Skip to content

fix(security): patch Studio async dependencies and GLib iterator #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rjwalters merged 3 commits into from
Oct 23, 2026
Merged

fix(security): patch Studio async dependencies and GLib iterator #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1224409
fix: patch Tokio and event-listener soundness issues
rjwalters Oct 23, 2026
b007d44
fix(security): backport GLib string iterator safety
rjwalters Oct 23, 2026
3064e2c
fix(ci): run security checks on the default branch
rjwalters Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Rust dependency security
on:
pull_request:
push:
branches: [master]
permissions:
contents: read
jobs:
glib-iterator-safety:
name: Vendored GLib iterator safety
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Checkout repository
uses: actions/checkout@v7
- name: Install native GLib dependencies
run: sudo apt-get update && sudo apt-get install -y libglib2.0-dev pkg-config
- name: Install stable Rust
uses: dtolnay/rust-toolchain@stable
- name: Optimized upstream library tests
run: cargo test --manifest-path vendor/glib/Cargo.toml --release --locked --lib
- name: Optimized string iterator regressions
run: cargo test --manifest-path vendor/glib/Cargo.toml --release --locked --test security_variant_iter
11 changes: 4 additions & 7 deletions apps/studio/src-tauri/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/studio/src-tauri/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,6 @@ serde_json = "1"
serialport = "4.9.0"
tauri-plugin-blec = "0.12"

[patch.crates-io]
# RUSTSEC-2024-0429: retain Tauri compatibility with the upstream iterator fix.
glib = { path = "../../../vendor/glib" }
6 changes: 6 additions & 0 deletions vendor/glib/.cargo_vcs_info.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"git": {
"sha1": "42b9caf98e03ded086362d9653ca58fe94dc8658"
},
"path_in_vcs": "glib"
}
14 changes: 14 additions & 0 deletions vendor/glib/COPYRIGHT
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
The gtk-rs Project is licensed under the MIT license, see the LICENSE file or
<http://opensource.org/licenses/MIT>.

Copyrights in the gtk-rs Project project are retained by their contributors.
No copyright assignment is required to contribute to the gtk-rs Project
project.

For full authorship information, see the version control history.

This project provides interoperability with various GNOME libraries but
doesn't distribute any parts of them. Distributing compiled libraries and
executables that link to those libraries may be subject to terms of the GNU
LGPL or other licenses. For more information check the license of each GNOME
library.
Loading
Loading