Repository navigation
docs(watch): resolve W3 unsafe-libyaml after panic-attack#234 - #1320
Merged
Merged
Conversation
Records dependency advisories that no estate repository can clear alone because the fix must ship upstream first, with the release that unblocks each one so a re-check is a single crates.io lookup. Watching: - W1: zvariant, zbus_names, zvariant_derive unmaintained (RUSTSEC-2026-0370/0371/0372), via eframe -> accesskit -> atspi -> zbus 5. Unblocks when atspi moves to zbus 6. - W2: ttf-parser unmaintained (RUSTSEC-2026-0192), via winit -> sctk-adwaita -> ab_glyph. - W3: unsafe-libyaml unmaintained (RUSTSEC-2024-0449), via serde_yaml. Locally fixable by moving to serde-saphyr, listed because it recurs. Resolved: - R1: quick-xml 0.38 (RUSTSEC-2026-0194/0195), cleared by a lockfile bump of zbus_xml to 5.2.1 and wayland-scanner to 0.31.11. Kept as the worked example of checking the newest compatible release before planning an upstream fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
…ures Review follow-ups on the upstream dependency watch list: - Per-repo counts no longer point at .machine_readable/Debtfile.a2ml. A2ML is retired and must not gain new entries, and the Debtfile has no deed mapping yet, so the page now says not to record these advisories there. - W1: the zbus 5 chain is present only with the `accesskit` feature, which eframe enables by default and egui-winit leaves opt-in. Building eframe without `accesskit` drops the chain at the cost of screen-reader support; recorded as a local workaround. - W2: sctk-adwaita and ab_glyph come from winit's `wayland-csd-adwaita`, enabled through eframe's default `winit/default`. Disabling eframe's defaults and re-enabling the needed features drops ttf-parser at the cost of Adwaita client-side decorations; recorded as a local workaround. Both workarounds were checked by resolving eframe 0.36.2 with each feature set: without `accesskit` the lockfile holds no zvariant, zbus, atspi-common or accesskit_unix; without `winit/default` it holds no ttf-parser, sctk-adwaita or ab_glyph. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
Second review round on the upstream dependency watch list: - Define *Resolved* as clear in every repository checked so far, not estate-wide, matching the "not a full census" caveat. W3 resolves only once every known affected repository is fixed. - W1 and W2: an opt-in feature limits which binaries compile the chain, but `cargo audit` reads Cargo.lock, which Cargo resolves with every feature on, so the audit reports the advisory on every build. - W2 workaround: Cargo merges features across the graph, so it holds only if nothing else turns `winit/default` back on; check with `cargo tree -e features -i sctk-adwaita`. - R1: the two update commands fix only the zbus_xml and wayland-scanner parents; run `cargo tree -i quick-xml@<version>` first. Both cargo tree commands were run: the sctk-adwaita check finds the crate under eframe defaults and nothing under the workaround feature set; the quick-xml check on panic-attack's pre-fix lockfile names zbus_xml 5.1.0 as the parent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
Third review round on the upstream dependency watch list: - W1 cause: only zvariant became zbus 6's `wire` module; zbus_names became the `names` module and zbus now provides the zvariant_derive macros (RUSTSEC-2026-0370/0371/0372 texts). - W1 and W2 dates are the RustSec `date` field, which is the report date, so label them "reported" rather than "issued". - Link the watch list from 3-practice/SECURITY-ADVISORIES.adoc so it is reachable from the existing advisory log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
Fourth review round on the upstream dependency watch list: - The estate census loop now recurses into each clone, so repositories that keep Rust workspaces below the root (standards has seven nested Cargo.lock files) are no longer skipped. - Every cargo tree check uses `--target all --workspace`; by default cargo tree shows only the host platform and current member, so a Linux-only dependency can look absent on another host. - W1 workaround and bump action name the directly depended-on crate, `eframe` or a standalone `egui-winit`. Checked: the recursive loop finds nested lockfiles such as echidna/fuzz/Cargo.lock; both cargo tree commands with the new flags resolve against eframe 0.36.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
Fifth review round on the upstream dependency watch list: - Every cargo tree check adds `--all-features`; without it a crate behind an opt-in feature (such as a `gui` feature) can look absent even though `cargo audit` finds it in Cargo.lock. - W1 gates add zbus-lockstep, zbus-lockstep-macros and zbus_xml, which atspi-common pulls in and which reach the retired crates on their own. - W2 workaround gains a second option: keep Adwaita decorations through winit's `wayland-csd-adwaita-crossfont` (FreeType + fontconfig) instead of ab_glyph. The confirmation check now looks for ttf-parser itself. Checked: with eframe defaults off and a direct winit 0.30.13 dependency on `wayland-csd-adwaita-crossfont`, the lockfile keeps sctk-adwaita and crossfont but has no ab_glyph or ttf-parser; the documented ttf-parser check finds nothing. The R1 check with `--all-features` names zbus_xml 5.1.0 as quick-xml 0.38.4's parent in panic-attack's pre-fix lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
Sixth review round on the upstream dependency watch list: - W3: `noyalib` releases before 0.0.53 carry RUSTSEC-2026-0333, a denial-of-service vulnerability (patched >= 0.0.53 per the RustSec database), so the replacement guidance now sets that floor. serde-saphyr has no RustSec advisories. - W1: an unmaintained advisory makes `cargo audit` exit 0 only by default; an audit.toml that denies `unmaintained` or `warnings` turns it into a non-zero exit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
hyperpolymath/panic-attack#234 replaced serde_yaml with serde-saphyr 2.0, so RUSTSEC-2024-0449 is clear in every known affected repository. Move W3 out of Local remediation and record it as R2 under Resolved, keeping "was W3" for traceability. The entry records what the fix needed beyond the swap: the minimum Rust version (no maintained safe-Rust serde YAML crate builds on 1.85, and the noyalib releases that do predate RUSTSEC-2026-0333), and the parse-budget scaling that large machine-written documents need. echidna was checked clear. The follow-up line says how to find the parent in any other repo. Rendered with asciidoctor --failure-level=WARN: no warnings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFaqv6iBXrt3W5Akd1Fq5k
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 57 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
marked this pull request as ready for review
October 20, 2026 13:28
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
#1320 merged as an empty commit (6f96eab): #1311 was squash-merged, and merging main back into #1320's branch resolved the conflict on docs/UPSTREAM-DEPENDENCY-WATCH.adoc to main's side, dropping the edit. main therefore still lists W3 under Local remediation. Reapply the edit unchanged. hyperpolymath/panic-attack#234 replaced serde_yaml with serde-saphyr 2.0, so RUSTSEC-2024-0449 is clear in every known affected repository: W3 leaves Local remediation ("No entries.") and becomes R2 (was W3) under Resolved, recording the MSRV constraint, the parse-budget scaling, echidna checked clear, and the follow-up command for other repositories. Rendered with asciidoctor --failure-level=WARN: no warnings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFaqv6iBXrt3W5Akd1Fq5k
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
## Why this exists #1320 merged as an **empty commit** (`6f96eab`), so `main` still lists W3 under *Local remediation*. How it happened: #1311 was squash-merged. Merging `main` back into #1320's branch then conflicted on `docs/UPSTREAM-DEPENDENCY-WATCH.adoc`. That merge commit, `d952134`, resolved the conflict by taking `main`'s side, which left the branch identical to `main`. This PR reapplies the same edit, unchanged, on top of the latest `main`; `main`'s copy of the file is otherwise identical to the one the edit was made against. ## What [hyperpolymath/panic-attack#234](hyperpolymath/panic-attack#234) (merged 2026-10-20) replaced `serde_yaml` with `serde-saphyr` 2.0, so RUSTSEC-2024-0449 is clear in every known affected repository. - W3 leaves *Local remediation*, which now reads "No entries." - It becomes **R2 (was W3)** under *Resolved*. The entry records: - **Minimum Rust version:** no maintained safe-Rust serde YAML crate builds on 1.85, and the noyalib releases that do predate RUSTSEC-2026-0333. - **Resource limits:** scaling serde-saphyr's parse budget for large machine-written documents. - **Checked clear:** `hyperpolymath/echidna`. - **Follow-up:** a `cargo tree -i unsafe-libyaml` command for any other repository. ## Checks - The diff against `main` is this one file, +33 / −18, and nothing else. - `asciidoctor --failure-level=WARN` renders it with no warnings. - The commit message passes `.githooks/commit-msg`. **Merge note:** if `main` moves before merge, please update this branch with a rebase, or a merge that keeps this side of the file. A plain "merge main" that takes `main`'s side reproduces the empty merge. --- _Generated by [Claude Code](https://claude.ai/code/session_01PFaqv6iBXrt3W5Akd1Fq5k)_ Co-authored-by: Claude <noreply@anthropic.com>
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1311, which adds
docs/UPSTREAM-DEPENDENCY-WATCH.adoc. The base is that PR's branch; retarget this PR tomainonce #1311 merges (GitHub does this automatically when the base branch is deleted on merge).What
hyperpolymath/panic-attack#234 (merged 2026-10-20) replaced
serde_yamlwithserde-saphyr2.0. RUSTSEC-2024-0449 is now clear in every known affected repository, so:What the entry now records
These are the parts of the fix that weren't obvious from the advisory:
is_multiple_of); this was measured on 1.85.0. noyalib releases after 0.0.15 need 1.86 or later. The noyalib releases that build on 1.85 also predate RUSTSEC-2026-0333. panic-attack therefore raised its floor from 1.85.0 to 1.89 instead of pinning a frozen release.hyperpolymath/echidna(no lockfile holdsunsafe-libyaml). This is not a full census.cargo tree … -i unsafe-libyamlto find the parent, then swap it as above.Checks
asciidoctor --failure-level=WARNrenders the file with no warnings, and the table count is unchanged (5)..githooks/commit-msg.Generated by Claude Code