kestrove/kestrove-core
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Bump uniffi 0.28 -> 0.32.2; drop the bincode and paste deny ignores
ci / test (push) Canceled after 0s
Details
ci / wasm (push) Canceled after 0s
Details
ci / deny (push) Canceled after 0s
Details
ci / fuzz (push) Canceled after 0s
Details

Browse Source 
uniffi 0.32 no longer depends on bincode (RUSTSEC-2025-0141) or paste
(RUSTSEC-2024-0436), so their ignores go. basic-toml (RUSTSEC-2026-0374)
stays: askama_derive 0.16 in uniffi_bindgen 0.32 still pulls it in.
kv-ffi compiles unchanged; regenerated Swift/Kotlin bindings need no
caller changes in kestrove-apple or kestrove-android.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
sami
2026-10-20 23:25:22 +09:00
co-authored by Claude Opus 5.5
parent 2d32b20e81
commit d45033f424
4 changed files with 155 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deny.toml
+5 -6
View File
@@ -3,12 +3,11 @@
version = 2
yanked = "deny"
ignore = [
# Unmaintained (no known vulnerability), build-time only: pulled in by uniffi 0.28's proc-macros and
# bindgen, never linked into the shipped library's runtime paths. Goes away with a uniffi upgrade,
# which regenerates the Swift/Kotlin bindings (tracked in fuzz/README.md "Dependency policy").
{ id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
{ id = "RUSTSEC-2024-0436", reason = "paste via uniffi_core/uniffi_bindgen 0.28 (proc-macro)" },
{ id = "RUSTSEC-2026-0374", reason = "basic-toml (unmaintained, no known vulnerability) via askama_derive 0.12 in uniffi_bindgen 0.28: build-time code generation only" },
# basic-toml is NOT removed by the uniffi 0.32 upgrade (which did drop bincode and paste): every release
# through 0.32.2 enables askama's "config" feature, and askama_derive 0.16 still depends on basic-toml for it.
# Build-time only (template config parsing in the bindings generator); no known vulnerability.
# Revisit when askama or uniffi_bindgen drops basic-toml.
{ id = "RUSTSEC-2026-0374", reason = "basic-toml (unmaintained, no known vulnerability) via askama_derive 0.16 in uniffi_bindgen 0.32: build-time code generation only" },
]
[licenses]