From ca5ed338f795c60d0f1ddad15cad868929eda67c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 23:19:09 +0000 Subject: [PATCH 1/9] docs: add estate-wide upstream dependency watch list Records dependency advisories that no estate repository can clear alone because the fix must ship upstream first, with the release that unblocks each one so a re-check is a single crates.io lookup. Watching: - W1: zvariant, zbus_names, zvariant_derive unmaintained (RUSTSEC-2026-0370/0371/0372), via eframe -> accesskit -> atspi -> zbus 5. Unblocks when atspi moves to zbus 6. - W2: ttf-parser unmaintained (RUSTSEC-2026-0192), via winit -> sctk-adwaita -> ab_glyph. - W3: unsafe-libyaml unmaintained (RUSTSEC-2024-0449), via serde_yaml. Locally fixable by moving to serde-saphyr, listed because it recurs. Resolved: - R1: quick-xml 0.38 (RUSTSEC-2026-0194/0195), cleared by a lockfile bump of zbus_xml to 5.2.1 and wayland-scanner to 0.31.11. Kept as the worked example of checking the newest compatible release before planning an upstream fix. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 149 ++++++++++++++++++++++++++++ 1 file changed, 149 insertions(+) create mode 100644 docs/UPSTREAM-DEPENDENCY-WATCH.adoc diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc new file mode 100644 index 00000000..0dd92c94 --- /dev/null +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -0,0 +1,149 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Upstream dependency watch +:toc: +:toclevels: 2 + +Estate-wide list of dependency advisories that no estate repository can clear +on its own, because the fix has to be released upstream first. Each entry +names the upstream release that unblocks it, so a re-check is one lookup +rather than a fresh investigation. + +== Scope and neighbours + +[cols="1,2"] +|=== +|Lives here |An advisory whose fix is blocked on an upstream release, and that +can affect more than one estate repository. +|Not here |An advisory a repository can fix itself with a lockfile bump or a +dependency swap. Fix it at its source in that repository. Entries below that +turn out to be locally fixable say so and move to *Resolved* once fixed. +|Per-repo counts |A repository that tolerates one of these advisories records +the shortfall in its own Debtfile (`docs/DEBTFILE-SPEC.adoc`). This page holds +the shared upstream trigger, not the per-repo integer. +|Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. +|=== + +== How to re-check an entry + +. Look up the *Unblocking release* crate on crates.io and read the dependency + requirement of its newest release. ++ +[source,bash] +---- +crate=atspi-common +v=$(curl -sS -A "upstream-watch" "https://crates.io/api/v1/crates/$crate" | jq -r .crate.max_stable_version) +curl -sS -A "upstream-watch" "https://crates.io/api/v1/crates/$crate/$v/dependencies" \ + | jq -r '.dependencies[] | select(.kind != "dev") | "\(.crate_id) \(.req)"' +---- +. Before assuming upstream is stuck, try the newest *semver-compatible* + release in the affected repository. The quick-xml entry under *Resolved* was + planned as a three-repository upstream fix, and turned out to need only + `cargo update -p zbus_xml --precise 5.2.1`. ++ +[source,bash] +---- +cargo update -p --precise +cargo audit +---- +. Find which estate repositories carry a crate, from a directory of clones: ++ +[source,bash] +---- +for lock in */Cargo.lock; do + grep -q '^name = "zvariant"$' "$lock" && echo "${lock%/Cargo.lock}" +done +---- + +== Watching + +=== W1: zbus 5 sub-crates unmaintained + +[cols="1,3"] +|=== +|Advisories |RUSTSEC-2026-0370 (`zvariant`), RUSTSEC-2026-0371 (`zbus_names`), +RUSTSEC-2026-0372 (`zvariant_derive`). All informational (`unmaintained`), +issued 2026-10-16. `cargo audit` warns but exits 0. +|Cause |zbus 6 folded these crates into `zbus` itself (the `wire` module). +The 5.x crates get no further releases. Upstream notice: +https://github.com/z-galaxy/zbus/issues/2043 +|Path in |`eframe` -> `egui-winit` -> `accesskit_winit` -> `accesskit_unix` -> +`accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. Linux +accessibility (AT-SPI) support, so any eframe/egui GUI on Linux carries it. +|Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still +require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and +`zbus ^5.19`. +|Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, then +`accesskit_atspi_common` and `accesskit_unix` following it, then an +`accesskit_winit` and `egui-winit` / `eframe` release that takes those. +|Action when cleared |Bump `eframe` in each affected repository. This is a +manifest change and may carry egui API breaks, so build and test the GUI +feature before merging. +|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. +Default builds are unaffected. `hyperpolymath/echidna` is not affected. +This is not a full census. +|=== + +=== W2: `ttf-parser` unmaintained + +[cols="1,3"] +|=== +|Advisory |RUSTSEC-2026-0192, informational (`unmaintained`), issued +2026-06-28. Upstream notice: https://github.com/harfbuzz/ttf-parser/issues/217 +|Path in |`eframe` -> `winit` -> `sctk-adwaita` -> `ab_glyph` -> +`owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window +decoration path. +|Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires +`owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory +names `skrifa` as the maintained alternative. +|Unblocking release |`ab_glyph` / `owned_ttf_parser` moving to `skrifa`, or a +`sctk-adwaita` release that drops `ab_glyph`, then a `winit` release taking it. +|Action when cleared |`cargo update` in each affected repository, or an +`eframe` bump if `winit` moves a minor version. +|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. +This is not a full census. +|=== + +=== W3: `unsafe-libyaml` unmaintained, via `serde_yaml` + +[cols="1,3"] +|=== +|Advisory |RUSTSEC-2024-0449, informational (`unmaintained`). The upstream +repository was archived on 2024-03-25. +|Path in |`serde_yaml` 0.9 (itself deprecated) -> `unsafe-libyaml`, a c2rust +translation of libyaml in unsafe Rust. +|Blocked on |Nothing upstream. `serde_yaml` will not be revived, so waiting +does not clear this. It sits on this page because it is likely to recur across +the estate's Rust repositories. +|Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory +suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, +which still depends on `unsafe-libyaml`. +|Known affected |`hyperpolymath/panic-attack` declares `serde_yaml = "0.9"` +directly. This is not a full census. +|=== + +== Resolved + +=== R1: `quick-xml` 0.38 denial-of-service advisories (resolved 2026-10-19) + +[cols="1,3"] +|=== +|Advisories |RUSTSEC-2026-0194 (quadratic attribute checking) and +RUSTSEC-2026-0195 (unbounded namespace allocation), fixed in `quick-xml` +0.41.0. These were vulnerabilities, so `cargo audit` failed. +|Paths in |`zbus_xml` 5.1.0 (via the same AT-SPI chain as W1), and +`wayland-scanner` before 0.31.11. +|Fix a|Lockfile-only. `zbus_xml` 5.2.0 and later dropped `quick-xml` for +`winnow`, and `zbus-lockstep` 0.5.2 accepts `zbus_xml ^5.0.2`. +`wayland-scanner` 0.31.11 moved to `quick-xml` 0.41. + +[source,bash] +---- +cargo update -p zbus_xml --precise 5.2.1 +cargo update -p wayland-scanner +---- +|Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. +|Estate follow-up |Any other Rust repository whose lockfile still holds +`quick-xml` 0.38 or 0.39 fails `cargo audit` for the same reason and takes the +same fix. +|=== From e2a2dcb3b5d586b85bac2f071cf2f7371fa04d30 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 00:24:31 +0000 Subject: [PATCH 2/9] docs: clarify dependency watch gates and local remediation --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 30 ++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 0dd92c94..32bd5739 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -6,7 +6,7 @@ Estate-wide list of dependency advisories that no estate repository can clear on its own, because the fix has to be released upstream first. Each entry -names the upstream release that unblocks it, so a re-check is one lookup +names the upstream releases that unblock it, so a re-check follows a known chain rather than a fresh investigation. == Scope and neighbours @@ -17,17 +17,22 @@ rather than a fresh investigation. can affect more than one estate repository. |Not here |An advisory a repository can fix itself with a lockfile bump or a dependency swap. Fix it at its source in that repository. Entries below that -turn out to be locally fixable say so and move to *Resolved* once fixed. +turn out to be locally fixable move to *Local remediation*, then to *Resolved* +once fixed. |Per-repo counts |A repository that tolerates one of these advisories records -the shortfall in its own Debtfile (`docs/DEBTFILE-SPEC.adoc`). This page holds +the shortfall in its own Debtfile (`.machine_readable/Debtfile.a2ml`). This page holds the shared upstream trigger, not the per-repo integer. |Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. |=== == How to re-check an entry -. Look up the *Unblocking release* crate on crates.io and read the dependency - requirement of its newest release. +. Look up every crate in the *Unblocking release* chain on crates.io and read + the dependency requirements of each crate's newest release. For W1, check + `atspi-common`, `atspi`, `accesskit_atspi_common`, `accesskit_unix`, + `accesskit_winit`, `egui-winit`, and `eframe`. Repeat the lookup below for + each gate; consider the entry unblocked only when every gate's newest release + accepts the fixed dependencies through the entire chain. + [source,bash] ---- @@ -50,8 +55,9 @@ cargo audit + [source,bash] ---- +crate=zvariant for lock in */Cargo.lock; do - grep -q '^name = "zvariant"$' "$lock" && echo "${lock%/Cargo.lock}" + grep -q "^name = \"$crate\"$" "$lock" && echo "${lock%/Cargo.lock}" done ---- @@ -104,6 +110,8 @@ names `skrifa` as the maintained alternative. This is not a full census. |=== +== Local remediation + === W3: `unsafe-libyaml` unmaintained, via `serde_yaml` [cols="1,3"] @@ -112,9 +120,9 @@ This is not a full census. repository was archived on 2024-03-25. |Path in |`serde_yaml` 0.9 (itself deprecated) -> `unsafe-libyaml`, a c2rust translation of libyaml in unsafe Rust. -|Blocked on |Nothing upstream. `serde_yaml` will not be revived, so waiting -does not clear this. It sits on this page because it is likely to recur across -the estate's Rust repositories. +|Status |Locally remediable; no upstream release is needed. `serde_yaml` will +not be revived, so waiting does not clear this. Move to *Resolved* once the +replacement is applied in the affected repository. |Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. @@ -144,6 +152,6 @@ cargo update -p wayland-scanner ---- |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds -`quick-xml` 0.38 or 0.39 fails `cargo audit` for the same reason and takes the -same fix. +`quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same +reason and takes the same fix. |=== From e64d6bc23755618f4055e9c3f6667921fa249755 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:26:57 +0000 Subject: [PATCH 3/9] docs: keep watch-list debt out of A2ML, scope W1 and W2 to their features Review follow-ups on the upstream dependency watch list: - Per-repo counts no longer point at .machine_readable/Debtfile.a2ml. A2ML is retired and must not gain new entries, and the Debtfile has no deed mapping yet, so the page now says not to record these advisories there. - W1: the zbus 5 chain is present only with the `accesskit` feature, which eframe enables by default and egui-winit leaves opt-in. Building eframe without `accesskit` drops the chain at the cost of screen-reader support; recorded as a local workaround. - W2: sctk-adwaita and ab_glyph come from winit's `wayland-csd-adwaita`, enabled through eframe's default `winit/default`. Disabling eframe's defaults and re-enabling the needed features drops ttf-parser at the cost of Adwaita client-side decorations; recorded as a local workaround. Both workarounds were checked by resolving eframe 0.36.2 with each feature set: without `accesskit` the lockfile holds no zvariant, zbus, atspi-common or accesskit_unix; without `winit/default` it holds no ttf-parser, sctk-adwaita or ab_glyph. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 32bd5739..a5957d36 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -19,9 +19,10 @@ can affect more than one estate repository. dependency swap. Fix it at its source in that repository. Entries below that turn out to be locally fixable move to *Local remediation*, then to *Resolved* once fixed. -|Per-repo counts |A repository that tolerates one of these advisories records -the shortfall in its own Debtfile (`.machine_readable/Debtfile.a2ml`). This page holds -the shared upstream trigger, not the per-repo integer. +|Per-repo counts |This page holds the shared upstream trigger, not a per-repo +count. Do not record these advisories in a new `Debtfile.a2ml` entry. The +Debtfile format (`docs/DEBTFILE-SPEC.adoc`) is A2ML, which is retired, and no +deed mapping for it exists yet. |Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. |=== @@ -74,8 +75,13 @@ issued 2026-10-16. `cargo audit` warns but exits 0. The 5.x crates get no further releases. Upstream notice: https://github.com/z-galaxy/zbus/issues/2043 |Path in |`eframe` -> `egui-winit` -> `accesskit_winit` -> `accesskit_unix` -> -`accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. Linux -accessibility (AT-SPI) support, so any eframe/egui GUI on Linux carries it. +`accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. This is +Linux screen-reader (AT-SPI) support. It is present only when the `accesskit` +feature is on. That feature is in `eframe`'s default set, but opt-in for +standalone `egui-winit`. +|Local workaround |Building `eframe` without its `accesskit` feature drops the +whole chain, at the cost of screen-reader support. Prefer waiting for the +upstream release unless the advisory must clear sooner. |Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and `zbus ^5.19`. @@ -98,7 +104,12 @@ This is not a full census. 2026-06-28. Upstream notice: https://github.com/harfbuzz/ttf-parser/issues/217 |Path in |`eframe` -> `winit` -> `sctk-adwaita` -> `ab_glyph` -> `owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window -decoration path. +decoration path. It comes from `winit`'s `wayland-csd-adwaita` feature, which +`eframe`'s default `winit/default` feature turns on. +|Local workaround |Disable `eframe`'s default features and re-enable the ones +the application needs (for example `wayland`, `x11`, `accesskit` and a renderer) +without `winit/default`. Wayland windows then lose Adwaita client-side +decorations on compositors that do not draw server-side decorations. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory names `skrifa` as the maintained alternative. From 644652ce7ceb3799de514f8b2fc363ae9a420db8 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:35:04 +0000 Subject: [PATCH 4/9] docs: scope Resolved, audit reach and the quick-xml follow-up Second review round on the upstream dependency watch list: - Define *Resolved* as clear in every repository checked so far, not estate-wide, matching the "not a full census" caveat. W3 resolves only once every known affected repository is fixed. - W1 and W2: an opt-in feature limits which binaries compile the chain, but `cargo audit` reads Cargo.lock, which Cargo resolves with every feature on, so the audit reports the advisory on every build. - W2 workaround: Cargo merges features across the graph, so it holds only if nothing else turns `winit/default` back on; check with `cargo tree -e features -i sctk-adwaita`. - R1: the two update commands fix only the zbus_xml and wayland-scanner parents; run `cargo tree -i quick-xml@` first. Both cargo tree commands were run: the sctk-adwaita check finds the crate under eframe defaults and nothing under the workaround feature set; the quick-xml check on panic-attack's pre-fix lockfile names zbus_xml 5.1.0 as the parent. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index a5957d36..b3210694 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -23,6 +23,8 @@ once fixed. count. Do not record these advisories in a new `Debtfile.a2ml` entry. The Debtfile format (`docs/DEBTFILE-SPEC.adoc`) is A2ML, which is retired, and no deed mapping for it exists yet. +|What *Resolved* means |Clear in every repository checked so far. It is not an +estate-wide claim, because *Known affected* is not a full census. |Standards' own advisories |`3-practice/SECURITY-ADVISORIES.adoc`. |=== @@ -91,8 +93,11 @@ require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and |Action when cleared |Bump `eframe` in each affected repository. This is a manifest change and may carry egui API breaks, so build and test the GUI feature before merging. -|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. -Default builds are unaffected. `hyperpolymath/echidna` is not affected. +|Known affected |`hyperpolymath/panic-attack`. Only its opt-in `gui` feature +compiles the chain into a binary. Its `cargo audit` still reports the +advisories on every build, because the audit reads `Cargo.lock` and Cargo +resolves the lockfile with every feature on. `hyperpolymath/echidna` is not +affected. This is not a full census. |=== @@ -109,7 +114,11 @@ decoration path. It comes from `winit`'s `wayland-csd-adwaita` feature, which |Local workaround |Disable `eframe`'s default features and re-enable the ones the application needs (for example `wayland`, `x11`, `accesskit` and a renderer) without `winit/default`. Wayland windows then lose Adwaita client-side -decorations on compositors that do not draw server-side decorations. +decorations on compositors that do not draw server-side decorations. This works +only if no other dependency turns `winit/default` back on, since Cargo merges +features across the dependency graph. Confirm that +`cargo tree -e features -i sctk-adwaita` finds no `sctk-adwaita` before relying +on it. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory names `skrifa` as the maintained alternative. @@ -117,7 +126,8 @@ names `skrifa` as the maintained alternative. `sctk-adwaita` release that drops `ab_glyph`, then a `winit` release taking it. |Action when cleared |`cargo update` in each affected repository, or an `eframe` bump if `winit` moves a minor version. -|Known affected |`hyperpolymath/panic-attack`, opt-in `gui` feature only. +|Known affected |`hyperpolymath/panic-attack`, through its opt-in `gui` +feature. As with W1, its `cargo audit` reports the advisory on every build. This is not a full census. |=== @@ -133,7 +143,7 @@ repository was archived on 2024-03-25. translation of libyaml in unsafe Rust. |Status |Locally remediable; no upstream release is needed. `serde_yaml` will not be revived, so waiting does not clear this. Move to *Resolved* once the -replacement is applied in the affected repository. +replacement is applied in every known affected repository. |Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. @@ -164,5 +174,8 @@ cargo update -p wayland-scanner |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds `quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same -reason and takes the same fix. +reason. Run `cargo tree -i quick-xml@` first. The two commands above +fix it only when the parent is `zbus_xml` or `wayland-scanner`. A direct +dependency needs its requirement in `Cargo.toml` raised, and any other parent +needs that parent upgraded. |=== From 5dcee79a1ff88986dedb7288787ff8927a615827 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:41:45 +0000 Subject: [PATCH 5/9] docs: correct zbus 6 targets and advisory dates, link the watch list Third review round on the upstream dependency watch list: - W1 cause: only zvariant became zbus 6's `wire` module; zbus_names became the `names` module and zbus now provides the zvariant_derive macros (RUSTSEC-2026-0370/0371/0372 texts). - W1 and W2 dates are the RustSec `date` field, which is the report date, so label them "reported" rather than "issued". - Link the watch list from 3-practice/SECURITY-ADVISORIES.adoc so it is reachable from the existing advisory log. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- 3-practice/SECURITY-ADVISORIES.adoc | 3 +++ docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 10 ++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/3-practice/SECURITY-ADVISORIES.adoc b/3-practice/SECURITY-ADVISORIES.adoc index 28b6a55a..b793b44c 100644 --- a/3-practice/SECURITY-ADVISORIES.adoc +++ b/3-practice/SECURITY-ADVISORIES.adoc @@ -10,6 +10,9 @@ Triaged record of open / deferred / closed Dependabot advisories against `hyperpolymath/standards`. Updated whenever an advisory is resolved or a deferral is re-evaluated. +Estate-wide advisories that wait on an upstream release are tracked in +link:../docs/UPSTREAM-DEPENDENCY-WATCH.adoc[the upstream dependency watch]. + == Closed === GHSA-xgp8-3hg3-c2mh + GHSA-965h-392x-2mh5 (rustls-webpki, low, 2026-04-18) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index b3210694..8ff5eeb6 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -72,9 +72,11 @@ done |=== |Advisories |RUSTSEC-2026-0370 (`zvariant`), RUSTSEC-2026-0371 (`zbus_names`), RUSTSEC-2026-0372 (`zvariant_derive`). All informational (`unmaintained`), -issued 2026-10-16. `cargo audit` warns but exits 0. -|Cause |zbus 6 folded these crates into `zbus` itself (the `wire` module). -The 5.x crates get no further releases. Upstream notice: +reported 2026-10-16. `cargo audit` warns but exits 0. +|Cause |zbus 6 folded these crates into `zbus` itself. `zvariant` became the +`wire` module, `zbus_names` became the `names` module, and `zbus` now provides +the `zvariant_derive` macros. The 5.x crates get no further releases. Upstream +notice: https://github.com/z-galaxy/zbus/issues/2043 |Path in |`eframe` -> `egui-winit` -> `accesskit_winit` -> `accesskit_unix` -> `accesskit_atspi_common` / `atspi` -> `atspi-common` -> `zbus` 5. This is @@ -105,7 +107,7 @@ This is not a full census. [cols="1,3"] |=== -|Advisory |RUSTSEC-2026-0192, informational (`unmaintained`), issued +|Advisory |RUSTSEC-2026-0192, informational (`unmaintained`), reported 2026-06-28. Upstream notice: https://github.com/harfbuzz/ttf-parser/issues/217 |Path in |`eframe` -> `winit` -> `sctk-adwaita` -> `ab_glyph` -> `owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window From b56345334ce04f75f31e752369835444f42fad42 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:47:53 +0000 Subject: [PATCH 6/9] docs: recurse the lockfile census, check all targets, cover egui-winit Fourth review round on the upstream dependency watch list: - The estate census loop now recurses into each clone, so repositories that keep Rust workspaces below the root (standards has seven nested Cargo.lock files) are no longer skipped. - Every cargo tree check uses `--target all --workspace`; by default cargo tree shows only the host platform and current member, so a Linux-only dependency can look absent on another host. - W1 workaround and bump action name the directly depended-on crate, `eframe` or a standalone `egui-winit`. Checked: the recursive loop finds nested lockfiles such as echidna/fuzz/Cargo.lock; both cargo tree commands with the new flags resolve against eframe 0.36.2. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 35 +++++++++++++++++++---------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 8ff5eeb6..f3f23bd7 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -54,15 +54,23 @@ curl -sS -A "upstream-watch" "https://crates.io/api/v1/crates/$crate/$v/dependen cargo update -p --precise cargo audit ---- -. Find which estate repositories carry a crate, from a directory of clones: +. Find which estate repositories carry a crate, from a directory of clones. + The search recurses, because some repositories keep their Rust workspaces + below the root. Each match prints the lockfile path, which starts with the + repository name. + [source,bash] ---- crate=zvariant -for lock in */Cargo.lock; do - grep -q "^name = \"$crate\"$" "$lock" && echo "${lock%/Cargo.lock}" +for repo in */; do + find "$repo" -name Cargo.lock -not -path '*/target/*' \ + -exec grep -l "^name = \"$crate\"$" {} + done ---- +. Run every `cargo tree` check on this page with `--target all --workspace`. + By default `cargo tree` shows only the host platform and the current + workspace member, so a Linux-only dependency can look absent on another + host. == Watching @@ -83,18 +91,19 @@ https://github.com/z-galaxy/zbus/issues/2043 Linux screen-reader (AT-SPI) support. It is present only when the `accesskit` feature is on. That feature is in `eframe`'s default set, but opt-in for standalone `egui-winit`. -|Local workaround |Building `eframe` without its `accesskit` feature drops the -whole chain, at the cost of screen-reader support. Prefer waiting for the -upstream release unless the advisory must clear sooner. +|Local workaround |Turn off the `accesskit` feature on whichever crate the +repository depends on directly: `eframe`, or `egui-winit` when it is used on +its own. That drops the whole chain, at the cost of screen-reader support. +Prefer waiting for the upstream release unless the advisory must clear sooner. |Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and `zbus ^5.19`. |Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, then `accesskit_atspi_common` and `accesskit_unix` following it, then an `accesskit_winit` and `egui-winit` / `eframe` release that takes those. -|Action when cleared |Bump `eframe` in each affected repository. This is a -manifest change and may carry egui API breaks, so build and test the GUI -feature before merging. +|Action when cleared |Bump the crate each affected repository depends on +directly, `eframe` or `egui-winit`. This is a manifest change and may carry +egui API breaks, so build and test the GUI feature before merging. |Known affected |`hyperpolymath/panic-attack`. Only its opt-in `gui` feature compiles the chain into a binary. Its `cargo audit` still reports the advisories on every build, because the audit reads `Cargo.lock` and Cargo @@ -119,7 +128,8 @@ without `winit/default`. Wayland windows then lose Adwaita client-side decorations on compositors that do not draw server-side decorations. This works only if no other dependency turns `winit/default` back on, since Cargo merges features across the dependency graph. Confirm that -`cargo tree -e features -i sctk-adwaita` finds no `sctk-adwaita` before relying +`cargo tree --target all --workspace -e features -i sctk-adwaita` finds no +`sctk-adwaita` before relying on it. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory @@ -176,8 +186,9 @@ cargo update -p wayland-scanner |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds `quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same -reason. Run `cargo tree -i quick-xml@` first. The two commands above -fix it only when the parent is `zbus_xml` or `wayland-scanner`. A direct +reason. Run `cargo tree --target all --workspace -i quick-xml@` +first. The two commands above fix it only when the parent is `zbus_xml` or +`wayland-scanner`. A direct dependency needs its requirement in `Cargo.toml` raised, and any other parent needs that parent upgraded. |=== From 0bbc820f4276088d739275037496c462dae50dda Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:55:45 +0000 Subject: [PATCH 7/9] docs: all-features tree checks, lockstep gates, crossfont W2 option Fifth review round on the upstream dependency watch list: - Every cargo tree check adds `--all-features`; without it a crate behind an opt-in feature (such as a `gui` feature) can look absent even though `cargo audit` finds it in Cargo.lock. - W1 gates add zbus-lockstep, zbus-lockstep-macros and zbus_xml, which atspi-common pulls in and which reach the retired crates on their own. - W2 workaround gains a second option: keep Adwaita decorations through winit's `wayland-csd-adwaita-crossfont` (FreeType + fontconfig) instead of ab_glyph. The confirmation check now looks for ttf-parser itself. Checked: with eframe defaults off and a direct winit 0.30.13 dependency on `wayland-csd-adwaita-crossfont`, the lockfile keeps sctk-adwaita and crossfont but has no ab_glyph or ttf-parser; the documented ttf-parser check finds nothing. The R1 check with `--all-features` names zbus_xml 5.1.0 as quick-xml 0.38.4's parent in panic-attack's pre-fix lockfile. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 43 +++++++++++++++++++---------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index f3f23bd7..b1ce9559 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -33,7 +33,9 @@ estate-wide claim, because *Known affected* is not a full census. . Look up every crate in the *Unblocking release* chain on crates.io and read the dependency requirements of each crate's newest release. For W1, check `atspi-common`, `atspi`, `accesskit_atspi_common`, `accesskit_unix`, - `accesskit_winit`, `egui-winit`, and `eframe`. Repeat the lookup below for + `accesskit_winit`, `egui-winit`, and `eframe`. Also check `zbus-lockstep`, + `zbus-lockstep-macros` and `zbus_xml`, which `atspi-common` pulls in and which + reach the retired crates on their own. Repeat the lookup below for each gate; consider the entry unblocked only when every gate's newest release accepts the fixed dependencies through the entire chain. + @@ -67,10 +69,12 @@ for repo in */; do -exec grep -l "^name = \"$crate\"$" {} + done ---- -. Run every `cargo tree` check on this page with `--target all --workspace`. - By default `cargo tree` shows only the host platform and