Skip to content

chore(deps): consolidate PRs #116-126, fix rkyv/brace-expansion/nanoid advisories #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pacphi merged 1 commit into from
Aug 9, 2026
Merged

chore(deps): consolidate PRs #116-126, fix rkyv/brace-expansion/nanoid advisories #127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ jobs:
- uses: dtolnay/rust-toolchain@stable
- name: Install lld
run: sudo apt-get update && sudo apt-get install -y lld
- uses: taiki-e/install-action@v2.85.4
- uses: taiki-e/install-action@v2.85.8
with:
tool: cargo-nextest@0.9.140
- uses: Swatinem/rust-cache@v2
Expand Down Expand Up @@ -97,7 +97,7 @@ jobs:
TEST_DATABASE_URL: postgres://finima:test@localhost:5432/finima_test
steps:
- uses: actions/checkout@v7
- uses: taiki-e/install-action@v2.85.4
- uses: taiki-e/install-action@v2.85.8
with:
tool: cargo-nextest@0.9.140
- uses: actions/download-artifact@v8
Expand Down Expand Up @@ -148,7 +148,7 @@ jobs:
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
- uses: taiki-e/install-action@v2.85.4
- uses: taiki-e/install-action@v2.85.8
with:
tool: cargo-audit
- name: Run security audit
Expand Down
34 changes: 17 additions & 17 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 9 additions & 0 deletions audit-ignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,3 +35,12 @@ RUSTSEC-2025-0119
# RUSTSEC-2024-0436: paste unmaintained (informational, no CVE)
# Transitive dep via candle/tokenizers; no drop-in replacement used.
RUSTSEC-2024-0436

# RUSTSEC-2026-0235: rkyv 0.7.46 archive validation (out-of-bounds reads via Rc/Arc)
# Pulled in only via rust_decimal's optional "rkyv" feature, which nothing in
# this workspace enables (verified with `cargo tree -i rkyv@0.7.46 --all-features
# --target all`, which finds no reachable path, and confirmed by a from-scratch
# `cargo generate-lockfile`, which still retains the edge without activating it).
# The vulnerable deserialization path is never compiled or executed. Will
# resolve once rust_decimal ships a release depending on rkyv 0.8.17+.
RUSTSEC-2026-0235
8 changes: 4 additions & 4 deletions frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
"typecheck": "tsc --noEmit"
},
"dependencies": {
"@hookform/resolvers": "^5.4.0",
"@hookform/resolvers": "^5.7.1",
"@tanstack/react-table": "^8.21.0",
"js-yaml": "^5.2.2",
"react": "^19.2.8",
Expand All @@ -36,20 +36,20 @@
},
"devDependencies": {
"@eslint/js": "^10.0.1",
"@playwright/test": "^1.62.0",
"@playwright/test": "^1.62.1",
"@tailwindcss/vite": "^4.3.3",
"@testing-library/jest-dom": "^7.0.0",
"@testing-library/react": "^16.1.0",
"@types/react": "^19.2.17",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^6.0.2",
"@vitejs/plugin-react": "^6.0.5",
"eslint": "^10.4.1",
"eslint-plugin-react-hooks": "^7.1.1",
"jsdom": "^30.0.1",
"prettier": "^3.8.3",
"tailwindcss": "^4.3.3",
"typescript": "^6.0.3",
"typescript-eslint": "^8.60.0",
"typescript-eslint": "^8.66.0",
"vite": "^8.0.16",
"vitest": "^4.1.10"
}
Expand Down
Loading