…stall command (#16) * patch certifi and desktop cargo advisories and fix the cargo-about install command - certifi 2026.6.17 -> 2026.10.19 in the harbor testbed uv.lock (GHSA-6q48-6c7w-9gw2, Dependabot alert block#101). The parent benchmark lock already took this bump in #13. - desktop/src-tauri/Cargo.lock: h2 0.4.15 -> 0.4.16 (RUSTSEC-2026-0258), rtrb 0.3.4 -> 0.3.5 (RUSTSEC-2026-0274) and the yanked chacha20 0.10.1 -> 0.10.2. h2 and chacha20 now match the workspace lock. Only these three packages change. - cargo-about 0.9.2 builds its binary only with the `cli` feature, so the install command in licenses/README.md and in the generator docstring now passes `--features cli`. - Regenerated the native notices with cargo-about 0.9.2. The remaining desktop advisories are unmaintained-crate notices with no upgrade: mach (user-idle), proc-macro-error (gtk-rs 0.18 via tray-icon) and unic-* (urlpattern via tauri-utils). Signed-off-by: Brendan Smith-Elion <brendan.smith-elion@arcadia.io> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CqT7EqwYMQoSjcRi3Ch29f * check the desktop lockfile with cargo-deny in the Security job The Security job ran `cargo-deny check` against the workspace lock only, and CI skipped it when only desktop/src-tauri changed, so nothing checked desktop/src-tauri/Cargo.lock. - The Security job now also runs `cargo-deny check advisories bans` from desktop/src-tauri, using the hermit-pinned cargo-deny. Security Domain and the Security gate run for desktop-rust changes too. The workspace step keeps its rust-only selection. - desktop/src-tauri/deny.toml is the desktop policy. cargo-deny reads one config per run, so the root deny.toml gains no ignores. The graph enables all features because macOS and Linux releases ship `mesh-llm`. Each ignore names the desktop path and why it is acceptable: unmaintained crates with no upgrade (instant, mach, paste, proc-macro-error, unic-*, unsafe-libyaml, zbus 5 crates), quick-xml in a dev-dependency only, ringbuf in neteq only (with the same wrapper ban as the workspace), and zip, which tauri-plugin-updater extracts on Windows only after its signature check and which mesh-llm never extracts. - desktop/src-tauri/Cargo.lock: negentropy 0.5.0 -> 0.5.2 (RUSTSEC-2026-0365, mesh-llm feature). The yanked async-utility 0.3.1, spin 0.9.8 and spin 0.10.0 move to 0.3.2, 0.9.9 and 0.10.1. All four now match the workspace lock, and only these packages change. - Regenerated the native notices with cargo-about 0.9.2. Signed-off-by: Brendan Smith-Elion <brendan.smith-elion@arcadia.io> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CqT7EqwYMQoSjcRi3Ch29f --------- Signed-off-by: Brendan Smith-Elion <brendan.smith-elion@arcadia.io> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Custom emoji #101

Description

Activity

wpfleger96 commented on Jun 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions