Take the quick-xml fix; drop its two advisory ignores
plist 1.10.0 requires quick-xml ^0.41, which is the fixed version, so the
reason recorded against RUSTSEC-2026-0194/-0195 no longer holds. Nothing
pinned us to 1.8.0: tauri-utils asks for plist ^1 and the lock had just
not moved.
Leaves 16 ignores, all unmaintained notices rather than vulnerabilities.
- Co-Authored-By
- Claude Opus 5 (1M context) <noreply@anthropic.com>
2 files changed,
+12 insertions,
-19 deletions
| 2300 |
2300 |
|
|
| 2301 |
2301 |
|
[[package]]
|
| 2302 |
2302 |
|
name = "plist"
|
| 2303 |
|
- |
version = "1.8.0"
|
|
2303 |
+ |
version = "1.10.0"
|
| 2304 |
2304 |
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
| 2305 |
|
- |
checksum = "740ebea15c5d1428f910cd1a5f52cebf8d25006245ed8ade92702f4943d91e07"
|
|
2305 |
+ |
checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
|
| 2306 |
2306 |
|
dependencies = [
|
| 2307 |
2307 |
|
"base64 0.22.1",
|
| 2308 |
2308 |
|
"indexmap 2.14.0",
|
| 2488 |
2488 |
|
|
| 2489 |
2489 |
|
[[package]]
|
| 2490 |
2490 |
|
name = "quick-xml"
|
| 2491 |
|
- |
version = "0.38.4"
|
|
2491 |
+ |
version = "0.41.0"
|
| 2492 |
2492 |
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
| 2493 |
|
- |
checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
|
|
2493 |
+ |
checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
|
| 2494 |
2494 |
|
dependencies = [
|
| 2495 |
2495 |
|
"memchr",
|
| 2496 |
2496 |
|
]
|
| 4636 |
4636 |
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
| 4637 |
4637 |
|
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
|
| 4638 |
4638 |
|
|
| 4639 |
|
- |
[[patch.unused]]
|
| 4640 |
|
- |
name = "synckit-client"
|
| 4641 |
|
- |
version = "0.8.0"
|
| 4642 |
|
- |
|
| 4643 |
|
- |
[[patch.unused]]
|
| 4644 |
|
- |
name = "synckit-config"
|
| 4645 |
|
- |
version = "0.2.0"
|
| 4646 |
|
- |
|
| 4647 |
4639 |
|
[[patch.unused]]
|
| 4648 |
4640 |
|
name = "kberg"
|
| 4649 |
4641 |
|
version = "0.1.0"
|
| 4655 |
4647 |
|
[[patch.unused]]
|
| 4656 |
4648 |
|
name = "tagtree"
|
| 4657 |
4649 |
|
version = "0.4.0"
|
|
4650 |
+ |
|
|
4651 |
+ |
[[patch.unused]]
|
|
4652 |
+ |
name = "synckit-client"
|
|
4653 |
+ |
version = "0.8.0"
|
|
4654 |
+ |
|
|
4655 |
+ |
[[patch.unused]]
|
|
4656 |
+ |
name = "synckit-config"
|
|
4657 |
+ |
version = "0.2.0"
|
| 19 |
19 |
|
# review task: GoingsOn `quasicoherent`, "Re-check the quasi-tauri advisory
|
| 20 |
20 |
|
# ignores". Delete an entry the moment tauri's tree stops needing it.
|
| 21 |
21 |
|
ignore = [
|
| 22 |
|
- |
# `plist` requires `quick-xml ^0.38` and the fix is 0.41, so there is no
|
| 23 |
|
- |
# upgrade until `plist` bumps. What quick-xml parses in this graph is
|
| 24 |
|
- |
# `Info.plist`, which is bundle metadata we generate, not input a user
|
| 25 |
|
- |
# sends. Both advisories are denial of service against the parsing thread.
|
| 26 |
|
- |
"RUSTSEC-2026-0194",
|
| 27 |
|
- |
"RUSTSEC-2026-0195",
|
| 28 |
|
- |
|
| 29 |
22 |
|
# gtk-rs GTK3 bindings, unmaintained. Ten crates, one cause: tauri's Linux
|
| 30 |
23 |
|
# backend is GTK3 and the bindings were retired when gtk-rs moved to GTK4.
|
| 31 |
24 |
|
# Unmaintained rather than vulnerable, and it resolves when tauri does.
|