Repository navigation
fix: remediate Maple dependency security advisories - #1258
Merged
Merged
Conversation
Contributor
|
Maple Auth development preview: https://7a6afc88.maple-auth-dev.pages.dev Commit: Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal. |
Contributor
|
Maple development preview: https://b3cfd461.maple-ca8.pages.dev Commit: Uses development API, billing, flags and PCR configuration. Cloudflare Access applies. |
Restore the original Tinfoil pin, dependency graph and Nix vendor hashes at user request. Formatting and backend flake checks pass. The restored crypto-bigint 0.5.5 graph fails the existing RustSec advisory gate for RUSTSEC-2026-0387; no advisory ignore or CI gate change is added.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patches the auth and Research Vite graphs, KaTeX (including Markdown-plugin copies), OpenSecret OpenSSL, tar, QUIC protocol dependencies in all five Rust consumers, and the remaining compatible npm audit findings in the SDK and updater workers. Updating rust_decimal removes the obsolete rkyv 0.7 graph. Removes the unused standalone lockfile from vendored Tao; Research still resolves its Linux GTK stack through the application lockfile.
Adds real Markdown rendering regressions for inline/display math and polluted-prototype trust handling. Keeps scripts disabled and frozen installs enabled; fast-uri 3.1.9 has an explicit, package-scoped exception to the release-age gate for the reviewed URI security fixes.
Validation in pinned Nix shells:
Known remaining advisories: glib 0.18 in Tauri's GTK3 stack (existing documented exception) and Zod 3 in published/legacy TypeScript SDK consumers. Tinfoil's rsa advisory has no patched release and its existing exception covers public-key verification. These require upstream/API migrations or a separately authorized SDK publication. The original advisory commit's hook was skipped after explicit component checks because its Nix shell forces RUST_BACKTRACE=1 and triggers the documented macOS unwinder crash; hosted checks remain enabled.
Tinfoil crypto migration is explicitly deferred: the original Tinfoil f0fef79eec6a5a2c8592cf8aff4b90ab556acfbc pin, dependency graph and Nix Git hashes are restored. Companion tinfoil-rs #3 remains unmerged and is not consumed by this PR.
Adds a reviewed backend-only exception for RUSTSEC-2026-0387: the pinned Tinfoil dependency uses crypto-bigint 0.5.5 for public-input P-256/P-384 attestation and Sigstore verification. Production EHBP key agreement is concretely X25519/dalek; P-256 signing calls are test fixtures. The affected ECDSA verification arithmetic receives public keys, signatures and public signed messages, not private signing scalars. The source trace found no production secret-integer path through this instance. The exception records both immutable Tinfoil/EHBP pins and requires re-review on pin, crypto-consumer or HPKE-suite changes, and removal after upgrading the affected dependency. Other components retain their advisory policies. This is a source reachability assessment, not a production exploit test or a claim that crypto-bigint 0.5.5 is fixed.
Validation after restoring the original Tinfoil dependency: pinned cargo fmt and current-host backend Nix flake checks pass. With the authorized narrow exception, pinned cargo-deny --all-features --locked check advisories bans passes (advisories ok, bans ok). Current-head hosted CI must pass before merge; prior green heads are not substituted for the final head.