Dependency Audit #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Audit | |
| on: | |
| schedule: | |
| - cron: '0 9 * * 1' # Weekly Monday 9am UTC | |
| workflow_dispatch: | |
| jobs: | |
| rust-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| # Prebuilt binary instead of `cargo install cargo-audit`, which compiled from | |
| # source (~3 min) on every run. | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit | |
| # Audit F043: ignore transitive warning-level advisories (unmaintained/unsound, | |
| # 0 actual vulnerabilities), reachability-validated as not exploitable here on | |
| # 2026-06-17. GTK3-rs bindings (atk/gdk/gtk/gtk-sys/glib/gdkx11/gdkwayland) compile | |
| # only on the Linux webview target (Windows is the primary platform); proc-macro-error, | |
| # unic-*, and fxhash are build-time/transitive; rand is unused by app code | |
| # (RUSTSEC-2026-0097 requires rand::rng() + a custom logger). Re-review yearly. | |
| - run: > | |
| cargo audit --file src-tauri/Cargo.lock | |
| --ignore RUSTSEC-2024-0370 | |
| --ignore RUSTSEC-2024-0411 | |
| --ignore RUSTSEC-2024-0412 | |
| --ignore RUSTSEC-2024-0413 | |
| --ignore RUSTSEC-2024-0414 | |
| --ignore RUSTSEC-2024-0415 | |
| --ignore RUSTSEC-2024-0416 | |
| --ignore RUSTSEC-2024-0417 | |
| --ignore RUSTSEC-2024-0418 | |
| --ignore RUSTSEC-2024-0419 | |
| --ignore RUSTSEC-2024-0420 | |
| --ignore RUSTSEC-2024-0429 | |
| --ignore RUSTSEC-2025-0057 | |
| --ignore RUSTSEC-2025-0075 | |
| --ignore RUSTSEC-2025-0080 | |
| --ignore RUSTSEC-2025-0081 | |
| --ignore RUSTSEC-2025-0098 | |
| --ignore RUSTSEC-2025-0100 | |
| --ignore RUSTSEC-2026-0097 | |
| npm-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: { node-version: '22' } | |
| # --omit=dev: audit only deps shipped in the app (the webview runtime). Build-only | |
| # tooling (vite/vitest/knip) lives in devDependencies; its advisories (e.g. the | |
| # vite dev-server CVEs) never reach the shipped binary. | |
| - run: npm audit --omit=dev --audit-level=high |