Skip to content

chore: cargo update to clear pulldown-cmark advisory - #441

Closed
scardracs wants to merge 1 commit into
OpenGamingCollective:mainfrom
scardracs:chore/cargo-update
Closed

scardracs wants to merge 1 commit into
OpenGamingCollective:mainfrom
scardracs:chore/cargo-update

Conversation

@scardracs

Copy link
Copy Markdown
Contributor

Summary

  • Refresh Cargo.lock with cargo update so pulldown-cmark moves to 0.13.6 (>= 0.13.5), clearing RUSTSEC-2026-0414 that was failing CI cargo audit.
  • Restore the missing trailing newline in asusd/src/aura_laptop/mod.rs so cargo fmt --check passes under the pinned rustc 1.93 toolchain.

Audit warnings (not fixed here)

After this update, cargo audit reports 0 vulnerabilities and 8 allowed warnings. They are not easy one-line fixes:

Crate Kind Why it stays
clipboard-win yanked gone after this update (5.4.1 → 5.4.3)
zbus_names / zvariant / zvariant_derive unmaintained Need zbus 6 migration (breaking, whole tree)
bincode unmaintained Transitive via Slint (typed-index-collections)
paste unmaintained Transitive via image codecs (pulp / rav1e) under Slint
rustybuzz / ttf-parser unmaintained Transitive via usvg / resvg under Slint
gettext-rs unsound Transitive via i-slint-core

Clearing those needs Slint and/or zbus major upgrades, not another lockfile bump.

Test plan

  • CI cargo audit job passes (no RUSTSEC-2026-0414)
  • cargo check --workspace / existing build jobs stay green
  • Local cargo audit → 0 vulnerabilities, 8 warnings
  • Local pulldown-cmark in lockfile is 0.13.6

RUSTSEC-2026-0414 requires pulldown-cmark >= 0.13.5; refresh
Cargo.lock so CI cargo audit passes again. Also restore the
missing trailing newline in aura_laptop so rustfmt --check
passes under the pinned 1.93 toolchain.

Signed-off-by: Marco Scardovi <scardracs@disroot.org>
@coderabbitai

coderabbitai Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 45aab452-825d-42f0-ab26-f6216e6e4b26
Commits

Reviewing files that changed from the base of the PR and between f537fca and a98e128.

Files ignored due to path filters: 1
  • Cargo.lock is excluded by !**/*.lock
Files selected for processing: 1
  • asusd/src/aura_laptop/mod.rs

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Recent review details
Context from checks skipped due to timeout: 3
  • GitHub Check: CodeRabbit
  • GitHub Check: cargo build --workspace (Ubuntu / rustc 1.93)
  • GitHub Check: cargo audit (Debian 13 / rustc 1.93)
Additional comments: 1
asusd/src/aura_laptop/mod.rs: 1

256-256: LGTM!

Summary

Summary by CodeRabbit

  • Release Notes
    • No user-visible changes are included in this update. The change does not alter app functionality or affect how features work.

The diff replaces a function’s closing brace with an identical brace. It does not change observable functionality.

Changes: Aura laptop module

Layer / File(s) Summary
Function closing brace
asusd/src/aura_laptop/mod.rs
The function’s closing brace is unchanged in effect.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested labels: fix, asusd

Suggested reviewers: 0ri0nexe, luytan

Merge Risk: Minimal · up to a98e1

No actionable merge-blocking risk was identified.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title clearly identifies the main change: updating Cargo dependencies to address the pulldown-cmark security advisory.
Description check Passed The description explains the lockfile update, security advisory, remaining audit warnings, and test plan. It omits the template's hardware and environment fields and does not provide an issue number, …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description explains the lockfile update, security advisory, remaining audit warnings, and test plan. It omits the template's hardware and environment fields and does not provide an issue number, but it is otherwise sufficiently complete and relevant.

Warning

Some tools did not complete. Review the errors below.

Clippy (1.99.0)

Clippy execution failed

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@coderabbitai coderabbitai Bot added asusd System Daemon / D-Bus fix Fix a bug or an issue labels Nov 2, 2026
@scardracs scardracs closed this Nov 2, 2026
@scardracs
scardracs deleted the chore/cargo-update branch November 2, 2026 11:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

asusd System Daemon / D-Bus fix Fix a bug or an issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant