chore(deps): bump actions/cache from 5 to 6 - #793
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v5...v6) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Quality Ratchet ReportMode: Resumo
❌ Regressões Detectadas
|
Coverage Report (cargo-llvm-cov)Generated by Excluded crates: |
michelbr84
added a commit
that referenced
this pull request
Aug 16, 2026
…me 45.0.3) (#796) * fix(security): GAR-895 — RUSTSEC-2026-0187 + 0188 (lopdf 0.42, wasmtime 45.0.3) - lopdf 0.40 → 0.42 in garraia-media (RUSTSEC-2026-0187: stack overflow via deeply nested PDF objects; 0.41 also affected, fix requires >=0.42.0) - wasmtime-wasi 45.0.2 → 45.0.3 in Cargo.lock (RUSTSEC-2026-0188: WASI hard-links/renames bypass FilePerms; fixed in >=45.0.3, <46.0.0); cranelift 0.132.2 → 0.132.3 pulled in as part of the same atomic release Both cargo-deny and security-audit gates were failing on all open Dependabot PRs (#793, #794, #795) due to these advisories published 2026-06-29. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EMkJ4VRMNhmdrYaYGMAr2V * fix(security): GAR-895 amend — RUSTSEC-2026-0190 (anyhow 1.0.103) anyhow 1.0.102 has unsoundness in Error::downcast_mut() — violates borrow rules, resulting in UB when context is added and then downcast_mut called (RUSTSEC-2026-0190). Upgrade to 1.0.103 which fixes the borrow chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EMkJ4VRMNhmdrYaYGMAr2V * fix(security): GAR-895 amend 2 — mirror 6 unmaintained IDs to audit.toml cargo-audit ^0.22 now exits 1 for `unmaintained` advisories under `--deny unsound`, breaking the Security Audit CI gate. Prior assumption that unmaintained advisories were "auto-classified as allowed warnings" (SYNC NOTE) is no longer correct. Mirror 6 IDs already in deny.toml with proper Linear owners: - RUSTSEC-2026-0173 (proc-macro-error2 2.0.1) — GAR-817, exp 2026-07-31 - RUSTSEC-2025-0075 (unic-char-range 0.9.0) — GAR-430, exp 2026-07-31 - RUSTSEC-2025-0080 (unic-common 0.9.0) — GAR-430, exp 2026-07-31 - RUSTSEC-2025-0081 (unic-char-property 0.9.0) — GAR-430, exp 2026-07-31 - RUSTSEC-2025-0098 (unic-ucd-version 0.9.0) — GAR-430, exp 2026-07-31 - RUSTSEC-2025-0100 (unic-ucd-ident 0.9.0) — GAR-430, exp 2026-07-31 Also updates SYNC NOTE to document the behavior change and correct the asymmetry rule: only mirror IDs that actually appear in Cargo.lock and trigger cargo-audit; gtk-rs family remains deny.toml-only. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EMkJ4VRMNhmdrYaYGMAr2V * fix(security): GAR-895 amend 3 — fix 6 new vulns + clippy Security Audit CI (cargo audit --deny unsound) was failing with 6 vulnerabilities. All 6 resolved via lockfile-only updates: • RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18 → 0.9.20 (Invalid pointer dereference in fmt::Pointer impl for Atomic/Shared) • RUSTSEC-2026-0194 — quick-xml 0.37.5 removed, 0.39.4 → 0.41.0 • RUSTSEC-2026-0195 — (same quick-xml bump; both IDs patched by >=0.41.0) plist 1.9.0 → 1.10.0 brought quick-xml 0.39.4 → 0.41.0; tauri-winrt-notification 0.7.2 → 0.7.3 dropped quick-xml 0.37.5. Both consumers are garraia-desktop / Tauri-only. • RUSTSEC-2026-0185 — quinn-proto 0.11.14 → 0.11.16 (Remote memory exhaustion via unbounded out-of-order stream reassembly) Clippy: fix 3 clippy::for_kv_map errors in crates/garraia-gateway/src/admin/secrets.rs:466/470/474 for (_, x) in map.iter_mut() → for x in map.values_mut() * fix(security): GAR-895 amend 4 — deny.toml ignore ttf-parser RUSTSEC-2026-0192 ttf-parser 0.25.1 unmaintained (author archived 2026-06-28, RUSTSEC-2026-0192). cargo-deny errors on this because deny.toml classifies `unmaintained` as deny. No safe upgrade path: advisory says "No safe upgrade is available!" — lopdf 0.42 requires ttf-parser 0.25.x for font-glyph rendering. lopdf 0.42 is required to fix RUSTSEC-2026-0187 (stack overflow in earlier lopdf). Alternative: wait for lopdf upstream to migrate to skrifa (fontations project). Add ignore entry under the unmaintained section in deny.toml. Owner: GAR-895 (health run 146). Expires: 2026-10-31. Dep chain: garraia-media → lopdf 0.42.0 → ttf-parser 0.25.1 * fix(security): GAR-895 amend 5 — wasmtime 45→46 (RUSTSEC-2026-0222) wasmtime 45.0.3 is vulnerable to RUSTSEC-2026-0222: 'Stores can mix up type indices between engines' (GHSA-hgjw-h833-99q9). Fix floor: >=46.0.2. Bump workspace deps wasmtime 45→46, wasmtime-wasi 45→46. cargo update resolves all internal wasmtime-* crates to 46.0.2. garraia-plugins cargo check passes with 46.0.2. No deny.toml / audit.toml ignore entries needed — upgrade closes the advisory. Owner: GAR-895 (health run 146, 2026-08-16). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EMkJ4VRMNhmdrYaYGMAr2V * fix(ci): GAR-895 — MSRV 1.93 → 1.94 (wasmtime 46 exige rustc 1.94) wiggle-macro 46.0.2 (transitiva de wasmtime 46) declara rust-version 1.94.0, quebrando o job MSRV check (1.93). Eleva rust-version do workspace e o pin do job em lockstep com o bump do RUSTSEC-2026-0222, mesmo padrão do bump 1.92 → 1.93 do GAR-708. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: GarraIA <michelduek@gmail.com>
Contributor
Author
|
Superseded by #819. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/cache from 5 to 6.
Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
55cc834Merge pull request #1768 from jasongin/readonly-cached8cd72fBump@actions/cacheto v6.1.0 - handle cache write error due to RO token2c8a9bdMerge pull request #1760 from actions/samirat/esm_migration_and_package_updatee9b91fdPrettier fixese4884b8Rebuild dist10baf01Fixed licensese39b386Fix test mock return orderb692820PR feedback6074912Rebuild dist bundles as ESM to match type:module5a912e8Fix lint and jest issuesYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)