e6e241746c
fix(deps): audit-driven updates across npm, pnpm, cargo, pip
...
JavaScript lockfiles:
- bezier-kit: vitest 3.2.4→3.2.6, @babel/core 7.29.0→7.29.7,
esbuild 0.27.7→0.27.2, vite 6.4.2→6.4.3
- parametric-learn: vite 8.0.10→8.0.16, form-data 4.0.5→4.0.6
- lytenyte-storage + cluster-dashboard/frontend: vite 6.4.2→6.4.3
Cargo lockfiles:
- leechy-py: pyo3 0.28.3→0.29.0 (RUSTSEC-2026-0176/0177)
- stract: rkyv 0.7.45→0.7.46 (RUSTSEC-2026-0001)
- rs-surface, ene-rds, ene-session-sync: postgres updates
- shared-data/namidb: aws-lc-sys 0.37.1→0.41.0
Python:
- whoogle-search: cryptography 46.0.7→48.0.1 (GHSA-537c-gmf6-5ccf)
Remaining blocked advisories documented in commit body metadata;
require upstream releases or source-level migrations.
2026-06-20 19:00:38 -05:00
Brandon Schneider
8e5efbe11f
Fix Dependabot vulns: update sqlx 0.7->0.8.6, add ene-rds Cargo.lock
...
Security fixes:
- rds_probe: bump sqlx 0.7.4 -> 0.8.6 (GHSA-xmrp-424f-vfpx MEDIUM)
Also removes transitive rustls-webpki 0.101.7 dependency chain,
fixing GHSA-82j2-j2ch-gfr8 (HIGH), GHSA-xgp8-3hg3-c2mh,
GHSA-965h-392x-2mh5 (LOW) in this workspace.
- ene-rds already has rustls-webpki 0.103.13 (patched); commit its
Cargo.lock for reproducible builds.
Generated with [Devin](https://cli.devin.ai/docs )
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-05-19 08:09:34 +00:00