From daa6b0d29f2736bdc9ae6adc9edd4b30577d99cb Mon Sep 17 00:00:00 2001 From: Roman Inflianskas Date: Tue, 4 Aug 2026 11:51:47 +0000 Subject: [PATCH 1/2] build(deps): track Cargo dependencies with Dependabot The Dependabot config covered only the github-actions ecosystem, so no Rust dependency in the workspace was ever checked for newer releases or published advisories despite the repo pinning Actions to SHAs for supply-chain safety. Group minor and patch bumps into one weekly pull request and leave major bumps as individual pull requests so each breaking change is reviewed on its own. Signed-off-by: Roman Inflianskas --- .github/dependabot.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1775cf08..8392722c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,27 @@ updates: github-actions: patterns: - "*" + + # Cargo dependencies were previously untracked, so the workspace could drift + # onto crate versions carrying published advisories with nothing to surface + # them. `directory: /` is the workspace root: Dependabot resolves the whole + # member graph from the root manifest and `Cargo.lock`, so one entry covers + # every crate. Minor and patch bumps are grouped into a single weekly PR -- + # they are almost always drop-in for a workspace this wide, and one PR per + # crate would bury real review signal. Major bumps stay ungrouped so each + # breaking change is reviewed, and eventually merged, on its own. + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + # Above the default of 5 so a backlog of separate major bumps cannot starve + # the grouped minor/patch PR, but still bounded so the queue stays readable. + open-pull-requests-limit: 10 + groups: + cargo-minor-patch: + applies-to: version-updates + patterns: + - "*" + update-types: + - minor + - patch From 1817ad3f8e31b642db3b8d2fb32878e20fbc1b44 Mon Sep 17 00:00:00 2001 From: Roman Inflianskas Date: Tue, 4 Aug 2026 12:07:36 +0000 Subject: [PATCH 2/2] build(deps): give Dependabot Cargo bumps a 7-day cooldown A crate bump PR runs the new version's build.rs and proc macros on the CI runner as soon as it opens, so a malicious release is executed before anyone reads the lockfile diff. Waiting a week lets the usual yank happen off our runners. Signed-off-by: Roman Inflianskas --- .github/dependabot.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8392722c..155f4cb6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -25,6 +25,15 @@ updates: directory: / schedule: interval: weekly + # Let a bad release be found and yanked before we adopt it. A crate bump is + # not inert data waiting for review: `cargo build` runs the new version's + # `build.rs` and expands its proc macros on the CI runner, so the bump PR + # executes third-party code the moment it opens — before a human reads the + # lockfile diff. A week is long enough for the common case of a malicious or + # backdoored release being yanked from crates.io to play out off our + # runners. Cooldown delays only version updates, never security updates. + cooldown: + default-days: 7 # Above the default of 5 so a backlog of separate major bumps cannot starve # the grouped minor/patch PR, but still bounded so the queue stays readable. open-pull-requests-limit: 10