From f9b53ca316ff3df0d85827c01a5a98fd646699d2 Mon Sep 17 00:00:00 2001 From: QuicksilverSlick Date: Wed, 16 Sep 2026 18:31:00 -0500 Subject: [PATCH] fix(deps): bump h2, rtrb and chacha20 in the desktop lockfile cargo-deny on desktop/src-tauri (not covered by CI's Security job) reports: - RUSTSEC-2026-0258: h2 0.4.15 accepts unbounded empty DATA frames. Bump to 0.4.16, the version the root lockfile already uses. - RUSTSEC-2026-0274: rtrb 0.3.4 double free in ReadChunk::commit when an element's Drop panics (via rodio). Bump to the 0.3.5 backport. - chacha20 0.10.1 is yanked (via rand 0.10.2). Bump to 0.10.2. Only the three package entries change. `cargo update -p h2` also re-picked windows-sys for ~15 unrelated crates, so the h2 entry was applied by hand; h2 0.4.16 has the same dependency list as 0.4.15, the checksum matches the root lockfile, and `cargo metadata --locked` and `cargo fetch --locked` accept the result. Co-Authored-By: Claude Opus 5 --- desktop/src-tauri/Cargo.lock | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 7a3669f440e..764817914e7 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1493,9 +1493,9 @@ dependencies = [ [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if 1.0.4", "cpufeatures 0.3.0", @@ -3592,9 +3592,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.15" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", @@ -8206,7 +8206,7 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "chacha20 0.10.1", + "chacha20 0.10.2", "getrandom 0.4.3", "rand_core 0.10.1", ] @@ -8755,9 +8755,9 @@ dependencies = [ [[package]] name = "rtrb" -version = "0.3.4" +version = "0.3.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ade083ccbb4bf536df69d1f6432cc23deb7acccff86b183f3923a6fd56a1153" +checksum = "fae8ee26b0371a29a77d2b2d6b3ae13aa81def6f9bf1b1b92a32d279a5e709b7" [[package]] name = "rubato"