diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 37632e0a..305ddfde 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,6 +17,21 @@ updates: - minor - patch + # Rust dependencies of the desktop shell + - package-ecosystem: cargo + directory: /src-tauri + schedule: + interval: weekly + open-pull-requests-limit: 5 + commit-message: + prefix: chore + include: scope + groups: + minor-and-patch: + update-types: + - minor + - patch + # GitHub Actions used in .github/workflows/ - package-ecosystem: github-actions directory: / diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index c82140df..0bd30e23 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -25,7 +25,7 @@ jobs: - uses: EmbarkStudios/cargo-deny-action@v2 with: - command: check licenses + command: check licenses advisories manifest-path: ./src-tauri/Cargo.toml - run: pnpm attribution:check diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a2ee7b49..27d7d0ce 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,7 +51,7 @@ jobs: - uses: EmbarkStudios/cargo-deny-action@v2 with: - command: check licenses + command: check licenses advisories manifest-path: ./src-tauri/Cargo.toml - id: version diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 7942ad10..0d0b0178 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -227,11 +227,12 @@ dependencies = [ [[package]] name = "atoi_simd" -version = "0.16.1" +version = "0.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2a49e05797ca52e312a0c658938b7d00693ef037799ef7187678f212d7684cf" +checksum = "f3cdb3708a128e559a30fb830e8a77a5022ee6902806925c216658652b452a44" dependencies = [ "debug_unsafe", + "rustversion", ] [[package]] @@ -409,9 +410,9 @@ dependencies = [ [[package]] name = "calamine" -version = "0.30.1" +version = "0.36.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1a9acfeb1555aa8def91fe8ff208aadaea850c109968ec35ac965edbe7d210b" +checksum = "6975084f43060e56343ffba7f9731fa52a7dcf2e1cd8e2459fd4c6bf4a1bff59" dependencies = [ "atoi_simd", "byteorder", @@ -420,9 +421,9 @@ dependencies = [ "encoding_rs", "fast-float2", "log", - "quick-xml 0.37.5", + "quick-xml", "serde", - "zip", + "zip 8.6.0", ] [[package]] @@ -2959,7 +2960,7 @@ checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85" dependencies = [ "base64 0.22.1", "indexmap 2.14.0", - "quick-xml 0.41.0", + "quick-xml", "serde", "time", ] @@ -3105,22 +3106,13 @@ dependencies = [ "unicode-ident", ] -[[package]] -name = "quick-xml" -version = "0.37.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb" -dependencies = [ - "encoding_rs", - "memchr", -] - [[package]] name = "quick-xml" version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" dependencies = [ + "encoding_rs", "memchr", ] @@ -4556,7 +4548,7 @@ dependencies = [ "tokio", "url", "windows-sys 0.60.2", - "zip", + "zip 4.6.1", ] [[package]] @@ -5064,6 +5056,12 @@ version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" +[[package]] +name = "typed-path" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" + [[package]] name = "typeid" version = "1.0.3" @@ -6308,6 +6306,20 @@ dependencies = [ "zopfli", ] +[[package]] +name = "zip" +version = "8.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +dependencies = [ + "crc32fast", + "flate2", + "indexmap 2.14.0", + "memchr", + "typed-path", + "zopfli", +] + [[package]] name = "zlib-rs" version = "0.6.6" @@ -6358,7 +6370,7 @@ dependencies = [ "tokio", "tokio-stream", "windows-sys 0.61.2", - "zip", + "zip 4.6.1", ] [[package]] diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 3d6ac5e8..34717063 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -36,7 +36,7 @@ keyring = { version = "3", features = ["windows-native", "apple-native", "sync-s sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "postgres", "mysql", "tls-rustls-ring"] } # Excel as a plain file reader (excel.rs): ZebraDesigner-parity without the # ODBC driver-manager tax. dates maps serial datetimes via chrono. -calamine = { version = "0.30.1", features = ["dates"] } +calamine = { version = "0.36", features = ["dates"] } # Already transitive via calamine; used directly in excel.rs to bound a # workbook's DECLARED uncompressed size before calamine materializes it, so a # decompression bomb can't defeat the compressed-only file-size cap. diff --git a/src-tauri/THIRD-PARTY-LICENSES-RUST.md b/src-tauri/THIRD-PARTY-LICENSES-RUST.md index e60a7d67..ad77eddb 100644 --- a/src-tauri/THIRD-PARTY-LICENSES-RUST.md +++ b/src-tauri/THIRD-PARTY-LICENSES-RUST.md @@ -8,7 +8,7 @@ drifts from the locked dependencies. ## Overview -- MIT License (454) +- MIT License (456) - Unicode License v3 (19) - Apache License 2.0 (7) - BSD 3-Clause "New" or "Revised" License (5) @@ -4321,6 +4321,40 @@ DEALINGS IN THE SOFTWARE. Used by: +- [atoi_simd 0.18.1](https://github.com/RoDmitry/atoi_simd) +```` +Copyright (c) 2022 Dmitry Rodionov + +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. + +```` + +### MIT License + +Used by: + - [rustls-pki-types 1.15.0](https://github.com/rustls/pki-types) ```` Copyright (c) 2023 Dirkjan Ochtman @@ -5768,7 +5802,6 @@ SOFTWARE. Used by: - [zplab 0.2.0](https://github.com/u8array/ZPLab) -- [atoi_simd 0.16.1](https://github.com/RoDmitry/atoi_simd) - [block2 0.6.2](https://github.com/madsmtm/objc2) - [brotli-decompressor 5.0.3](https://github.com/dropbox/rust-brotli-decompressor) - [cargo_toml 0.22.3](https://gitlab.com/lib.rs/cargo_toml) @@ -6100,6 +6133,7 @@ Used by: - [proc-macro2 1.0.106](https://github.com/dtolnay/proc-macro2) - [quote 1.0.46](https://github.com/dtolnay/quote) - [rustix 1.1.4](https://github.com/bytecodealliance/rustix) +- [rustversion 1.0.23](https://github.com/dtolnay/rustversion) - [semver 1.0.28](https://github.com/dtolnay/semver) - [serde-untagged 0.1.9](https://github.com/dtolnay/serde-untagged) - [serde 1.0.228](https://github.com/serde-rs/serde) @@ -6116,6 +6150,7 @@ Used by: - [thiserror-impl 2.0.18](https://github.com/dtolnay/thiserror) - [thiserror 1.0.69](https://github.com/dtolnay/thiserror) - [thiserror 2.0.18](https://github.com/dtolnay/thiserror) +- [typed-path 0.12.3](https://github.com/chipsenkbeil/typed-path) - [typeid 1.0.3](https://github.com/dtolnay/typeid) - [unicode-ident 1.0.24](https://github.com/dtolnay/unicode-ident) - [x11-dl 2.21.0](https://github.com/AltF02/x11-rs.git) @@ -6384,6 +6419,36 @@ SOFTWARE. Used by: +- [zip 8.6.0](https://github.com/zip-rs/zip2) +```` +The MIT License (MIT) + +Copyright (c) 2014 Mathijs van de Nes + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +```` + +### MIT License + +Used by: + - [zip 4.6.1](https://github.com/zip-rs/zip2.git) ```` The MIT License (MIT) @@ -6666,7 +6731,7 @@ SOFTWARE. Used by: -- [calamine 0.30.1](https://github.com/tafia/calamine) +- [calamine 0.36.0](https://github.com/tafia/calamine) ```` The MIT License (MIT) @@ -6987,7 +7052,6 @@ SOFTWARE. Used by: -- [quick-xml 0.37.5](https://github.com/tafia/quick-xml) - [quick-xml 0.41.0](https://github.com/tafia/quick-xml) ```` The MIT License (MIT) diff --git a/src-tauri/deny.toml b/src-tauri/deny.toml index a85160c5..f2fa5f4b 100644 --- a/src-tauri/deny.toml +++ b/src-tauri/deny.toml @@ -1,6 +1,17 @@ # Fail-closed license gate for the Rust dependency tree shipped in the desktop # binaries; mirror of scripts/check-licenses.mjs for npm. Adding an id to # `allow` or a crate to `exceptions` is a deliberate review step. +# RustSec advisories fail the same CI gate; unmaintained crates only warn +# (no fix available by definition, tracked via dependabot bumps instead). +[advisories] +unmaintained = "workspace" +yanked = "deny" +ignore = [ + # sqlx-mysql pulls rsa for the auth handshake; no fixed release exists + # (Marvin timing side channel). Revisit when sqlx drops the rsa crate. + { id = "RUSTSEC-2023-0071", reason = "no upstream fix; local-network DB auth only" }, +] + [licenses] allow = [ "MIT", @@ -14,7 +25,6 @@ allow = [ "Unlicense", "CC0-1.0", "Zlib", - "Python-2.0", # ICU4X family (icu_*, zerovec, yoke, ...); OSI-approved permissive. "Unicode-3.0", ]