Skip to content

fix(security): resolve Dependabot alerts and upgrade dependencies - #30

Merged
BGLuis merged 6 commits into
developfrom
fix/security-dependabot-and-dependencies
Oct 5, 2026
Merged

BGLuis merged 6 commits into
developfrom
fix/security-dependabot-and-dependencies

Conversation

@BGLuis

@BGLuis BGLuis commented Oct 5, 2026

Copy link
Copy Markdown
Owner

Summary

This PR addresses all 12 open GitHub Dependabot security alerts by upgrading russh to 0.64.0 and russh-sftp to 3.0.1, alongside modernizing key network protocol clients and AndroidX dependencies across the repository.

Key Changes by Commit

  1. fix(protocols): update russh to 0.64 and russh-sftp to 3.0 to resolve dependabot alerts

  2. feat(protocols): update suppaftp to 12.1.1 with self-finalizing streams

    • Upgrades suppaftp from 6 to 12.1.1.
    • Adapts close_data_stream in ftp/mod.rs to self-finalizing TransferStream::drop.
    • Replaces deprecated from_mlsx_line with ListParser::parse_mlsd.
  3. feat(protocols): update smb2 to 0.27.0

    • Upgrades smb2 from 0.18 to 0.27.0.
    • Configures connect_options: None in ClientConfig.
  4. feat(media-logic): update chardetng to 1.0.0

    • Upgrades chardetng from 0.1 to 1.0.0.
    • Adapts detector initialization in subtitle.rs with Iso2022JpDetection::Allow and Utf8Detection::Allow.
  5. build(android): update androidx core, appcompat, material, coroutines and exifinterface

    • androidx.core:core-ktx: 1.12.0 -> 1.13.1 (latest stable release compatible with compileSdk 34).
    • androidx.appcompat:appcompat: 1.6.1 -> 1.7.0.
    • com.google.android.material:material: 1.11.0 -> 1.12.0.
    • kotlinx-coroutines-android & test: 1.7.3 -> 1.8.1.
    • androidx.exifinterface:exifinterface: 1.3.7 -> 1.4.0.
    • Preserves androidx.room:2.6.1 to maintain strict compatibility with Kotlin 1.9.0 and KSP.

Validation Performed

  • cd rust && cargo clippy -p protocols -p media-logic -- -D warnings (passed, 0 warnings)
  • cd rust && cargo test -p protocols -p media-logic (passed, 307 tests total: 83 protocols, 224 media-logic)
  • ./gradlew testDebugUnitTest (passed, 26 tasks executed/up-to-date)

@BGLuis
BGLuis merged commit 0efac40 into develop Oct 5, 2026
2 checks passed
@BGLuis
BGLuis deleted the fix/security-dependabot-and-dependencies branch October 5, 2026 04:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant