mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-30 18:56:16 +00:00
Track remaining Dependabot transitive exceptions
This commit is contained in:
Brandon Schneider
parent
f3a09178e3
commit
d8616d2879
3 changed files with 32 additions and 64 deletions
63
5-Applications/parquet_compressor/Cargo.lock
generated
63
5-Applications/parquet_compressor/Cargo.lock
generated
|
|
@ -31,21 +31,6 @@ dependencies = [
|
|||
"memchr",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "alloc-no-stdlib"
|
||||
version = "2.0.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
|
||||
|
||||
[[package]]
|
||||
name = "alloc-stdlib"
|
||||
version = "0.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
|
||||
dependencies = [
|
||||
"alloc-no-stdlib",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "allocator-api2"
|
||||
version = "0.2.21"
|
||||
|
|
@ -402,27 +387,6 @@ version = "0.1.6"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
|
||||
|
||||
[[package]]
|
||||
name = "brotli"
|
||||
version = "8.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4bd8b9603c7aa97359dbd97ecf258968c95f3adddd6db2f7e7a5bef101c84560"
|
||||
dependencies = [
|
||||
"alloc-no-stdlib",
|
||||
"alloc-stdlib",
|
||||
"brotli-decompressor",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "brotli-decompressor"
|
||||
version = "5.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "874bb8112abecc98cbd6d81ea4fa7e94fb9449648c93cc89aa40c81c24d7de03"
|
||||
dependencies = [
|
||||
"alloc-no-stdlib",
|
||||
"alloc-stdlib",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bumpalo"
|
||||
version = "3.20.2"
|
||||
|
|
@ -803,7 +767,6 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
|
|||
dependencies = [
|
||||
"crc32fast",
|
||||
"miniz_oxide",
|
||||
"zlib-rs",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -1279,15 +1242,6 @@ version = "0.4.29"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
|
||||
|
||||
[[package]]
|
||||
name = "lz4_flex"
|
||||
version = "0.13.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
|
||||
dependencies = [
|
||||
"twox-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "malloc_buf"
|
||||
version = "0.0.6"
|
||||
|
|
@ -1493,20 +1447,15 @@ dependencies = [
|
|||
"arrow-schema",
|
||||
"arrow-select",
|
||||
"base64",
|
||||
"brotli",
|
||||
"bytes",
|
||||
"chrono",
|
||||
"flate2",
|
||||
"half",
|
||||
"hashbrown 0.17.1",
|
||||
"lz4_flex",
|
||||
"num-bigint",
|
||||
"num-integer",
|
||||
"num-traits",
|
||||
"paste",
|
||||
"seq-macro",
|
||||
"simdutf8",
|
||||
"snap",
|
||||
"thrift",
|
||||
"twox-hash",
|
||||
"zstd",
|
||||
|
|
@ -1838,12 +1787,6 @@ version = "1.15.1"
|
|||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
|
||||
|
||||
[[package]]
|
||||
name = "snap"
|
||||
version = "1.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
|
||||
|
||||
[[package]]
|
||||
name = "spirv"
|
||||
version = "0.3.0+sdk-1.3.268.0"
|
||||
|
|
@ -2494,12 +2437,6 @@ dependencies = [
|
|||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zlib-rs"
|
||||
version = "0.6.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513"
|
||||
|
||||
[[package]]
|
||||
name = "zmij"
|
||||
version = "1.0.21"
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ version = "0.1.0"
|
|||
edition = "2021"
|
||||
|
||||
[dependencies]
|
||||
parquet = "58.3"
|
||||
parquet = { version = "58.3", default-features = false, features = ["arrow", "zstd"] }
|
||||
arrow = "58.3"
|
||||
serde = { version = "1.0", features = ["derive"] }
|
||||
serde_json = "1.0"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,31 @@
|
|||
# Dependabot Alert Exceptions - 2026-05-12
|
||||
|
||||
This ledger records the remaining live Dependabot alerts after direct dependency updates were attempted. These are not silent ignores: each entry names the blocker chain, the attempted source fix, the local mitigation, and the unblock condition.
|
||||
|
||||
GitHub tracker: https://github.com/allaunthefox/Research-Stack/issues/6
|
||||
|
||||
## Dismissed As Tracked Transitive Exceptions
|
||||
|
||||
| Alerts | Manifest | Package | Blocker | Local action | Unblock condition |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| #41, #42, #44 | `4-Infrastructure/servo-fetch/Cargo.lock` | `ml-dsa` | `servo-script v0.1.0` requires `ml-dsa ^0.0.4`; patched `0.1.0-rc.5` does not satisfy the upstream constraint. | Verified the owner chain with `cargo tree -i ml-dsa --locked`; kept `servo-fetch` treated as an experimental rendered-fetch tool rather than a trusted cryptographic verifier. | Upgrade or vendor-patch Servo/servo-script onto an `ml-dsa >=0.1.0-rc.5` line. |
|
||||
| #43 | `4-Infrastructure/servo-fetch/Cargo.lock` | `rand` | `textnonce v1.0.0` requires `rand ^0.7` through `mime-multipart-hyper1 -> servo-script -> servo`. | Verified direct `rand 0.8.6` update is rejected by the transitive constraint; keep generated nonce behavior out of security-boundary claims for this tool. | Upgrade or replace the Servo multipart/textnonce chain with a `rand >=0.8.6` compatible path. |
|
||||
| #51 | `5-Applications/linear-native-tauri/Cargo.lock` | `glib` | Current Linux Tauri stack routes through `gtk v0.18` / `webkit2gtk v2.0.2`, which pins `glib v0.18.5`; direct `glib 0.20` update is rejected. | Verified the package is already on the latest compatible Tauri 2 line and that the dependency chain still pins `glib v0.18.5`; wrapper only navigates to Linear and does not call `VariantStrIter` directly. | Tauri/Wry/WebKitGTK stack moves to GTK/glib `>=0.20`, or this wrapper is replaced with a browser/PWA launcher outside the vulnerable Rust GTK path. |
|
||||
| #52 | `5-Applications/notion-native-tauri/Cargo.lock` | `glib` | Same GTK/WebKit/Tauri pin as the Linear wrapper. | Same as #51; wrapper only navigates to Notion and does not call `VariantStrIter` directly. | Same as #51. |
|
||||
| #61 | `5-Applications/parquet_compressor/Cargo.lock` | `thrift` | The latest `parquet v58.3.0` still depends on `thrift v0.17.0`; crates.io exposes no patched `thrift` release beyond `0.17.0`, matching Dependabot's `NO_PATCH` result. | Narrowed `parquet` to `default-features = false` with only `arrow` and `zstd`, removing unused Brotli/LZ4/Snappy/zlib codec crates from the lockfile while preserving `cargo check --locked`. | Apache Arrow/Parquet removes or patches the `thrift` dependency, or this tool switches to a non-Parquet metadata reader/writer. |
|
||||
|
||||
## Verification Commands
|
||||
|
||||
```bash
|
||||
gh api 'repos/allaunthefox/Research-Stack/dependabot/alerts?state=open&per_page=100' --paginate
|
||||
cd 4-Infrastructure/servo-fetch && cargo tree -i ml-dsa --locked && cargo tree -i rand@0.7.3 --locked
|
||||
cd 5-Applications/linear-native-tauri && cargo tree -i glib --locked
|
||||
cd 5-Applications/notion-native-tauri && cargo tree -i glib --locked
|
||||
cd 5-Applications/parquet_compressor && cargo tree -i thrift --locked && cargo check --locked
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- These dismissals should be revisited whenever `Cargo.lock` changes in the affected manifests.
|
||||
- A fresh Dependabot alert query is the source of truth; push banners can lag after a successful remediation.
|
||||
- The Parquet feature narrowing is a real source cleanup, but it does not remove the `thrift` advisory because the remaining dependency is structural in `parquet`.
|
||||
Loading…
Add table
Reference in a new issue