kestrove/kestrove-core
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Bump uniffi 0.28 -> 0.32.2; drop the bincode and paste deny ignores
ci / test (push) Canceled after 0s
Details
ci / wasm (push) Canceled after 0s
Details
ci / deny (push) Canceled after 0s
Details
ci / fuzz (push) Canceled after 0s
Details

Browse Source 
uniffi 0.32 no longer depends on bincode (RUSTSEC-2025-0141) or paste
(RUSTSEC-2024-0436), so their ignores go. basic-toml (RUSTSEC-2026-0374)
stays: askama_derive 0.16 in uniffi_bindgen 0.32 still pulls it in.
kv-ffi compiles unchanged; regenerated Swift/Kotlin bindings need no
caller changes in kestrove-apple or kestrove-android.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
sami
2026-10-20 23:25:22 +09:00
co-authored by Claude Opus 5.5
parent 2d32b20e81
commit d45033f424
4 changed files with 155 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fuzz/README.md
+2 -2
View File
@@ -78,9 +78,9 @@ passkeys branch is changing `kv-ffi`. Worth a `saturating_add` when that merges.
| Repo | Check | Result |
|---|---|---|
| kestrove-core | `cargo deny check` | passes. `allow-wildcard-paths` for the workspace's own path crates. Ignored: RUSTSEC-2025-0141 (bincode 1.x) and RUSTSEC-2024-0436 (paste), both *unmaintained* notices for build-time crates pulled in by uniffi 0.28's proc-macros and bindgen. **Not fixable here:** the fix is a uniffi upgrade, which regenerates the Swift and Kotlin bindings for both apps. |
| kestrove-core | `cargo deny check` | passes. `allow-wildcard-paths` for the workspace's own path crates. The uniffi 0.32 upgrade dropped bincode 1.x (RUSTSEC-2025-0141) and paste (RUSTSEC-2024-0436). Still ignored: RUSTSEC-2026-0374 (basic-toml, *unmaintained*), build-time only via askama_derive 0.16 in uniffi_bindgen 0.32. **Not fixable here:** it goes away when askama or uniffi_bindgen drops basic-toml. |
| kestrove-server | `cargo deny check` (new `deny.toml`) | passes, no ignores |
| kestrove-desktop/src-tauri | `cargo deny check` (new `deny.toml`) | passes. Also allows BSL-1.0 (clipboard-win/error-code via arboard on Windows) and CDLA-Permissive-2.0 (webpki-roots). Ignores the two uniffi notices plus RUSTSEC-2024-0370 (proc-macro-error via gtk-rs glib-macros 0.18, Tauri's Linux stack, build-time). **Not fixable here:** it goes away when Tauri moves to gtk-rs ≥ 0.19 / gtk4. |
| kestrove-desktop/src-tauri | `cargo deny check` (new `deny.toml`) | passes. Also allows BSL-1.0 (clipboard-win/error-code via arboard on Windows) and CDLA-Permissive-2.0 (webpki-roots). Ignores the basic-toml notice (as core) plus RUSTSEC-2024-0370 (proc-macro-error via gtk-rs glib-macros 0.18, Tauri's Linux stack, build-time). **Not fixable here:** it goes away when Tauri moves to gtk-rs ≥ 0.19 / gtk4. |
| kestrove-browser | `npm audit --omit=dev` | 0 vulnerabilities. Dev-only: 1 moderate, esbuild ≤ 0.24.2 dev-server CORS issue (GHSA-67mh-4wv8-2f99). It only matters for `esbuild serve`, which the build script doesn't use, and none of it ships. |
| kestrove-desktop | `npm audit --omit=dev` and `npm audit` | 0 vulnerabilities |
| kestrove-android | Gradle dependency verification | new `gradle/verification-metadata.xml` pins sha256 for all 388 components used by `assembleDebug test lint`. The Linux and Windows `aapt2` jars were added by hand: the macOS hash Gradle recorded matched dl.google.com. The 106 release-runtime artifacts were checked against OSV.dev: 0 advisories. |