the current - workspace member, so a Linux-only dependency can look absent on another - host. +. Run every `cargo tree` check on this page with + `--target all --workspace --all-features`. By default `cargo tree` shows only + the host platform, the current workspace member and default features. A + Linux-only dependency, or one behind an opt-in feature such as a `gui` + feature, can then look absent even though `cargo audit` finds it in + `Cargo.lock`. == Watching @@ -98,7 +102,8 @@ Prefer waiting for the upstream release unless the advisory must clear sooner. |Blocked on, as of 2026-10-19 |`atspi-common` 0.14.0 and `atspi` 0.30.0 still require `zbus ^5.5`. `accesskit_unix` 0.24.0 requires `atspi ^0.29` and `zbus ^5.19`. -|Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, then +|Unblocking release |An `atspi` / `atspi-common` release on `zbus ^6`, with its +`zbus-lockstep` and `zbus_xml` dependencies also off the zbus 5 crates. Then `accesskit_atspi_common` and `accesskit_unix` following it, then an `accesskit_winit` and `egui-winit` / `eframe` release that takes those. |Action when cleared |Bump the crate each affected repository depends on @@ -122,15 +127,22 @@ This is not a full census. `owned_ttf_parser` -> `ttf-parser`. This is the Wayland client-side window decoration path. It comes from `winit`'s `wayland-csd-adwaita` feature, which `eframe`'s default `winit/default` feature turns on. -|Local workaround |Disable `eframe`'s default features and re-enable the ones +|Local workaround a|Disable `eframe`'s default features and re-enable the ones the application needs (for example `wayland`, `x11`, `accesskit` and a renderer) -without `winit/default`. Wayland windows then lose Adwaita client-side -decorations on compositors that do not draw server-side decorations. This works -only if no other dependency turns `winit/default` back on, since Cargo merges -features across the dependency graph. Confirm that -`cargo tree --target all --workspace -e features -i sctk-adwaita` finds no -`sctk-adwaita` before relying -on it. +without `winit/default`. Then choose one of two options: + +* Drop the Adwaita decorations. Wayland windows lose client-side decorations +on compositors that do not draw server-side ones. +* Keep them by adding a direct `winit` dependency at the same version, with +default features off and the `wayland-csd-adwaita-crossfont` feature on. That +draws the decorations through FreeType and fontconfig, two C libraries, instead +of `ab_glyph`. + +Either option holds only if nothing else turns `winit/default` or +`wayland-csd-adwaita` back on, because Cargo merges features across the +dependency graph. Confirm that +`cargo tree --target all --workspace --all-features -i ttf-parser` finds no +`ttf-parser` before relying on it. |Blocked on, as of 2026-10-19 |`ab_glyph` 0.2.32 requires `owned_ttf_parser ^0.25`, which requires `ttf-parser ^0.25.1`. The advisory names `skrifa` as the maintained alternative. @@ -186,7 +198,8 @@ cargo update -p wayland-scanner |Applied in |`hyperpolymath/panic-attack`, pull requests 222 and 231. |Estate follow-up |Any other Rust repository whose lockfile still holds `quick-xml` below 0.41.0 (including 0.40) fails `cargo audit` for the same -reason. Run `cargo tree --target all --workspace -i quick-xml@` +reason. Run +`cargo tree --target all --workspace --all-features -i quick-xml@` first. The two commands above fix it only when the parent is `zbus_xml` or `wayland-scanner`. A direct dependency needs its requirement in `Cargo.toml` raised, and any other parent From 2c979b64933581f541aff1cd8d26f3ec133b72d9 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:03:15 +0000 Subject: [PATCH 8/9] docs: noyalib version floor, qualify the cargo-audit exit status Sixth review round on the upstream dependency watch list: - W3: `noyalib` releases before 0.0.53 carry RUSTSEC-2026-0333, a denial-of-service vulnerability (patched >= 0.0.53 per the RustSec database), so the replacement guidance now sets that floor. serde-saphyr has no RustSec advisories. - W1: an unmaintained advisory makes `cargo audit` exit 0 only by default; an audit.toml that denies `unmaintained` or `warnings` turns it into a non-zero exit. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index b1ce9559..88f348de 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -84,7 +84,8 @@ done |=== |Advisories |RUSTSEC-2026-0370 (`zvariant`), RUSTSEC-2026-0371 (`zbus_names`), RUSTSEC-2026-0372 (`zvariant_derive`). All informational (`unmaintained`), -reported 2026-10-16. `cargo audit` warns but exits 0. +reported 2026-10-16. By default `cargo audit` warns but exits 0. It exits +non-zero if an `audit.toml` denies `unmaintained` or `warnings`. |Cause |zbus 6 folded these crates into `zbus` itself. `zvariant` became the `wire` module, `zbus_names` became the `names` module, and `zbus` now provides the `zvariant_derive` macros. The 5.x crates get no further releases. Upstream @@ -169,8 +170,9 @@ translation of libyaml in unsafe Rust. not be revived, so waiting does not clear this. Move to *Resolved* once the replacement is applied in every known affected repository. |Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory -suggests `serde-saphyr` for serde users, or `noyalib`. Avoid `serde_yaml_ng`, -which still depends on `unsafe-libyaml`. +suggests `serde-saphyr` for serde users, or `noyalib`. Use `noyalib` 0.0.53 or +later, because earlier releases carry RUSTSEC-2026-0333, a denial-of-service +vulnerability. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. |Known affected |`hyperpolymath/panic-attack` declares `serde_yaml = "0.9"` directly. This is not a full census. |=== From 4dea0debad2322077ae7991b4ba20adc430ec751 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 13:23:30 +0000 Subject: [PATCH 9/9] docs(watch): resolve W3 unsafe-libyaml after panic-attack#234 hyperpolymath/panic-attack#234 replaced serde_yaml with serde-saphyr 2.0, so RUSTSEC-2024-0449 is clear in every known affected repository. Move W3 out of Local remediation and record it as R2 under Resolved, keeping "was W3" for traceability. The entry records what the fix needed beyond the swap: the minimum Rust version (no maintained safe-Rust serde YAML crate builds on 1.85, and the noyalib releases that do predate RUSTSEC-2026-0333), and the parse-budget scaling that large machine-written documents need. echidna was checked clear. The follow-up line says how to find the parent in any other repo. Rendered with asciidoctor --failure-level=WARN: no warnings. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01PFaqv6iBXrt3W5Akd1Fq5k --- docs/UPSTREAM-DEPENDENCY-WATCH.adoc | 51 +++++++++++++++++++---------- 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc index 88f348de..167e01bb 100644 --- a/docs/UPSTREAM-DEPENDENCY-WATCH.adoc +++ b/docs/UPSTREAM-DEPENDENCY-WATCH.adoc @@ -158,24 +158,7 @@ This is not a full census. == Local remediation -=== W3: `unsafe-libyaml` unmaintained, via `serde_yaml` - -[cols="1,3"] -|=== -|Advisory |RUSTSEC-2024-0449, informational (`unmaintained`). The upstream -repository was archived on 2024-03-25. -|Path in |`serde_yaml` 0.9 (itself deprecated) -> `unsafe-libyaml`, a c2rust -translation of libyaml in unsafe Rust. -|Status |Locally remediable; no upstream release is needed. `serde_yaml` will -not be revived, so waiting does not clear this. Move to *Resolved* once the -replacement is applied in every known affected repository. -|Local fix |Replace `serde_yaml` with a YAML parser in safe Rust. The advisory -suggests `serde-saphyr` for serde users, or `noyalib`. Use `noyalib` 0.0.53 or -later, because earlier releases carry RUSTSEC-2026-0333, a denial-of-service -vulnerability. Avoid `serde_yaml_ng`, which still depends on `unsafe-libyaml`. -|Known affected |`hyperpolymath/panic-attack` declares `serde_yaml = "0.9"` -directly. This is not a full census. -|=== +No entries. == Resolved @@ -207,3 +190,35 @@ first. The two commands above fix it only when the parent is `zbus_xml` or dependency needs its requirement in `Cargo.toml` raised, and any other parent needs that parent upgraded. |=== + +=== R2 (was W3): `unsafe-libyaml` unmaintained, via `serde_yaml` (resolved 2026-10-20) + +[cols="1,3"] +|=== +|Advisory |RUSTSEC-2024-0449, informational (`unmaintained`). The upstream +repository was archived on 2024-03-25. +|Path in |`serde_yaml` 0.9 (itself deprecated) -> `unsafe-libyaml`, a c2rust +translation of libyaml in unsafe Rust. +|Fix |Replace `serde_yaml` with `serde-saphyr` 2.0, a serde YAML crate in safe +Rust (`#![forbid(unsafe_code)]`). Avoid `serde_yaml_ng`, which still depends on +`unsafe-libyaml`. `noyalib` is the other safe option, at 0.0.53 or later, +because earlier releases carry RUSTSEC-2026-0333. +|Minimum Rust version |`serde-saphyr` 1.2 and later declare Rust 1.89, and 1.1.0 +compiles only on 1.88 or later despite declaring none. `noyalib` releases after +0.0.15 need 1.86 or later. The releases that still build on 1.85 are frozen and +pre-1.0, and every `noyalib` release in that range predates the RUSTSEC-2026-0333 +fix. A repository on an older floor raises it rather than pinning one. +|Resource limits |`serde-saphyr` parses within a resource budget. Its defaults +(250k nodes, 1M events, 64 MiB of scalar text) suit hand-written configuration, +but reject large machine-written documents. For those, scale the node, event and +scalar-byte limits with the input length and leave the alias limits at their +defaults. +|Applied in |`hyperpolymath/panic-attack`, pull request 234 (MSRV raised from +1.85.0 to 1.89). +|Checked clear |`hyperpolymath/echidna`: no lockfile holds `unsafe-libyaml`. +This is not a full census. +|Estate follow-up |Any other Rust repository whose lockfile holds +`unsafe-libyaml`. Run +`cargo tree --target all --workspace --all-features -i unsafe-libyaml` to find +the parent, then swap it as above. +|===