Dependency audit and weekly update PRs #83

Merged

littlefox merged 4 commits from issue-68-deny into main 2026-10-17 23:15:13 +00:00

Conversation 0 Commits 4 Files changed 11 +159 -45

littlefox commented 2026-10-17 21:37:14 +00:00

Owner

Copy link

Closes #68

• cargo-deny 0.20.2 (pinned + sha256) in CI: advisories, licences, sources. Fixed RUSTSEC-2026-0009 (time 0.3.47; rust-version 1.85 -> 1.88; clippy let-chain fixes).
• npm audit --audit-level=high in the e2e job.
• .forgejo/workflows/deps.yml: weekly cargo update -> check -> PR. Caveat: runs started with the workflow token may not trigger CI on that branch; push or re-run then.

Renovate would need a bot account (needs the user); this covers the same ground for Cargo.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

Closes #68 - cargo-deny 0.20.2 (pinned + sha256) in CI: advisories, licences, sources. Fixed RUSTSEC-2026-0009 (time 0.3.47; rust-version 1.85 -> 1.88; clippy let-chain fixes). - npm audit --audit-level=high in the e2e job. - .forgejo/workflows/deps.yml: weekly cargo update -> check -> PR. Caveat: runs started with the workflow token may not trigger CI on that branch; push or re-run then. Renovate would need a bot account (needs the user); this covers the same ground for Cargo. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox added 1 commit 2026-10-17 21:37:15 +00:00

Dependency audit (cargo-deny, npm audit) and weekly update PRs ... 542ddc57b3

CI now runs cargo-deny (a pinned, checksummed 0.20.2 via
tools/cargo-deny.sh): RustSec advisories, licences that fit
GPL-3.0-or-later, crates.io only. It found RUSTSEC-2026-0009 in time
0.3.45 (via the desktop webview); time 0.3.47 needs Rust 1.88, so
rust-version goes from 1.85 to 1.88 (CI and every package build
already use newer), and clippy's let-chain suggestions that come with
it are applied. The e2e job runs npm audit for high and critical
issues. A weekly deps workflow runs cargo update, checks it (audit,
clippy, tests) and opens a PR.

Refs #68

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox added 1 commit 2026-10-17 21:53:49 +00:00

Re-run CI (run #126: the runner lost its Docker socket) ... 949abd36d4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox added 2 commits 2026-10-17 22:43:12 +00:00

Merge remote-tracking branch 'origin/main' into issue-68-deny ad0e228446

Clippy: let chains in the merged reconnect code (rust-version 1.88) ... 0a02aa721a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox merged commit c5c2e82cf9 into main 2026-10-17 23:15:13 +00:00

littlefox referenced this pull request from a commit 2026-10-17 23:15:14 +00:00

Merge pull request 'Dependency audit and weekly update PRs' (#83) from issue-68-deny into main

littlefox referenced this pull request from a commit 2026-10-17 23:34:05 +00:00

Clippy: let chains after the rust-version 1.88 bump

littlefox referenced this pull request 2026-10-18 00:56:00 +00:00

Dependency audit (cargo-deny) and update PRs #68

littlefox referenced this pull request 2026-10-18 14:33:47 +00:00

Release 0.2.0 #115

littlefox referenced this pull request from a commit 2026-10-18 14:33:48 +00:00

Release 0.2.0

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/ci

Forgejo Actions, runner, tests

  

area/desktop

Desktop build

  

area/packaging

Arch, Debian, Fedora, NixOS packages

  

area/protocol

kom-proto, wire format, charset

  

area/reading

Unread tracking, reading order, review

  

area/ui

Dioxus app, layout, interaction

  

area/web

Web build and relay

  

area/writing

Composing and sending texts

  

kind/bug

Something is broken

  

kind/feature

New functionality

  

kind/infra

Tooling, tests, CI, dev environment

  

kind/request

requests for features or changes from users

  

needs/user

Waiting for a decision or action from littlefox

  

parked

Kept for reference; no work planned until the user says so

  

perf

Run the perf workflow and its budgets on this pull request (#287)

  

security

Security-relevant

  

upstream

A proposal for Protocol A or lyskomd, for the LysKOM development group

No labels

area/ci

area/desktop

area/packaging

area/protocol

area/reading

area/ui

area/web

area/writing

kind/bug

kind/feature

kind/infra

kind/request

needs/user

parked

perf

security

upstream

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

littlefox/neokom!83

No description provided.