Skip to content

fix(deps): patch Rust XML advisory paths #218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
saagpatel merged 1 commit into from
Jul 17, 2026
Merged

fix(deps): patch Rust XML advisory paths #218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/scripts/dependency_watch_completion.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,18 @@ def build_payload(env: Mapping[str, str], observed_at: str) -> dict:
state = "failed"

succeeded = state == "succeeded"
if not issue_attempted:
write_result = "not_attempted"
readback_result = "not_required"
observed_result = {"kind": "state", "value": "no_issue_mutation"}
elif action:
write_result = "succeeded"
readback_result = "verified" if readback_verified else "failed"
observed_result = {"kind": "destination_id", "value": destination_id}
else:
write_result = "failed"
readback_result = "failed"
observed_result = {"kind": "state", "value": "issue_unverified"}
return {
"schema": "AutomationTerminalStateV1",
"automation_id": AUTOMATION_ID,
Expand All @@ -54,6 +66,9 @@ def build_payload(env: Mapping[str, str], observed_at: str) -> dict:
"evidence": {
"issue_action": action or ("unknown" if issue_attempted else "not_required"),
"issue_step_outcome": issue_outcome or "unknown",
"write_result": write_result,
"readback_result": readback_result,
"observed_result": observed_result,
},
},
"operator_action_required": not succeeded,
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/dependency-watch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,9 +58,9 @@ jobs:
working-directory: src-tauri
run: |
set +e
cargo audit --json > ../cargo-audit.json
bash ../scripts/security/run-cargo-audit.sh --json > ../cargo-audit.json

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Guard quick-xml waivers by dependency path

Switching the scheduled Rust audit to the waiver wrapper means the JSON summary is produced after the wrapper's global --ignore RUSTSEC-2026-0194/0195; cargo-audit documents --ignore as ignoring advisory IDs, not dependency paths (docs). I checked this workflow and it does not run the new tests/security/test_rust_dependency_advisories.py path guard, so if a later lockfile update reintroduces quick-xml <0.41 through calamine/plist or another runtime parser, dependency-watch can suppress the alert even though the waiver is intended only for wayland-scanner. Run the path guard here or make the wrapper fail when the ignored quick-xml advisories appear outside the trusted build-time chain.

Useful? React with 👍 / 👎.

status=$?
cargo audit > ../cargo-audit.txt || true
bash ../scripts/security/run-cargo-audit.sh > ../cargo-audit.txt || true
echo "exit_code=$status" >> "$GITHUB_OUTPUT"
exit 0

Expand Down
17 changes: 10 additions & 7 deletions docs/adr/0014-rust-advisory-vector-dependency-refresh.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,13 @@ Patch related Rust advisory drift in the same lockfile refresh:
- Tauri utility/plugin crates far enough to remove the stale `rand 0.7.3`
build-time path

Temporarily waive `RUSTSEC-2026-0194` and `RUSTSEC-2026-0195` for existing
`quick-xml` paths constrained by `calamine` and Tauri/plist. Keep the waiver in
`scripts/security/run-cargo-audit.sh`, not in workflow configuration, so the
exception remains visible to maintainers.
Upgrade `calamine` to `0.36.0` and `plist` to `1.10.0` so operator-controlled
spreadsheet parsing and Tauri/plist runtime parsing use patched
`quick-xml 0.41.0`. Temporarily retain the `RUSTSEC-2026-0194` and
`RUSTSEC-2026-0195` waiver only for `wayland-scanner`'s trusted build-time
protocol XML generator. Keep the waiver in `scripts/security/run-cargo-audit.sh`,
not in workflow configuration, so the exception remains visible to maintainers.
Track the residual exception through the dependency-alert destination `#178`.

## Consequences

Expand All @@ -45,9 +48,9 @@ Dependabot paths are removed from the lockfile. The vector store continues to
use the same table schema and data flow, with only the LanceDB reader interface
adapted.

