From 8a16273025a7aae09478cfae2d4281b14e650d9e Mon Sep 17 00:00:00 2001 From: Adam Chalmers Date: Thu, 29 Oct 2026 06:29:52 -0700 Subject: [PATCH 1/3] Fix pulldown-cmark wikilink event amplification --- Cargo.lock | 4 ++-- Cargo.toml | 2 +- src/ml/copilot/ui.rs | 9 +++++++++ 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 68bf9315..198d1f40 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4101,9 +4101,9 @@ dependencies = [ [[package]] name = "pulldown-cmark" -version = "0.13.4" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags 2.13.0", "getopts", diff --git a/Cargo.toml b/Cargo.toml index 1961111e..d5b863ab 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -61,7 +61,7 @@ oauth2 = { version = "5.0.0", default-features = false } oauth2-reqwest = "0.1.0-alpha.3" open = "5.3.5" parse-display = "0.11.0" -pulldown-cmark = "0.13.4" +pulldown-cmark = "0.13.5" pulldown-cmark-to-cmark = "22.0.3" ratatui = { version = "0.30", default-features = false, features = [ "crossterm", diff --git a/src/ml/copilot/ui.rs b/src/ml/copilot/ui.rs index 647fbd4d..d1f7918f 100644 --- a/src/ml/copilot/ui.rs +++ b/src/ml/copilot/ui.rs @@ -312,6 +312,15 @@ mod tests { use super::*; + #[test] + fn empty_wikilink_labels_do_not_duplicate_following_text() { + // RUSTSEC-2026-0414: empty wikilink labels must not duplicate later events. + // Keep the input small so this regression also fails safely on vulnerable versions. + let md = format!("{}tail", "[[a|]] ".repeat(8)); + + assert_eq!(render_markdown_to_lines(&md), vec![format!("{}tail", " ".repeat(8))]); + } + fn empty_end_of_stream() -> kittycad::types::MlCopilotServerMessage { kittycad::types::MlCopilotServerMessage::EndOfStream { completed_at: None, From 1801cb1a29510708af36ddbdb06fc4ea64030c5f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 13:32:38 +0000 Subject: [PATCH 2/3] [dependabot skip] Automatically fix Nix hashes --- flake.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/flake.nix b/flake.nix index 42e4f703..94853995 100644 --- a/flake.nix +++ b/flake.nix @@ -76,7 +76,7 @@ version = cargoToml.package.version; src = ./.; - cargoHash = "sha256-dO3TKdU7yuO9aOBANTYU7UcjnRKXuRb2f3lzhYFgyKQ="; + cargoHash = "sha256-VfXgo74o37v/y+ggwFCw/MP/XmaSxu9HYStmDagVUFs="; doCheck = false; nativeBuildInputs = [pkgs.pkg-config]; From bc6f13335f03d63813832df01e02ea3c058b049b Mon Sep 17 00:00:00 2001 From: Adam Chalmers Date: Thu, 29 Oct 2026 06:33:55 -0700 Subject: [PATCH 3/3] Keep the security update dependency-only --- src/ml/copilot/ui.rs | 9 --------- 1 file changed, 9 deletions(-) diff --git a/src/ml/copilot/ui.rs b/src/ml/copilot/ui.rs index d1f7918f..647fbd4d 100644 --- a/src/ml/copilot/ui.rs +++ b/src/ml/copilot/ui.rs @@ -312,15 +312,6 @@ mod tests { use super::*; - #[test] - fn empty_wikilink_labels_do_not_duplicate_following_text() { - // RUSTSEC-2026-0414: empty wikilink labels must not duplicate later events. - // Keep the input small so this regression also fails safely on vulnerable versions. - let md = format!("{}tail", "[[a|]] ".repeat(8)); - - assert_eq!(render_markdown_to_lines(&md), vec![format!("{}tail", " ".repeat(8))]); - } - fn empty_end_of_stream() -> kittycad::types::MlCopilotServerMessage { kittycad::types::MlCopilotServerMessage::EndOfStream { completed_at: None,