fix(deps): Angular 21.2.9 + audit gate (CON-44) - #12
Open
Gatos90 wants to merge 2 commits into
Open
Conversation
…Android (CON-42) Replaces the legacy XOR obfuscation on desktop and the plaintext api_key write path on Android with authenticated encryption. Adds src-tauri/src/crypto/vault.rs wrapping Aes256Gcm with a 12-byte random nonce per write; desktop sources the master key from the OS keyring, Android returns None and refuses new writes (no Android Keystore JNI shim yet — deferred per delegator). - New crypto_version tag on rows (1=legacy XOR, 2=AES-GCM) plus *_nonce columns - Idempotent ALTER TABLE migrations; existing XOR rows still readable via fallback - get/upsert signatures now take Option<&LocalVault>; store refuses secrets w/o vault - commands/ai.rs update_ai_settings_cmd routes api_key through the vault on both paths - Tests: round-trip, nonce uniqueness, tamper detection, wrong-key rejection, legacy read cargo test -p containerus: 158 passed, 0 failed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Bumps @angular/{core,compiler,common,forms,platform-browser,router,cdk,build,cli,compiler-cli,platform-browser-dynamic} to 21.2.x to clear CVE-2026-22610 (GHSA-jrmj-c5cx-3cw6) and two follow-up Angular XSS advisories (GHSA-prjf-86w9-mfqv, GHSA-g93w-mfhg-p222).
- Adds pnpm overrides for rollup >=4.60.1, picomatch >=4.0.4, serialize-javascript >=7.0.5 (all transitive through tauri-plugin-keychain) and dompurify >=3.4.0 (transitive through monaco-editor). pnpm audit --prod now reports 0 vulnerabilities.
- Adds a security-audit CI job that runs pnpm audit --prod --audit-level high and cargo audit on every push/PR, wired into the test-results gate.
- Adds .cargo/audit.toml documenting known cargo advisories that require coordinated upstream bumps (russh/libcrux, rusqlite/sqlx, validator/idna, rsa PKCS#1 v1.5) — to be addressed in CON-44 follow-up issues.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes CON-44. Clears all high/critical pnpm advisories and wires security audit into CI.
pnpm audit --prodnow reports 0 vulnerabilities.pnpm audit --prod --audit-level highandcargo audit, gated viatest-results..cargo/audit.tomldocuments cargo advisories that need coordinated upstream bumps (russh/libcrux, rusqlite/sqlx/validator/idna, rsa PKCS#1 v1.5). Follow-ups to be filed after merge.Test plan
pnpm audit --prod→ 0 vulnerabilitiespnpm buildpassespnpm testno new failures (pre-existing 52 failures unchanged)cargo auditpasses with documented exceptions🤖 Generated with Claude Code