The remaining `glib` and `quick-xml` advisories are upstream-constrained and
must stay on the dependency-advisory review list until their dependency chains
allow patched versions.
The remaining `glib` warning and build-only `quick-xml` advisory path are
upstream-constrained and must stay on the dependency-advisory review list until
their dependency chains allow patched versions.

## Alternatives Considered

Expand Down
6 changes: 4 additions & 2 deletions docs/security/DEPENDENCY_ADVISORY_BASELINE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Dependency Advisory Baseline

Date: 2026-07-04
Date: 2026-07-13
Default branch snapshot: pending merge of `codex/fix/assistsupport-lru-advisory`

## Purpose
Expand Down Expand Up @@ -38,7 +38,9 @@ It records known advisory state, active remediation PRs, and temporary exception
- `lancedb` upgraded to `0.30.0`, removing vulnerable `lru`.
- `rand` resolved to patched `0.8.6`.
- `quinn-proto`, `anyhow`, and `memmap2` patch updates applied for newly published RustSec advisories.
- `quick-xml` advisories `RUSTSEC-2026-0194` and `RUSTSEC-2026-0195` are temporarily waived for constrained `calamine` and Tauri/plist transitive paths.
- `calamine` is upgraded to `0.36.0` and `plist` to `1.10.0`; both runtime XML paths now use patched `quick-xml 0.41.0`.
- `quick-xml` advisories `RUSTSEC-2026-0194` and `RUSTSEC-2026-0195` remain temporarily waived only for `wayland-scanner`'s trusted build-time protocol XML generator.
- Waiver owner: Platform Engineering; tracking issue: `#178`; review deadline: 2026-08-10 or the first `wayland-scanner` release using `quick-xml >=0.41.0`.

## Exit Criteria to Update Baseline

Expand Down
13 changes: 8 additions & 5 deletions scripts/security/run-cargo-audit.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ cd "$repo_root/src-tauri"
# Last remediation update: hickory-resolver upgraded to 0.26.1 to clear
# RUSTSEC-2026-0119, and locked lz4_flex versions kept outside the
# RUSTSEC-2026-0041 vulnerable ranges.
# Umbrella tracking issue: https://github.com/saagar210/AssistSupport/issues/11
# Current dependency-alert destination: https://github.com/saagpatel/AssistSupport/issues/178
#
# GTK3/Tauri Linux runtime chain (issue #12):
# - RUSTSEC-2024-0411 gdkwayland-sys
Expand Down Expand Up @@ -44,11 +44,13 @@ cd "$repo_root/src-tauri"
# - RUSTSEC-2026-0105 core2
# - RUSTSEC-2026-0097 rand
#
# XML parser transitives (issue #17):
# XML parser transitives (dependency alert #178):
# - RUSTSEC-2026-0194 quick-xml duplicate attribute scan DoS
# - RUSTSEC-2026-0195 quick-xml namespace declaration allocation DoS
# Current paths are constrained by calamine and Tauri/plist. Revisit when
# calamine allows quick-xml >=0.41.0 and Tauri/plist moves past quick-xml 0.38.
# Runtime paths through calamine and Tauri/plist use quick-xml >=0.41.0.
# The sole older copy is constrained to wayland-scanner's trusted build-time
# protocol XML generator; it never parses operator-controlled documents.
# Review deadline: 2026-08-10, or when wayland-scanner adopts quick-xml >=0.41.
# Deny unsound/unmaintained advisories but do not hard-fail on yanked crate warnings,
# which can fluctuate transitively outside this repo's direct control.
cargo audit --deny unsound --deny unmaintained \
Expand All @@ -73,4 +75,5 @@ cargo audit --deny unsound --deny unmaintained \
--ignore RUSTSEC-2026-0097 \
--ignore RUSTSEC-2026-0105 \
--ignore RUSTSEC-2026-0194 \
--ignore RUSTSEC-2026-0195
--ignore RUSTSEC-2026-0195 \
"$@"
Loading
Loading