After #809, cargo audit on merged beta reports zero vulnerabilities but retains informational warnings:
- 16 unmaintained GTK3/gtk-rs transitive crates through Tauri/WebKitGTK.
glib 0.18.5 unsound advisory; current OpenLess code does not call the affected VariantStrIter::as_ref API.memmap2 0.8.0 unsound advisory through enigo -> xkbcommon; current OpenLess code does not call the affected Mmap::map_copy_read_only API.
These cannot be removed by a safe leaf-version bump: they require an upstream Tauri/WebKitGTK/GTK4 and/or enigo/xkbcommon migration.
Acceptance for a future change:
- Upgrade the owning dependency chain to maintained releases without patching advisories away.
- Re-run Linux Wayland/X11 startup, global hotkeys, insertion, tray, and packaging tests.
- Keep
cargo audit at zero vulnerabilities and eliminate the applicable informational warnings.
- If upstream remains blocked, periodically record exact dependency graph and reachability instead of adding blanket ignores.
This is tracked but does not block the current Beta because the high advisories are fixed and the warned APIs are not reached.
After #809,
cargo auditon mergedbetareports zero vulnerabilities but retains informational warnings:glib 0.18.5unsound advisory; current OpenLess code does not call the affectedVariantStrIter::as_refAPI.memmap2 0.8.0unsound advisory throughenigo -> xkbcommon; current OpenLess code does not call the affectedMmap::map_copy_read_onlyAPI.These cannot be removed by a safe leaf-version bump: they require an upstream Tauri/WebKitGTK/GTK4 and/or enigo/xkbcommon migration.
Acceptance for a future change:
cargo auditat zero vulnerabilities and eliminate the applicable informational warnings.This is tracked but does not block the current Beta because the high advisories are fixed and the warned APIs are not reached.