mirror of
https://github.com/Heretek-AI/drop.git
synced 2026-10-12 10:19:53 +00:00
John SmithandClaude Opus 5
7e61deb4fc
JavaScript (pnpm audit: 84 -> 0):
- prisma/@prisma/client/@prisma/adapter-pg 7.7.0 -> 7.10.0 (hono chain)
- remove deprecated 'tauri' npm package (2019-era, unused; source of
decompress critical, request, lodash.pick advisories)
- pnpm overrides for transitive deps: deepmerge-ts, file-type, uuid,
esbuild, sharp
- workspace-wide minor updates via pnpm update -r
- pin tailwindcss/@tailwindcss/vite to 4.2.2 (4.3.x recursion bug)
Rust (cargo-audit: all 7 crates exit 0):
- cargo update across cli/torrential/src-tauri (aws-lc-sys, h2, quinn,
rustls-webpki, crossbeam-epoch, bytes, time, webbrowser, anyhow...)
- opendal 0.55 -> 0.58.2 (fixes quick-xml DoS advisories)
- drop unused speedometer dep in droplet (removes unmaintained failure,
RUSTSEC-2020-0036 critical)
- drop unused slice-deque and reqwest-middleware-cache in desktop
(removes RUSTSEC-2021-0047 and h2 0.3 stack)
- jsonwebtoken 10 -> 11 with aws_lc_rs provider (drops vulnerable rsa,
RUSTSEC-2023-0071); remote crate verified compiling
Go:
- golang.org/x/text v0.29.0 -> v0.39.0 (GO-2026-5970), govulncheck clean
Secrets:
- add .gitleaksignore for revoked 2025 Twitch token (already removed in
commit 2cf8b72c); full-history gitleaks scan now passes
Verified: server build + typecheck clean, eslint unchanged vs baseline,
promo/docs builds pass, govulncheck/gitleaks/cargo-audit/pnpm audit all
clean.
Co-Authored-By: Claude Opus 5 <[email protected]>