Update dependencies for security advisories#493
Conversation
Deploying maple with
|
| Latest commit: |
ac784f3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b7c7a1d7.maple-ca8.pages.dev |
| Branch Preview URL: | https://chore-security-dependency-up.maple-ca8.pages.dev |
📝 WalkthroughWalkthroughConsolidates frontend dependency upgrades, adds a vendored patched Changes
Sequence Diagram(s)Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Reminder before merge: preview Pages now uses |
|
Cloudflare preview build now passes after switching the Pages preview build system to v3 and using |
Bump npm and Rust dependencies to patched versions, including maple-proxy 0.1.8 and a temporary phf_generator patch for the remaining Tauri rand advisory chain. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
AnthonyRonning
force-pushed
the
chore/security-dependency-updates-20260424
branch
from
e23571f to
ac784f3
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (2)
frontend/src/routeTree.gen.ts (1)
11-33: Configure TanStack Router or explicitly exempt generated route tree from path alias policy.The imports in lines 11–33 use relative paths (
./routes/...) rather than the configured path aliases (@/...). However, sincerouteTree.gen.tsis auto-generated and should not be hand-edited, the appropriate fix is to either configure the TanStack Router generator to emit path-aliased imports or add an explicit exemption in the project's linting/import rules for this generated file.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@frontend/src/routeTree.gen.ts` around lines 11 - 33, The generated route tree uses relative imports (e.g., the symbols import { Route as rootRouteImport }, TermsRouteImport, AuthChatChatIdRouteImport in routeTree.gen.ts) which violates your path-alias policy; fix this by either configuring the TanStack Router codegen to emit aliased imports (update the router generator options to use "@/routes/..." for generated imports) or add an explicit lint/import rule exemption for this generated file (create an override for routeTree.gen.ts in your ESLint/TSLint/import rules to allow ./routes/* or disable the specific rule for this file).frontend/src-tauri/vendor/phf_generator-0.8.0/src/lib.rs (1)
5-21: Use a reproducible RNG type if cross-environment determinism is required.Line 5/Line 18 use
SmallRngwith a fixed seed, butSmallRngdoes not guarantee portable deterministic output across platforms or future rand updates. It uses different algorithms on 32-bit (Xoshiro128PlusPlus) and 64-bit (Xoshiro256PlusPlus) platforms, and the algorithm may change in future versions. For stable PHF generation, use an explicitly fixed algorithm RNG likerand_chacha::ChaCha8Rng, which is the official recommendation for reproducible streams.Suggested change in this file
-use rand::rngs::SmallRng; +use rand_chacha::ChaCha8Rng; use rand::{Rng, SeedableRng}; @@ - SmallRng::seed_from_u64(FIXED_SEED) + ChaCha8Rng::seed_from_u64(FIXED_SEED) .sample_iter(Standard)(Also add
rand_chachainfrontend/src-tauri/vendor/phf_generator-0.8.0/Cargo.tomlif you apply this.)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@frontend/src-tauri/vendor/phf_generator-0.8.0/src/lib.rs` around lines 5 - 21, The PR uses SmallRng with FIXED_SEED in generate_hash which is not cross-platform deterministic; replace SmallRng with an explicit algorithm like rand_chacha::ChaCha8Rng, update the imports (use rand_chacha::ChaCha8Rng; keep SeedableRng and sample_iter(Standard) usage), call ChaCha8Rng::seed_from_u64(FIXED_SEED) where SmallRng was used, and add rand_chacha to the vendor crate's Cargo.toml; ensure the rest of the flow (try_generate_hash, HashState, etc.) remains unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@frontend/src-tauri/vendor/phf_generator-0.8.0/src/lib.rs`:
- Around line 5-21: The PR uses SmallRng with FIXED_SEED in generate_hash which
is not cross-platform deterministic; replace SmallRng with an explicit algorithm
like rand_chacha::ChaCha8Rng, update the imports (use rand_chacha::ChaCha8Rng;
keep SeedableRng and sample_iter(Standard) usage), call
ChaCha8Rng::seed_from_u64(FIXED_SEED) where SmallRng was used, and add
rand_chacha to the vendor crate's Cargo.toml; ensure the rest of the flow
(try_generate_hash, HashState, etc.) remains unchanged.
In `@frontend/src/routeTree.gen.ts`:
- Around line 11-33: The generated route tree uses relative imports (e.g., the
symbols import { Route as rootRouteImport }, TermsRouteImport,
AuthChatChatIdRouteImport in routeTree.gen.ts) which violates your path-alias
policy; fix this by either configuring the TanStack Router codegen to emit
aliased imports (update the router generator options to use "@/routes/..." for
generated imports) or add an explicit lint/import rule exemption for this
generated file (create an override for routeTree.gen.ts in your
ESLint/TSLint/import rules to allow ./routes/* or disable the specific rule for
this file).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 39138c24-bfe6-4264-bbcf-b951b8d1cc7d
⛔ Files ignored due to path filters (2)
frontend/bun.lockis excluded by!**/*.lockfrontend/src-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
frontend/package.jsonfrontend/src-tauri/Cargo.tomlfrontend/src-tauri/vendor/phf_generator-0.8.0/.gitignorefrontend/src-tauri/vendor/phf_generator-0.8.0/Cargo.tomlfrontend/src-tauri/vendor/phf_generator-0.8.0/README.mdfrontend/src-tauri/vendor/phf_generator-0.8.0/src/lib.rsfrontend/src/components/ui/badge.tsxfrontend/src/components/ui/button.tsxfrontend/src/components/ui/sheet.tsxfrontend/src/routeTree.gen.ts
✅ Files skipped from review due to trivial changes (7)
- frontend/src-tauri/vendor/phf_generator-0.8.0/.gitignore
- frontend/src/components/ui/sheet.tsx
- frontend/src/components/ui/badge.tsx
- frontend/src-tauri/vendor/phf_generator-0.8.0/README.md
- frontend/src-tauri/vendor/phf_generator-0.8.0/Cargo.toml
- frontend/src/components/ui/button.tsx
- frontend/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
- frontend/src-tauri/Cargo.toml
|
@TestFlight build |
|
🚀 TestFlight deployment triggered! Check the Actions tab for progress. |
|
✅ TestFlight deployment completed successfully! |
1 participant
Summary
bun auditfindings, includingviteanduuidmaple-proxy0.1.8,openssl0.10.78,rustls-webpki0.103.13,bytes1.11.1,tar0.4.45, andtime0.3.47phf_generator0.8.0 patch to replace the remaining Tauri transitiverand0.7.x path withrand0.8.6Validation
bun install --frozen-lockfilebun auditjust rust-lintcargo testbun testjust buildjust lint(warnings only)bun run format:checkSummary by CodeRabbit