Repository navigation
fix: Patch Rust and npm security advisories - #200
Merged
Merged
Conversation
The amd64 and arm64 image builds share one cargo registry cache mount. When both unpack the same crate at once, one fails with "File exists" on .cargo-ok, which is what turned the tokio and rustls security bumps red. A locked mount makes the two builds take turns.
Eleven high advisories were open across the Rust and npm lockfiles. ui/Cargo.lock was an orphan of the cargo workspace, which resolves from the root Cargo.lock, so it is removed rather than patched. - quinn-proto 0.11.14 to 0.11.15 - openssl 0.10.78 to 0.10.79 - rustls-webpki 0.103.13 to 0.103.16, via rustls 0.23.46 - tokio 1.52.1 to 1.53.3 - picomatch 2.3.1 to 2.3.2 and source-map-js 1.2.1 to 1.2.2 in ui - braces and image-size stay: braces is withdrawn with no fix, and image-size 2 breaks appdmg, which has no newer release
kevwilliams
reviewed
Oct 25, 2026
kevwilliams
left a comment
kevwilliams
left a comment
Contributor
There was a problem hiding this comment.
Hold: the bundle (ubuntu-latest) check fails on this head.
- Fix or re-run the failing job before merge: https://github.com/datum-cloud/app/actions/runs/40162144618/job/121075748135
Untagged builds are versioned as the date plus the short commit SHA. A SHA of seven digits starting with zero is an invalid numeric pre-release identifier, so cargo rejects the manifest and the bundle job fails on that commit. A leading letter makes every SHA a valid identifier.
scotwells
approved these changes
Oct 25, 2026
kevwilliams
reviewed
Oct 25, 2026
kevwilliams
left a comment
kevwilliams
left a comment
Contributor
There was a problem hiding this comment.
Diff exceeds auto-review threshold (8168 lines). Flagging for human review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Eleven high advisories were open in the app's Rust and npm lockfiles, and this clears nine of them while also bumping tokio and rustls for the two Renovate PRs. Two stay open, one withdrawn without a fix and one needing a major version that breaks the DMG tool.
The Renovate PRs failed the image build because two architecture builds raced on one cargo cache, now locked. Bundle versions also gain a letter before the commit hash, since an all-digit hash with a leading zero broke the bundle job.
Test plan