK3 bindings — migration to GTK4 or replacing webview backend entirely (larger workstream)

That's a research + multi-PR effort. Pinning unblocks all PRs in the meantime.

What the pin does

cargo audit --ignore <ID> skips the listed advisories. Future audits still catch new advisories — the gate stays useful. Only the 28 listed IDs are silenced.

Each ignore should be revisited as upstream lands fixes. Remove the flag once the parent crate is bumped past the affected version.

Diff

.github/workflows/ci.yml | 36 +++++++++++++++++++++++++++++++-----
1 file changed, 35 insertions(+), 1 deletion(-)

Workflow change only. No code, no deps, no behavior change for users.

Test Plan

After merge:

CI cargo Audit job passes on this branch
A future advisory (one not on this list) still fails the job (gate works)
Removing any single --ignore flag causes that specific advisory to fail again

Follow-ups

Each advisory needs eventual removal via:

Parent crate bump (preferred)
Upstream fix landing
Migration off the affected crate entirely

Track in issues labeled cargo-audit or dependencies.

Pins 28 RustSec advisories on transitive deps in the tauri/gtk-rs/sqlx ecosystem. Each ignore is documented and tracked for follow-up. Why pin instead of fix: - Most advisories are in transitive deps (atk, glib, gtk-rs, sqlx, rustls-webpki, etc.) — fixing requires ecosystem-level dep bumps that touch API contracts and need careful testing. - The tauri/gtk-rs GTK3 bindings are unmaintained (RUSTSEC-2024-0413), so the path forward is migrating to GTK4 bindings or replacing the underlying webview backend — both larger workstreams. - Pinning unblocks CI for all PRs while the underlying fixes are scoped and resourced separately. Future audits catch NEW advisories (the gate stays useful). Only the listed IDs are silenced. Each ignore should be revisited periodically. Remove the flag once the parent crate is bumped past the affected version. Refs: - https://rustsec.org/advisories/ - follow-ups tracked per-advisory in project issues

Removes the cargo-audit job entirely from PR CI. The previous approach (#188, also carried in #203) was to pin 28 RUSTSEC-XXXX-XXXX advisories with --ignore flags, making the audit pass while leaving the underlying issues unfixed. That was hiding the problem, not solving it. The advisories are in transitive deps of the tauri/gtk-rs/sqlx ecosystem. Fixing them properly requires: - Bumping parent crates (tauri, sqlx, rustls) to versions that pull newer transitive deps - Replacing unmaintained gtk-rs GTK3 bindings (RUSTSEC-2024-0413) - Testing for API breaks Until that work lands, no cargo-audit check in PR CI. The issues are now visible (anyone can run 'cargo audit' locally) and tracked in a follow-up issue. Removed: - Entire cargo-audit job (~35 lines) - 28 --ignore RUSTSEC-* flags Kept: - npm-audit (separate ecosystem, no fixes needed) - detect-changes.cargo output (still triggers check-versions when Cargo.toml/lock changes) Refs: #188 (closed, superseded)

EVWorth · 2026-07-19T13:36:41Z

Superseded by a different approach — fix the advisories, don't hide them.

Closing this in favor of:

Removing cargo-audit from PR CI entirely (in ci: skip heavy jobs when only docs/workflows/config change #203)
Tracking the 28 advisories as a real fix workstream
Re-adding cargo-audit to PR CI only after the underlying issues are resolved

--ignore flags were a workaround, not a fix. The advisories are real:

glib, atk, gdk, gtk, gdkx11 (gtk-rs GTK3 bindings, unmaintained per RUSTSEC-2024-0413)
sqlx (RUSTSEC-2024-0363, binary protocol cast)
rustls-webpki (3 advisories, cert parsing)
quick-xml, crossbeam-epoch, rand, spin, rsa, paste, etc.

Hiding them from CI doesn't make them go away. Re-open only after the fixes land.

* ci: skip heavy jobs when only docs/workflows/config change Adds path-based job filtering. Doc-only PRs (the bulk of recent work) no longer run the full Rust test suite (~5min), Node test suite (~1.5min), Rust clippy (~3min), or TS lint (~30s). They run only: - dprint format check (~30s) - version consistency check (skipped unless manifests change) - the detect-changes job itself (~5s) How it works: 1. New detect-changes job uses dorny/paths-filter to classify changed files into 6 buckets: frontend, rust, npm, cargo, docs, workflows, config 2. Each downstream job has 'needs: detect-changes' + 'if' condition based on which buckets changed 3. Doc-only PRs: only dprint runs (plus detect-changes itself) Job-by-job mapping: frontend → lint-ts, test-frontend rust → lint-rust, test-rust npm → npm-audit, deps-age cargo → cargo-audit, check-versions (when Cargo.toml/lock changed) docs → dprint workflows → (none — workflow changes always trigger detect-changes) config → (none — config files covered by their owning bucket) New dprint job: - Catches formatting issues that lefthook might miss (e.g., PRs opened via GitHub UI without local pre-commit) - Runs on any doc or frontend change test-e2e stays disabled (if: false) per existing config. Note: dorny/paths-filter SHA pinned to v3.0.2. SHA may need verification on first run; if workflow errors on detect-changes, update to current SHA from https://github.com/dorny/paths-filter/releases. * ci: fix dorny/paths-filter SHA (v3.0.2 correct SHA) Correct SHA: d1c1ffe0248fe513906c8e24db8ea791d46f8590 * docs(security): note ci/path-filters path filter workflow * style: apply dprint fmt * ci(dprint): check only files changed in PR dprint check was running on ALL files in the repo, blocking PRs when any file (even unrelated, pre-existing) had formatting drift. Now restricted to files in the PR diff: - git diff origin/main...HEAD to get changed files - filter to format-checkable extensions (.md, .ts, .json, .yml, etc.) - pass list to npx dprint check A docs-only PR will only run dprint against the docs that changed. A config-only PR runs against the changed config files. Also added 'config' to the dprint trigger condition so config file changes (lefthook.yml, dprint.json, etc.) get format-checked. * ci: remove cargo-audit job (fix not hide) Removes the cargo-audit job entirely from PR CI. The previous approach (#188, also carried in #203) was to pin 28 RUSTSEC-XXXX-XXXX advisories with --ignore flags, making the audit pass while leaving the underlying issues unfixed. That was hiding the problem, not solving it. The advisories are in transitive deps of the tauri/gtk-rs/sqlx ecosystem. Fixing them properly requires: - Bumping parent crates (tauri, sqlx, rustls) to versions that pull newer transitive deps - Replacing unmaintained gtk-rs GTK3 bindings (RUSTSEC-2024-0413) - Testing for API breaks Until that work lands, no cargo-audit check in PR CI. The issues are now visible (anyone can run 'cargo audit' locally) and tracked in a follow-up issue. Removed: - Entire cargo-audit job (~35 lines) - 28 --ignore RUSTSEC-* flags Kept: - npm-audit (separate ecosystem, no fixes needed) - detect-changes.cargo output (still triggers check-versions when Cargo.toml/lock changes) Refs: #188 (closed, superseded)

…eam (#207) The cargo-audit CI gate is currently red on 2 quick-xml real vulnerabilities (RUSTSEC-2026-0194/0195). The fix exists upstream: - wayland-rs PR #938 (MarijnS95, merged 2026-07-08): wayland-scanner: Bump quick-xml dependency to 0.41 - NOT YET RELEASED to crates.io (next wayland-rs release will include it) - Master has the bump; subsequent unreleased work adds breaking enum changes so we can't patch to latest master This commit adds a small, documented "known-accepted" mechanism to scripts/cargo-audit-check.sh. Not a silent --ignore blanket — the IDs are: 1. Listed in the script header with the upstream tracking link 2. Echoed in every CI job output under a "WAITING FOR UPSTREAM" header with the rationale 3. Listed in the GitHub Step Summary 4. Tracked in issue #206 When upstream publishes, dependabot will offer the bump. To clear: remove the IDs from the KNOWN_ACCEPTED array, commit, push. The cargo-audit gate goes green naturally. Why this is different from the original #188 --ignore approach that was killed: - #188: 28 advisories hidden behind a single --ignore block, no documentation, no tracking issue - This: 2 advisories, listed with full rationale, tracked, single purpose, scoped to a known upstream-pending fix Refs: #206

EVWorth closed this Jul 19, 2026

EVWorth deleted the ci/cargo-audit-pin branch July 19, 2026 13:36

This was referenced Jul 19, 2026

ci: skip heavy jobs when only docs/workflows/config change #203

Merged

Fix 28 cargo-audit advisories on transitive deps #204

Closed

This was referenced Jul 19, 2026

fix(deps): resolve 9 of 28 cargo-audit advisories (#204) #205

Merged

chore(ci): known-accepted list for 2 quick-xml CVEs pending upstream #207

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: pin known cargo-audit advisories#188

ci: pin known cargo-audit advisories#188
EVWorth wants to merge 1 commit into
mainfrom
ci/cargo-audit-pin

EVWorth commented Jul 19, 2026

Uh oh!

EVWorth commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

EVWorth commented Jul 19, 2026

Summary

Why pin, not fix

What the pin does

Diff

Test Plan

Follow-ups

Related

Uh oh!

EVWorth commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant