From d8616d28797d04c1134b423e8f13c614615fa9bf Mon Sep 17 00:00:00 2001 From: Brandon Schneider Date: Mon, 11 May 2026 23:45:53 -0500 Subject: [PATCH] Track remaining Dependabot transitive exceptions --- 5-Applications/parquet_compressor/Cargo.lock | 63 ------------------- 5-Applications/parquet_compressor/Cargo.toml | 2 +- .../dependabot-alert-exceptions-2026-05-12.md | 31 +++++++++ 3 files changed, 32 insertions(+), 64 deletions(-) create mode 100644 6-Documentation/security/dependabot-alert-exceptions-2026-05-12.md diff --git a/5-Applications/parquet_compressor/Cargo.lock b/5-Applications/parquet_compressor/Cargo.lock index 229f6d30..2d1d98f5 100644 --- a/5-Applications/parquet_compressor/Cargo.lock +++ b/5-Applications/parquet_compressor/Cargo.lock @@ -31,21 +31,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "alloc-no-stdlib" -version = "2.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3" - -[[package]] -name = "alloc-stdlib" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece" -dependencies = [ - "alloc-no-stdlib", -] - [[package]] name = "allocator-api2" version = "0.2.21" @@ -402,27 +387,6 @@ version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a" -[[package]] -name = "brotli" -version = "8.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4bd8b9603c7aa97359dbd97ecf258968c95f3adddd6db2f7e7a5bef101c84560" -dependencies = [ - "alloc-no-stdlib", - "alloc-stdlib", - "brotli-decompressor", -] - -[[package]] -name = "brotli-decompressor" -version = "5.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "874bb8112abecc98cbd6d81ea4fa7e94fb9449648c93cc89aa40c81c24d7de03" -dependencies = [ - "alloc-no-stdlib", - "alloc-stdlib", -] - [[package]] name = "bumpalo" version = "3.20.2" @@ -803,7 +767,6 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c" dependencies = [ "crc32fast", "miniz_oxide", - "zlib-rs", ] [[package]] @@ -1279,15 +1242,6 @@ version = "0.4.29" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897" -[[package]] -name = "lz4_flex" -version = "0.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e" -dependencies = [ - "twox-hash", -] - [[package]] name = "malloc_buf" version = "0.0.6" @@ -1493,20 +1447,15 @@ dependencies = [ "arrow-schema", "arrow-select", "base64", - "brotli", "bytes", "chrono", - "flate2", "half", "hashbrown 0.17.1", - "lz4_flex", "num-bigint", "num-integer", "num-traits", "paste", "seq-macro", - "simdutf8", - "snap", "thrift", "twox-hash", "zstd", @@ -1838,12 +1787,6 @@ version = "1.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" -[[package]] -name = "snap" -version = "1.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b" - [[package]] name = "spirv" version = "0.3.0+sdk-1.3.268.0" @@ -2494,12 +2437,6 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "zlib-rs" -version = "0.6.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513" - [[package]] name = "zmij" version = "1.0.21" diff --git a/5-Applications/parquet_compressor/Cargo.toml b/5-Applications/parquet_compressor/Cargo.toml index 7d18e979..b147c766 100644 --- a/5-Applications/parquet_compressor/Cargo.toml +++ b/5-Applications/parquet_compressor/Cargo.toml @@ -4,7 +4,7 @@ version = "0.1.0" edition = "2021" [dependencies] -parquet = "58.3" +parquet = { version = "58.3", default-features = false, features = ["arrow", "zstd"] } arrow = "58.3" serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" diff --git a/6-Documentation/security/dependabot-alert-exceptions-2026-05-12.md b/6-Documentation/security/dependabot-alert-exceptions-2026-05-12.md new file mode 100644 index 00000000..74057214 --- /dev/null +++ b/6-Documentation/security/dependabot-alert-exceptions-2026-05-12.md @@ -0,0 +1,31 @@ +# Dependabot Alert Exceptions - 2026-05-12 + +This ledger records the remaining live Dependabot alerts after direct dependency updates were attempted. These are not silent ignores: each entry names the blocker chain, the attempted source fix, the local mitigation, and the unblock condition. + +GitHub tracker: https://github.com/allaunthefox/Research-Stack/issues/6 + +## Dismissed As Tracked Transitive Exceptions + +| Alerts | Manifest | Package | Blocker | Local action | Unblock condition | +| --- | --- | --- | --- | --- | --- | +| #41, #42, #44 | `4-Infrastructure/servo-fetch/Cargo.lock` | `ml-dsa` | `servo-script v0.1.0` requires `ml-dsa ^0.0.4`; patched `0.1.0-rc.5` does not satisfy the upstream constraint. | Verified the owner chain with `cargo tree -i ml-dsa --locked`; kept `servo-fetch` treated as an experimental rendered-fetch tool rather than a trusted cryptographic verifier. | Upgrade or vendor-patch Servo/servo-script onto an `ml-dsa >=0.1.0-rc.5` line. | +| #43 | `4-Infrastructure/servo-fetch/Cargo.lock` | `rand` | `textnonce v1.0.0` requires `rand ^0.7` through `mime-multipart-hyper1 -> servo-script -> servo`. | Verified direct `rand 0.8.6` update is rejected by the transitive constraint; keep generated nonce behavior out of security-boundary claims for this tool. | Upgrade or replace the Servo multipart/textnonce chain with a `rand >=0.8.6` compatible path. | +| #51 | `5-Applications/linear-native-tauri/Cargo.lock` | `glib` | Current Linux Tauri stack routes through `gtk v0.18` / `webkit2gtk v2.0.2`, which pins `glib v0.18.5`; direct `glib 0.20` update is rejected. | Verified the package is already on the latest compatible Tauri 2 line and that the dependency chain still pins `glib v0.18.5`; wrapper only navigates to Linear and does not call `VariantStrIter` directly. | Tauri/Wry/WebKitGTK stack moves to GTK/glib `>=0.20`, or this wrapper is replaced with a browser/PWA launcher outside the vulnerable Rust GTK path. | +| #52 | `5-Applications/notion-native-tauri/Cargo.lock` | `glib` | Same GTK/WebKit/Tauri pin as the Linear wrapper. | Same as #51; wrapper only navigates to Notion and does not call `VariantStrIter` directly. | Same as #51. | +| #61 | `5-Applications/parquet_compressor/Cargo.lock` | `thrift` | The latest `parquet v58.3.0` still depends on `thrift v0.17.0`; crates.io exposes no patched `thrift` release beyond `0.17.0`, matching Dependabot's `NO_PATCH` result. | Narrowed `parquet` to `default-features = false` with only `arrow` and `zstd`, removing unused Brotli/LZ4/Snappy/zlib codec crates from the lockfile while preserving `cargo check --locked`. | Apache Arrow/Parquet removes or patches the `thrift` dependency, or this tool switches to a non-Parquet metadata reader/writer. | + +## Verification Commands + +```bash +gh api 'repos/allaunthefox/Research-Stack/dependabot/alerts?state=open&per_page=100' --paginate +cd 4-Infrastructure/servo-fetch && cargo tree -i ml-dsa --locked && cargo tree -i rand@0.7.3 --locked +cd 5-Applications/linear-native-tauri && cargo tree -i glib --locked +cd 5-Applications/notion-native-tauri && cargo tree -i glib --locked +cd 5-Applications/parquet_compressor && cargo tree -i thrift --locked && cargo check --locked +``` + +## Notes + +- These dismissals should be revisited whenever `Cargo.lock` changes in the affected manifests. +- A fresh Dependabot alert query is the source of truth; push banners can lag after a successful remediation. +- The Parquet feature narrowing is a real source cleanup, but it does not remove the `thrift` advisory because the remaining dependency is structural in `parquet`.