From 3ed07e5c758fe14c3712e6e8309dfe90942f1d81 Mon Sep 17 00:00:00 2001 From: Matt Toohey Date: Thu, 29 Oct 2026 01:20:44 +1100 Subject: [PATCH] fix(deps): bump pulldown-cmark to 0.13.5 for RUSTSEC-2026-0414 (#8644) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Bumps `pulldown-cmark` 0.13.4 → 0.13.5 in `Cargo.lock` to clear [RUSTSEC-2026-0414](https://rustsec.org/advisories/RUSTSEC-2026-0414), which `cargo-deny` started flagging this morning. The advisory landed in the RustSec database at 08:50 UTC on 2026-10-28; main's last Security run passed at 00:24 UTC, and every PR touching a Rust path since (e.g. #8613, `jitter/block-staging-relay-domain`) fails the required **Security** check on it. Main will go red on its next Rust-path push until this merges. ## Exposure Not exploitable in Buzz: the advisory requires `Options::ENABLE_WIKILINKS`, which is off by default. The relay's only use is `render_policy_document` in `crates/buzz-relay/src/api/invites.rs`, which parses operator-authored policy Markdown via `Parser::new` with default options. This is a dependency-policy fix. ## Change - `cargo update -p pulldown-cmark --precise 0.13.5` under the pinned 1.98.1 toolchain; `crates/buzz-relay/Cargo.toml` already requires `0.13.4` (`^0.13.4`), so no manifest edit. - The same re-resolution moved `data-encoding-macro-internal`'s `syn` edge from 2.0.117 to the 1.0.109 already in the lock (declared requirement `>=1, <3`). No crate is added or removed. - `desktop/src-tauri/Cargo.lock` does not contain `pulldown-cmark`, and `cargo-deny` only checks the root workspace. Not touched here: `deny.toml:50`'s `RUSTSEC-2026-0381` ignore now warns `advisory-not-detected` (the crate is gone). Harmless; can be removed separately. ## Verification - `cargo update --dry-run` showed `pulldown-cmark` as the only version change before applying. - CI's Security lane on this PR is the real check. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Matt Toohey Co-authored-by: Claude Fable 5.1 --- Cargo.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1cb97df5cd..16ae718739 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2597,7 +2597,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" dependencies = [ "data-encoding", - "syn 2.0.117", + "syn 1.0.109", ] [[package]] @@ -7958,9 +7958,9 @@ dependencies = [ [[package]] name = "pulldown-cmark" -version = "0.13.4" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e" +checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" dependencies = [ "bitflags 2.13.0", "memchr",