fix(security): retire quick-xml RustSec exceptions - #948
Draft
seonghobae wants to merge 19 commits into
Draft
Conversation
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
opencode-agent
Bot
added
area: security
…r refresh The regression test locked the retirement contract, but the branch never performed the retirement itself, and the test file also failed "ruff format --check" (the first gate in both build-and-test and release-preflight), masking everything downstream. Complete the actual retirement: - refresh wayland-scanner 0.31.10 -> 0.31.11 in Cargo.lock, which drops quick-xml 0.39.4; the lock now resolves a single patched quick-xml 0.41.0 (plist 1.10.0 already required it) - remove RUSTSEC-2026-0194/0195 ignores from .cargo/audit.toml and osv-scanner.toml - apply ruff format to the regression test so format gates pass - move the advisory entry in docs/security/dependency-policy.md from active exceptions to retired signal
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Advances #542 now that the compatible Wayland owner chain can move off
quick-xml 0.39.4.TDD state
This Draft is intentionally opened at RED head
df74a1be0f5fd00b6f83a65d97f66e0527fbc16c. The only branch delta is a regression requiring:quick-xmlpackage to be at least0.41.0;wayland-scannerto be0.31.11; andRUSTSEC-2026-0194/RUSTSEC-2026-0195to be absent from cargo-audit and OSV exception configuration.Protected
developstill containswayland-scanner 0.31.10 -> quick-xml 0.39.4and the two temporary exceptions, so this exact head must fail the new regression. Do not interpret the RED head as merge-ready.The GREEN repair will stay scoped to the Cargo lock owner chain, removal of the now-obsolete exceptions, code-current dependency policy/CHANGELOG, and the committed regression. It will not duplicate #783's JavaScript dependency baseline or weaken any scan gate.
Merge gate
Keep Draft until one unchanged GREEN exact head has all applicable repository and central CI/security/SAST/SBOM/supply-chain/package/release/coverage/review gates terminal-success, zero valid unresolved findings, qualifying independent non-author last-push approval, and ordinary protected-branch acceptance without bypass. Queued, failed, predecessor, protected-base, model-only, or author/self evidence is non-passing.