From ca5ed338f795c60d0f1ddad15cad868929eda67c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 23:19:09 +0000 Subject: [PATCH 1/8] docs: add estate-wide upstream dependency watch list Records dependency advisories that no estate repository can clear alone because the fix must ship upstream first, with the release that unblocks each one so a re-check is a single crates.io lookup. Watching: - W1: zvariant, zbus_names, zvariant_derive unmaintained (RUSTSEC-2026-0370/0371/0372), via eframe -> accesskit -> atspi -> zbus 5. Unblocks when atspi moves to zbus 6. - W2: ttf-parser unmaintained (RUSTSEC-2026-0192), via winit -> sctk-adwaita -> ab_glyph. - W3: unsafe-libyaml unmaintained (RUSTSEC-2024-0449), via serde_yaml. Locally fixable by moving to serde-saphyr, listed because it recurs. Resolved: - R1: quick-xml 0.38 (RUSTSEC-2026-0194/0195), cleared by a lockfile bump of zbus_xml to 5.2.1 and wayland-scanner to 0.31.11. Kept as the worked example of checking the newest compatible release before planning an upstream fix. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 149 ++++++++++++++++++++++++++++ 1 file changed, 149 insertions(+) create mode 100644 docs/UPSTREAM-DEPENDENCY-WATCH.adoc diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc new file mode 100644 index 00000000..0dd92c94 --- /dev/null +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -0,0 +1,149 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Upstream dependency watch +:toc: +:toclevels: 2 + +Estate-wide list of dependency advisories that no estate repository can clear +on its own, because the fix has to be released upstream first. Each entry +names the upstream release that unblocks it, so a re-check is one lookup +rather than a fresh investigation. + +== Scope and neighbours + +[cols="1,2"] +|=== +|Lives here |An advisory whose fix is blocked on an upstream release, and that +can affect more than one estate repository. +|Not here |An advisory a repository can fix itself with a lockfile bump or a +dependency swap. Fix it at its source in that repository. Entries below that +turn out to be locally fixable say so and move to *Resolved* once fixed. +|Per-repo counts |A repository that tolerates one of these advisories records +the shortfall in its own Debtfile (`docs/DEBTFILE-SPEC.adoc`). This page holds +the shared upstream trigger, not the per-repo integer. +|Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. +|=== + +== How to re-check an entry + +. Look up the *Unblocking release* crate on crates.io and read the dependency + requirement of its newest release. ++ +[source,bash] +---- +crate=atspi-common +v=$(curl -sS -A "upstream-watch" "https://crates.io/api/v1/crates/$crate" | jq -r .crate.max_stable_version) +curl -sS -A "upstream-watch" "https://crates.io/api/v1/crates/$crate/$v/dependencies" \ + | jq -r '.dependencies[] | select(.kind != "dev") | "\(.crate_id) \(.req)"' +---- +. Before assuming upstream is stuck, try the newest *semver-compatible* + release in the affected repository. The quick-xml entry under *Resolved* was + planned as a three-repository upstream fix, and turned out to need only + `cargo update -p zbus_xml --precise 5.2.1`. ++ +[source,bash] +---- +cargo update -p --precise +cargo audit +---- +. Find which estate repositories carry a crate, from a directory of clones: ++ +[source,bash] +---- +for lock in */Cargo.lock; do + grep -q '^name = "zvariant"$' "$lock" && echo "${lock%/Cargo.lock}" +done +---- + +== Watching + +=== W1: zbus 5 sub-crates unmaintained + +[cols="1,3"] +|=== +|Advisories |RUSTSEC-2026-0370 (`zvariant`), RUSTSEC-2026-0371 (`zbus_names`), +RUSTSEC-2026-0372 (`zvariant_derive`). All informational (`unmaintained`), +issued 2026-10-16. `cargo audit` warns but exits 0. +|Cause |zbus 6 folded these crates into `zbus` itself (the `wire` module). +The 5.x crates get no further releases. Upstream notice: +https://github.com/z-galaxy/zbus/issues/2043 +|Path in |`eframe` -> `egui-winit` -> `accesskit_winit` -> `accesskit_unix` -> +`accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. Linux +accessibility (AT-SPI) support, so any eframe/egui GUI on Linux carries it. +|Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still +require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and +`zbus ^5.19`. +|Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, then +`accesskit_atspi_common` and `accesskit_unix` following it, then an +`accesskit_winit` and `egui-winit` / `eframe` release that takes those. +|Action when cleared |Bump `eframe` in each affected repository. This is a +manifest change and may carry egui API breaks, so build and test the GUI +feature before merging. +|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. +Default builds are unaffected. `hyperpolymath/echidna` is not affected. +This is not a full census. +|=== + +=== W2: `ttf-parser` unmaintained + +[cols="1,3"] +|=== +|Advisory |RUSTSEC-2026-0192, informational (`unmaintained`), issued +2026-06-28. Upstream notice: https://github.com/harfbuzz/ttf-parser/issues/217 +|Path in |`eframe` -> `winit` -> `sctk-adwaita` -> `ab_glyph` -> +`owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window +decoration path. +|Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires +`owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory +names `skrifa` as the maintained alternative. +|Unblocking release |`ab_glyph` / `owned_ttf_parser` moving to `skrifa`, or a +`sctk-adwaita` release that drops `ab_glyph`, then a `winit` release taking it. +|Action when cleared |`cargo update` in each affected repository, or an +`eframe` bump if `winit` moves a minor version. +|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. +This is not a full census. +|=== + +=== W3: `unsafe-libyaml` unmaintained, via `serde_yaml` + +[cols="1,3"] +|=== +|Advisory |RUSTSEC-2024-0449, informational (`unmaintained`). The upstream +repository was archived on 2024-03-25. +|Path in |`serde_yaml` 0.9 (itself deprecated) -> `unsafe-libyaml`, a c2rust +translation of libyaml in unsafe Rust. +|Blocked on |Nothing upstream. `serde_yaml` will not be revived, so waiting +does not clear this. It sits on this page because it is likely to recur across +the estate's Rust repositories. +|Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory +suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, +which still depends on `unsafe-libyaml`. +|Known affected |`hyperpolymath/panic-attack` declares `serde_yaml = "0.9"` +directly. This is not a full census. +|=== + +== Resolved + +=== R1: `quick-xml` 0.38 denial-of-service advisories (resolved 2026-10-19) + +[cols="1,3"] +|=== +|Advisories |RUSTSEC-2026-0194 (quadratic attribute checking) and +RUSTSEC-2026-0195 (unbounded namespace allocation), fixed in `quick-xml` +0.41.0. These were vulnerabilities, so `cargo audit` failed. +|Paths in |`zbus_xml` 5.1.0 (via the same AT-SPI chain as W1), and +`wayland-scanner` before 0.31.11. +|Fix a|Lockfile-only. `zbus_xml` 5.2.0 and later dropped `quick-xml` for +`winnow`, and `zbus-lockstep` 0.5.2 accepts `zbus_xml ^5.0.2`. +`wayland-scanner` 0.31.11 moved to `quick-xml` 0.41. + +[source,bash] +---- +cargo update -p zbus_xml --precise 5.2.1 +cargo update -p wayland-scanner +---- +|Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. +|Estate follow-up |Any other Rust repository whose lockfile still holds +`quick-xml` 0.38 or 0.39 fails `cargo audit` for the same reason and takes the +same fix. +|=== From e2a2dcb3b5d586b85bac2f071cf2f7371fa04d30 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 00:24:31 +0000 Subject: [PATCH 2/8] docs: clarify dependency watch gates and local remediation --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 30 ++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 0dd92c94..32bd5739 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -6,7 +6,7 @@ Estate-wide list of dependency advisories that no estate repository can clear on its own, because the fix has to be released upstream first. Each entry -names the upstream release that unblocks it, so a re-check is one lookup +names the upstream releases that unblock it, so a re-check follows a known chain rather than a fresh investigation. == Scope and neighbours @@ -17,17 +17,22 @@ rather than a fresh investigation. can affect more than one estate repository. |Not here |An advisory a repository can fix itself with a lockfile bump or a dependency swap. Fix it at its source in that repository. Entries below that -turn out to be locally fixable say so and move to *Resolved* once fixed. +turn out to be locally fixable move to *Local remediation*, then to *Resolved* +once fixed. |Per-repo counts |A repository that tolerates one of these advisories records -the shortfall in its own Debtfile (`docs/DEBTFILE-SPEC.adoc`). This page holds +the shortfall in its own Debtfile (`.machine_readable/Debtfile.a2ml`). This page holds the shared upstream trigger, not the per-repo integer. |Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. |=== == How to re-check an entry -. Look up the *Unblocking release* crate on crates.io and read the dependency - requirement of its newest release. +. Look up every crate in the *Unblocking release* chain on crates.io and read + the dependency requirements of each crate's newest release. For W1, check + `atspi-common`, `atspi`, `accesskit_atspi_common`, `accesskit_unix`, + `accesskit_winit`, `egui-winit`, and `eframe`. Repeat the lookup below for + each gate; consider the entry unblocked only when every gate's newest release + accepts the fixed dependencies through the entire chain. + [source,bash] ---- @@ -50,8 +55,9 @@ cargo audit + [source,bash] ---- +crate=zvariant for lock in */Cargo.lock; do - grep -q '^name = "zvariant"$' "$lock" && echo "${lock%/Cargo.lock}" + grep -q "^name = \"$crate\"$" "$lock" && echo "${lock%/Cargo.lock}" done ---- @@ -104,6 +110,8 @@ names `skrifa` as the maintained alternative. This is not a full census. |=== +== Local remediation + === W3: `unsafe-libyaml` unmaintained, via `serde_yaml` [cols="1,3"] @@ -112,9 +120,9 @@ This is not a full census. repository was archived on 2024-03-25. |Path in |`serde_yaml` 0.9 (itself deprecated) -> `unsafe-libyaml`, a c2rust translation of libyaml in unsafe Rust. -|Blocked on |Nothing upstream. `serde_yaml` will not be revived, so waiting -does not clear this. It sits on this page because it is likely to recur across -the estate's Rust repositories. +|Status |Locally remediable; no upstream release is needed. `serde_yaml` will +not be revived, so waiting does not clear this. Move to *Resolved* once the +replacement is applied in the affected repository. |Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. @@ -144,6 +152,6 @@ cargo update -p wayland-scanner ---- |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds -`quick-xml` 0.38 or 0.39 fails `cargo audit` for the same reason and takes the -same fix. +`quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same +reason and takes the same fix. |=== From e64d6bc23755618f4055e9c3f6667921fa249755 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:26:57 +0000 Subject: [PATCH 3/8] docs: keep watch-list debt out of A2ML, scope W1 and W2 to their features Review follow-ups on the upstream dependency watch list: - Per-repo counts no longer point at .machine_readable/Debtfile.a2ml. A2ML is retired and must not gain new entries, and the Debtfile has no deed mapping yet, so the page now says not to record these advisories there. - W1: the zbus 5 chain is present only with the `accesskit` feature, which eframe enables by default and egui-winit leaves opt-in. Building eframe without `accesskit` drops the chain at the cost of screen-reader support; recorded as a local workaround. - W2: sctk-adwaita and ab_glyph come from winit's `wayland-csd-adwaita`, enabled through eframe's default `winit/default`. Disabling eframe's defaults and re-enabling the needed features drops ttf-parser at the cost of Adwaita client-side decorations; recorded as a local workaround. Both workarounds were checked by resolving eframe 0.36.2 with each feature set: without `accesskit` the lockfile holds no zvariant, zbus, atspi-common or accesskit_unix; without `winit/default` it holds no ttf-parser, sctk-adwaita or ab_glyph. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 32bd5739..a5957d36 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -19,9 +19,10 @@ can affect more than one estate repository. dependency swap. Fix it at its source in that repository. Entries below that turn out to be locally fixable move to *Local remediation*, then to *Resolved* once fixed. -|Per-repo counts |A repository that tolerates one of these advisories records -the shortfall in its own Debtfile (`.machine_readable/Debtfile.a2ml`). This page holds -the shared upstream trigger, not the per-repo integer. +|Per-repo counts |This page holds the shared upstream trigger, not a per-repo +count. Do not record these advisories in a new `Debtfile.a2ml` entry. The +Debtfile format (`docs/DEBTFILE-SPEC.adoc`) is A2ML, which is retired, and no +deed mapping for it exists yet. |Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. |=== @@ -74,8 +75,13 @@ issued 2026-10-16. `cargo audit` warns but exits 0. The 5.x crates get no further releases. Upstream notice: https://github.com/z-galaxy/zbus/issues/2043 |Path in |`eframe` -> `egui-winit` -> `accesskit_winit` -> `accesskit_unix` -> -`accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. Linux -accessibility (AT-SPI) support, so any eframe/egui GUI on Linux carries it. +`accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. This is +Linux screen-reader (AT-SPI) support. It is present only when the `accesskit` +feature is on. That feature is in `eframe`'s default set, but opt-in for +standalone `egui-winit`. +|Local workaround |Building `eframe` without its `accesskit` feature drops the +whole chain, at the cost of screen-reader support. Prefer waiting for the +upstream release unless the advisory must clear sooner. |Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and `zbus ^5.19`. @@ -98,7 +104,12 @@ This is not a full census. 2026-06-28. Upstream notice: https://github.com/harfbuzz/ttf-parser/issues/217 |Path in |`eframe` -> `winit` -> `sctk-adwaita` -> `ab_glyph` -> `owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window -decoration path. +decoration path. It comes from `winit`'s `wayland-csd-adwaita` feature, which +`eframe`'s default `winit/default` feature turns on. +|Local workaround |Disable `eframe`'s default features and re-enable the ones +the application needs (for example `wayland`, `x11`, `accesskit` and a renderer) +without `winit/default`. Wayland windows then lose Adwaita client-side +decorations on compositors that do not draw server-side decorations. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory names `skrifa` as the maintained alternative. From 644652ce7ceb3799de514f8b2fc363ae9a420db8 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:35:04 +0000 Subject: [PATCH 4/8] docs: scope Resolved, audit reach and the quick-xml follow-up Second review round on the upstream dependency watch list: - Define *Resolved* as clear in every repository checked so far, not estate-wide, matching the "not a full census" caveat. W3 resolves only once every known affected repository is fixed. - W1 and W2: an opt-in feature limits which binaries compile the chain, but `cargo audit` reads Cargo.lock, which Cargo resolves with every feature on, so the audit reports the advisory on every build. - W2 workaround: Cargo merges features across the graph, so it holds only if nothing else turns `winit/default` back on; check with `cargo tree -e features -i sctk-adwaita`. - R1: the two update commands fix only the zbus_xml and wayland-scanner parents; run `cargo tree -i quick-xml@` first. Both cargo tree commands were run: the sctk-adwaita check finds the crate under eframe defaults and nothing under the workaround feature set; the quick-xml check on panic-attack's pre-fix lockfile names zbus_xml 5.1.0 as the parent. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index a5957d36..b3210694 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -23,6 +23,8 @@ once fixed. count. Do not record these advisories in a new `Debtfile.a2ml` entry. The Debtfile format (`docs/DEBTFILE-SPEC.adoc`) is A2ML, which is retired, and no deed mapping for it exists yet. +|What *Resolved* means |Clear in every repository checked so far. It is not an +estate-wide claim, because *Known affected* is not a full census. |Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. |=== @@ -91,8 +93,11 @@ require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and |Action when cleared |Bump `eframe` in each affected repository. This is a manifest change and may carry egui API breaks, so build and test the GUI feature before merging. -|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. -Default builds are unaffected. `hyperpolymath/echidna` is not affected. +|Known affected |`hyperpolymath/panic-attack`. Only its opt-in `gui` feature +compiles the chain into a binary. Its `cargo audit` still reports the +advisories on every build, because the audit reads `Cargo.lock` and Cargo +resolves the lockfile with every feature on. `hyperpolymath/echidna` is not +affected. This is not a full census. |=== @@ -109,7 +114,11 @@ decoration path. It comes from `winit`'s `wayland-csd-adwaita` feature, which |Local workaround |Disable `eframe`'s default features and re-enable the ones the application needs (for example `wayland`, `x11`, `accesskit` and a renderer) without `winit/default`. Wayland windows then lose Adwaita client-side -decorations on compositors that do not draw server-side decorations. +decorations on compositors that do not draw server-side decorations. This works +only if no other dependency turns `winit/default` back on, since Cargo merges +features across the dependency graph. Confirm that +`cargo tree -e features -i sctk-adwaita` finds no `sctk-adwaita` before relying +on it. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory names `skrifa` as the maintained alternative. @@ -117,7 +126,8 @@ names `skrifa` as the maintained alternative. `sctk-adwaita` release that drops `ab_glyph`, then a `winit` release taking it. |Action when cleared |`cargo update` in each affected repository, or an `eframe` bump if `winit` moves a minor version. -|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. +|Known affected |`hyperpolymath/panic-attack`, through its opt-in `gui` +feature. As with W1, its `cargo audit` reports the advisory on every build. This is not a full census. |=== @@ -133,7 +143,7 @@ repository was archived on 2024-03-25. translation of libyaml in unsafe Rust. |Status |Locally remediable; no upstream release is needed. `serde_yaml` will not be revived, so waiting does not clear this. Move to *Resolved* once the -replacement is applied in the affected repository. +replacement is applied in every known affected repository. |Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. @@ -164,5 +174,8 @@ cargo update -p wayland-scanner |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds `quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same -reason and takes the same fix. +reason. Run `cargo tree -i quick-xml@` first. The two commands above +fix it only when the parent is `zbus_xml` or `wayland-scanner`. A direct +dependency needs its requirement in `Cargo.toml` raised, and any other parent +needs that parent upgraded. |=== From 5dcee79a1ff88986dedb7288787ff8927a615827 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:41:45 +0000 Subject: [PATCH 5/8] docs: correct zbus 6 targets and advisory dates, link the watch list Third review round on the upstream dependency watch list: - W1 cause: only zvariant became zbus 6's `wire` module; zbus_names became the `names` module and zbus now provides the zvariant_derive macros (RUSTSEC-2026-0370/0371/0372 texts). - W1 and W2 dates are the RustSec `date` field, which is the report date, so label them "reported" rather than "issued". - Link the watch list from 3-practice/SECURITY-ADVISORIES.adoc so it is reachable from the existing advisory log. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- 3-practice/SECURITY-ADVISORIES.adoc | 3 +++ docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 10 ++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/3-practice/SECURITY-ADVISORIES.adoc b/3-practice/SECURITY-ADVISORIES.adoc index 28b6a55a..b793b44c 100644 --- a/3-practice/SECURITY-ADVISORIES.adoc +++ b/3-practice/SECURITY-ADVISORIES.adoc @@ -10,6 +10,9 @@ Triaged record of open / deferred / closed Dependabot advisories against `hyperpolymath/standards`. Updated whenever an advisory is resolved or a deferral is re-evaluated. +Estate-wide advisories that wait on an upstream release are tracked in +link:../docs/UPSTREAM-DEPENDENCY-WATCH.adoc[the upstream dependency watch]. + == Closed === GHSA-xgp8-3hg3-c2mh + GHSA-965h-392x-2mh5 (rustls-webpki, low, 2026-04-18) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index b3210694..8ff5eeb6 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -72,9 +72,11 @@ done |=== |Advisories |RUSTSEC-2026-0370 (`zvariant`), RUSTSEC-2026-0371 (`zbus_names`), RUSTSEC-2026-0372 (`zvariant_derive`). All informational (`unmaintained`), -issued 2026-10-16. `cargo audit` warns but exits 0. -|Cause |zbus 6 folded these crates into `zbus` itself (the `wire` module). -The 5.x crates get no further releases. Upstream notice: +reported 2026-10-16. `cargo audit` warns but exits 0. +|Cause |zbus 6 folded these crates into `zbus` itself. `zvariant` became the +`wire` module, `zbus_names` became the `names` module, and `zbus` now provides +the `zvariant_derive` macros. The 5.x crates get no further releases. Upstream +notice: https://github.com/z-galaxy/zbus/issues/2043 |Path in |`eframe` -> `egui-winit` -> `accesskit_winit` -> `accesskit_unix` -> `accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. This is @@ -105,7 +107,7 @@ This is not a full census. [cols="1,3"] |=== -|Advisory |RUSTSEC-2026-0192, informational (`unmaintained`), issued +|Advisory |RUSTSEC-2026-0192, informational (`unmaintained`), reported 2026-06-28. Upstream notice: https://github.com/harfbuzz/ttf-parser/issues/217 |Path in |`eframe` -> `winit` -> `sctk-adwaita` -> `ab_glyph` -> `owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window From b56345334ce04f75f31e752369835444f42fad42 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:47:53 +0000 Subject: [PATCH 6/8] docs: recurse the lockfile census, check all targets, cover egui-winit Fourth review round on the upstream dependency watch list: - The estate census loop now recurses into each clone, so repositories that keep Rust workspaces below the root (standards has seven nested Cargo.lock files) are no longer skipped. - Every cargo tree check uses `--target all --workspace`; by default cargo tree shows only the host platform and current member, so a Linux-only dependency can look absent on another host. - W1 workaround and bump action name the directly depended-on crate, `eframe` or a standalone `egui-winit`. Checked: the recursive loop finds nested lockfiles such as echidna/fuzz/Cargo.lock; both cargo tree commands with the new flags resolve against eframe 0.36.2. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 35 +++++++++++++++++++---------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 8ff5eeb6..f3f23bd7 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -54,15 +54,23 @@ curl -sS -A "upstream-watch" "https://crates.io/api/v1/crates/$crate/$v/dependen cargo update -p --precise cargo audit ---- -. Find which estate repositories carry a crate, from a directory of clones: +. Find which estate repositories carry a crate, from a directory of clones. + The search recurses, because some repositories keep their Rust workspaces + below the root. Each match prints the lockfile path, which starts with the + repository name. + [source,bash] ---- crate=zvariant -for lock in */Cargo.lock; do - grep -q "^name = \"$crate\"$" "$lock" && echo "${lock%/Cargo.lock}" +for repo in */; do + find "$repo" -name Cargo.lock -not -path '*/target/*' \ + -exec grep -l "^name = \"$crate\"$" {} + done ---- +. Run every `cargo tree` check on this page with `--target all --workspace`. + By default `cargo tree` shows only the host platform and the current + workspace member, so a Linux-only dependency can look absent on another + host. == Watching @@ -83,18 +91,19 @@ https://github.com/z-galaxy/zbus/issues/2043 Linux screen-reader (AT-SPI) support. It is present only when the `accesskit` feature is on. That feature is in `eframe`'s default set, but opt-in for standalone `egui-winit`. -|Local workaround |Building `eframe` without its `accesskit` feature drops the -whole chain, at the cost of screen-reader support. Prefer waiting for the -upstream release unless the advisory must clear sooner. +|Local workaround |Turn off the `accesskit` feature on whichever crate the +repository depends on directly: `eframe`, or `egui-winit` when it is used on +its own. That drops the whole chain, at the cost of screen-reader support. +Prefer waiting for the upstream release unless the advisory must clear sooner. |Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and `zbus ^5.19`. |Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, then `accesskit_atspi_common` and `accesskit_unix` following it, then an `accesskit_winit` and `egui-winit` / `eframe` release that takes those. -|Action when cleared |Bump `eframe` in each affected repository. This is a -manifest change and may carry egui API breaks, so build and test the GUI -feature before merging. +|Action when cleared |Bump the crate each affected repository depends on +directly, `eframe` or `egui-winit`. This is a manifest change and may carry +egui API breaks, so build and test the GUI feature before merging. |Known affected |`hyperpolymath/panic-attack`. Only its opt-in `gui` feature compiles the chain into a binary. Its `cargo audit` still reports the advisories on every build, because the audit reads `Cargo.lock` and Cargo @@ -119,7 +128,8 @@ without `winit/default`. Wayland windows then lose Adwaita client-side decorations on compositors that do not draw server-side decorations. This works only if no other dependency turns `winit/default` back on, since Cargo merges features across the dependency graph. Confirm that -`cargo tree -e features -i sctk-adwaita` finds no `sctk-adwaita` before relying +`cargo tree --target all --workspace -e features -i sctk-adwaita` finds no +`sctk-adwaita` before relying on it. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory @@ -176,8 +186,9 @@ cargo update -p wayland-scanner |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds `quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same -reason. Run `cargo tree -i quick-xml@` first. The two commands above -fix it only when the parent is `zbus_xml` or `wayland-scanner`. A direct +reason. Run `cargo tree --target all --workspace -i quick-xml@` +first. The two commands above fix it only when the parent is `zbus_xml` or +`wayland-scanner`. A direct dependency needs its requirement in `Cargo.toml` raised, and any other parent needs that parent upgraded. |=== From 0bbc820f4276088d739275037496c462dae50dda Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:55:45 +0000 Subject: [PATCH 7/8] docs: all-features tree checks, lockstep gates, crossfont W2 option Fifth review round on the upstream dependency watch list: - Every cargo tree check adds `--all-features`; without it a crate behind an opt-in feature (such as a `gui` feature) can look absent even though `cargo audit` finds it in Cargo.lock. - W1 gates add zbus-lockstep, zbus-lockstep-macros and zbus_xml, which atspi-common pulls in and which reach the retired crates on their own. - W2 workaround gains a second option: keep Adwaita decorations through winit's `wayland-csd-adwaita-crossfont` (FreeType + fontconfig) instead of ab_glyph. The confirmation check now looks for ttf-parser itself. Checked: with eframe defaults off and a direct winit 0.30.13 dependency on `wayland-csd-adwaita-crossfont`, the lockfile keeps sctk-adwaita and crossfont but has no ab_glyph or ttf-parser; the documented ttf-parser check finds nothing. The R1 check with `--all-features` names zbus_xml 5.1.0 as quick-xml 0.38.4's parent in panic-attack's pre-fix lockfile. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 43 +++++++++++++++++++---------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index f3f23bd7..b1ce9559 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -33,7 +33,9 @@ estate-wide claim, because *Known affected* is not a full census. . Look up every crate in the *Unblocking release* chain on crates.io and read the dependency requirements of each crate's newest release. For W1, check `atspi-common`, `atspi`, `accesskit_atspi_common`, `accesskit_unix`, - `accesskit_winit`, `egui-winit`, and `eframe`. Repeat the lookup below for + `accesskit_winit`, `egui-winit`, and `eframe`. Also check `zbus-lockstep`, + `zbus-lockstep-macros` and `zbus_xml`, which `atspi-common` pulls in and which + reach the retired crates on their own. Repeat the lookup below for each gate; consider the entry unblocked only when every gate's newest release accepts the fixed dependencies through the entire chain. + @@ -67,10 +69,12 @@ for repo in */; do -exec grep -l "^name = \"$crate\"$" {} + done ---- -. Run every `cargo tree` check on this page with `--target all --workspace`. - By default `cargo tree` shows only the host platform and the current - workspace member, so a Linux-only dependency can look absent on another - host. +. Run every `cargo tree` check on this page with + `--target all --workspace --all-features`. By default `cargo tree` shows only + the host platform, the current workspace member and default features. A + Linux-only dependency, or one behind an opt-in feature such as a `gui` + feature, can then look absent even though `cargo audit` finds it in + `Cargo.lock`. == Watching @@ -98,7 +102,8 @@ Prefer waiting for the upstream release unless the advisory must clear sooner. |Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and `zbus ^5.19`. -|Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, then +|Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, with its +`zbus-lockstep` and `zbus_xml` dependencies also off the zbus 5 crates. Then `accesskit_atspi_common` and `accesskit_unix` following it, then an `accesskit_winit` and `egui-winit` / `eframe` release that takes those. |Action when cleared |Bump the crate each affected repository depends on @@ -122,15 +127,22 @@ This is not a full census. `owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window decoration path. It comes from `winit`'s `wayland-csd-adwaita` feature, which `eframe`'s default `winit/default` feature turns on. -|Local workaround |Disable `eframe`'s default features and re-enable the ones +|Local workaround a|Disable `eframe`'s default features and re-enable the ones the application needs (for example `wayland`, `x11`, `accesskit` and a renderer) -without `winit/default`. Wayland windows then lose Adwaita client-side -decorations on compositors that do not draw server-side decorations. This works -only if no other dependency turns `winit/default` back on, since Cargo merges -features across the dependency graph. Confirm that -`cargo tree --target all --workspace -e features -i sctk-adwaita` finds no -`sctk-adwaita` before relying -on it. +without `winit/default`. Then choose one of two options: + +* Drop the Adwaita decorations. Wayland windows lose client-side decorations +on compositors that do not draw server-side ones. +* Keep them by adding a direct `winit` dependency at the same version, with +default features off and the `wayland-csd-adwaita-crossfont` feature on. That +draws the decorations through FreeType and fontconfig, two C libraries, instead +of `ab_glyph`. + +Either option holds only if nothing else turns `winit/default` or +`wayland-csd-adwaita` back on, because Cargo merges features across the +dependency graph. Confirm that +`cargo tree --target all --workspace --all-features -i ttf-parser` finds no +`ttf-parser` before relying on it. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory names `skrifa` as the maintained alternative. @@ -186,7 +198,8 @@ cargo update -p wayland-scanner |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds `quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same -reason. Run `cargo tree --target all --workspace -i quick-xml@` +reason. Run +`cargo tree --target all --workspace --all-features -i quick-xml@` first. The two commands above fix it only when the parent is `zbus_xml` or `wayland-scanner`. A direct dependency needs its requirement in `Cargo.toml` raised, and any other parent From 2c979b64933581f541aff1cd8d26f3ec133b72d9 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:03:15 +0000 Subject: [PATCH 8/8] docs: noyalib version floor, qualify the cargo-audit exit status Sixth review round on the upstream dependency watch list: - W3: `noyalib` releases before 0.0.53 carry RUSTSEC-2026-0333, a denial-of-service vulnerability (patched >= 0.0.53 per the RustSec database), so the replacement guidance now sets that floor. serde-saphyr has no RustSec advisories. - W1: an unmaintained advisory makes `cargo audit` exit 0 only by default; an audit.toml that denies `unmaintained` or `warnings` turns it into a non-zero exit. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index b1ce9559..88f348de 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -84,7 +84,8 @@ done |=== |Advisories |RUSTSEC-2026-0370 (`zvariant`), RUSTSEC-2026-0371 (`zbus_names`), RUSTSEC-2026-0372 (`zvariant_derive`). All informational (`unmaintained`), -reported 2026-10-16. `cargo audit` warns but exits 0. +reported 2026-10-16. By default `cargo audit` warns but exits 0. It exits +non-zero if an `audit.toml` denies `unmaintained` or `warnings`. |Cause |zbus 6 folded these crates into `zbus` itself. `zvariant` became the `wire` module, `zbus_names` became the `names` module, and `zbus` now provides the `zvariant_derive` macros. The 5.x crates get no further releases. Upstream @@ -169,8 +170,9 @@ translation of libyaml in unsafe Rust. not be revived, so waiting does not clear this. Move to *Resolved* once the replacement is applied in every known affected repository. |Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory -suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, -which still depends on `unsafe-libyaml`. +suggests `serde-saphyr` for serde users, or `noyalib`. Use `noyalib` 0.0.53 or +later, because earlier releases carry RUSTSEC-2026-0333, a denial-of-service +vulnerability. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. |Known affected |`hyperpolymath/panic-attack` declares `serde_yaml = "0.9"` directly. This is not a full census. |===