Dependency audit (cargo-deny) and update PRs #68

New issue

Closed

opened 2026-10-17 17:54:19 +00:00 by littlefox · 1 comment

littlefox commented

2026-10-17 17:54:19 +00:00

Owner

0.2 adds dependencies, among them a keyring library that handles passwords (#53).

What:

cargo-deny in CI: known vulnerabilities (RustSec), licences compatible with GPL-3.0-or-later, no duplicate major versions without a reason, allowed sources only.
The same for the e2e npm packages (npm audit).
Automatic update PRs (Renovate on Forgejo, or a scheduled workflow that opens them), batched weekly.

Done when:

CI fails on a known-vulnerable crate and says which one.
The first update PR has gone through CI.

Helps: #53.

From docs/ROADMAP.md, "Under the hood"; filed for 0.2.

0.2 adds dependencies, among them a keyring library that handles passwords (#53). What: - cargo-deny in CI: known vulnerabilities (RustSec), licences compatible with GPL-3.0-or-later, no duplicate major versions without a reason, allowed sources only. - The same for the e2e npm packages (npm audit). - Automatic update PRs (Renovate on Forgejo, or a scheduled workflow that opens them), batched weekly. Done when: - CI fails on a known-vulnerable crate and says which one. - The first update PR has gone through CI. Helps: #53. From docs/ROADMAP.md, "Under the hood"; filed for 0.2.

littlefox added this to the 0.2: Feels like an app milestone

2026-10-17 17:54:19 +00:00

littlefox added the

area/ci

kind/infra

security

labels

2026-10-17 17:54:19 +00:00

littlefox referenced this issue from a pull request that will close it,

2026-10-17 21:37:14 +00:00

Dependency audit and weekly update PRs #83

littlefox referenced this issue from a commit

2026-10-17 21:37:15 +00:00

Dependency audit (cargo-deny, npm audit) and weekly update PRs

littlefox closed this issue

2026-10-17 23:15:14 +00:00

littlefox commented

2026-10-18 00:56:00 +00:00

Author

Owner

Merged in #83 (CI run #139 green). cargo-deny (pinned 0.20.2) in CI; fixed RUSTSEC-2026-0009 (time 0.3.47, rust-version 1.88); npm audit in the e2e job; weekly deps workflow opens update PRs.