fix(security): update quinn-proto to the OSV-fixed release 0.11.18 by qnbs · Pull Request #1030 · qnbs/WorldScript-Studio

qnbs · 2026-10-12T22:44:07Z

Summary

Updates the transitive quinn-proto lockfile entry from 0.11.15 to 0.11.18 (src-tauri/Cargo.lock only).

Why

The Security Audit → OSV vulnerability scan job fails on quinn-proto 0.11.15 with RUSTSEC-2026-0338, -0339, -0340, -0341 and -0342. The same lockfile blob is on main, so every PR that runs the full pipeline currently stops at this required gate (for example #1029, where the downstream jobs were skipped).

Scope and evidence

Chain: tauri-plugin-http 2.6.0 → reqwest 0.12.28 → quinn 0.11.9 → quinn-proto (tauri's own reqwest 0.13.4 does not depend on quinn). No manifest, feature, toolchain pin or rust-version change.
OSV (api.osv.dev): 0.11.15 carries the five IDs above, 0.11.17 still carries -0338, -0340 and -0343, 0.11.18 and 0.11.19 report none. 0.11.18 is therefore the minimal clean release.
cargo update -p quinn-proto --precise 0.11.18; cargo metadata --locked passes.
MSRV: crates.io reports rust-version = 1.85 for both 0.11.15 and 0.11.18, so the bump adds no new requirement.
0.11.18 newly pulls rand 0.10.3, rand_core 0.10.1, rand_pcg 0.10.2, chacha20 0.10.2 and cpufeatures 0.3.1. All report no OSV advisories; existing rand 0.9.4 consumers are only disambiguated in the lockfile.
No osv-scanner.toml ignore, continue-on-error or exception is added.

Not in scope

The broader Rust toolchain/MSRV track (#572) and the Pages record pruning work (#1028/#1029).

Summary by Sourcery

Update the locked quinn-proto dependency to the minimal release without known OSV advisories.

Bug Fixes:

Update the transitive quinn-proto dependency to the OSV-fixed 0.11.18 release, resolving the reported security advisories and unblocking the required vulnerability scan.

Chores:

Record the quinn-proto security update in the unreleased changelog.

Summary by CodeRabbit

Security
- Updated a transitive dependency to address reported security vulnerabilities.

The Security Audit OSV scan fails on quinn-proto 0.11.15 (RUSTSEC-2026-0338, -0339, -0340, -0341, -0342). 0.11.17 still carries -0338, -0340 and -0343, so 0.11.18 is the minimal clean release. The crate is a transitive lockfile entry (tauri -> reqwest -> quinn -> quinn-proto); the lockfile-only update (`cargo update -p quinn-proto --precise 0.11.18`) changes no manifest, feature or toolchain pin. 0.11.15 and 0.11.18 both declare rust-version 1.85, so the bump adds no MSRV requirement. The crates 0.11.18 newly pulls in (rand 0.10, rand_core 0.10, rand_pcg, chacha20, cpufeatures 0.3) report no OSV advisories.

sourcery-ai · 2026-10-12T22:44:13Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates only src-tauri/Cargo.lock to replace vulnerable transitive quinn-proto 0.11.15 with the minimal OSV-clean 0.11.18 release, refreshing its transitive dependency set while preserving the existing toolchain/MSRV and requiring no manifest or security-scan configuration changes.

File-Level Changes

Change	Details	Files
Bump the transitive `quinn-proto` dependency to the minimal OSV-clean release without changing project manifests or toolchain requirements.	Update the lockfile entry from `quinn-proto` 0.11.15 to 0.11.18. Refresh associated transitive dependency entries, including the newly resolved `rand` 0.10.x and related cryptography/CPU-feature crates. Preserve existing `rand` 0.9.x consumers through lockfile version disambiguation.	`src-tauri/Cargo.lock`
Remove the vulnerable dependency versions from the audited dependency graph while retaining locked-build validity.	Resolve the five reported advisories affecting 0.11.15 by selecting 0.11.18, which has no reported OSV advisories according to the PR evidence. Keep the existing MSRV unchanged; both old and new `quinn-proto` releases require Rust 1.85. Validate the updated lockfile with `cargo metadata --locked`. Avoid suppressions or CI exceptions such as OSV ignore entries and `continue-on-error`.	`src-tauri/Cargo.lock`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

vercel · 2026-10-12T22:44:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
worldscript-studio	Ready	Preview	Oct 12, 2026 11:12pm UTC

codeant-ai · 2026-10-12T22:44:18Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	`c2699d6`	Oct 12, 2026 · 22:44	22:44

codeant-ai · 2026-10-12T22:44:19Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

chatgpt-codex-connector · 2026-10-12T22:44:20Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T23:13:11.926143Z	`74343a9`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-12T22:44:21Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: qnbs/WorldScript-Studio/.coderabbit.yaml
Review profile: CHILL
Plan: Essentials
Run ID: 31d8be58-2d19-4ca2-a42f-ddc8c02b3a4f

📥 Commits

Reviewing files that changed from the base of the PR and between d99a852 and 74343a9.

📒 Files selected for processing (1)

CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

CHANGELOG.md

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📝 Walkthrough

Walkthrough

The Unreleased changelog adds a security entry for a lockfile-only update of transitive quinn-proto to 0.11.18. It lists RUSTSEC-2026-0338 through -0342 and describes the dependency path. Manifests, features, and toolchain pins are unchanged.

Changes

Security changelog update

Layer / File(s)	Summary
Record dependency security update `CHANGELOG.md`	The Unreleased changelog records the `quinn-proto` update, the affected advisory identifiers, and that manifests, features, and toolchain pins are unchanged.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 74343

This updates a transitive dependency to a release without reported advisories and records it in the changelog. No actionable merge-blocking risk remains.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

codeant-ai · 2026-10-12T22:44:32Z

🏁 CodeAnt Quality Gate Results

Commit: 74343a98
Scan Time: 2026-10-12 23:12:25 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	No IAC issues

View Full Results

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

codeant-ai · 2026-10-12T22:44:54Z

CodeAnt PR Risk: Low Risk

The PR appears safe to merge; the visible changes are limited to Cargo.lock dependency updates, with no concrete compatibility or behavior issue identified.

Assessed commit: c2699d6cc0a0

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: qnbs/WorldScript-Studio/.coderabbit.yaml
Review profile: CHILL
Plan: Essentials
Run ID: 97575a79-3ee7-4488-818a-43e2eaa53eea

📥 Commits

Reviewing files that changed from the base of the PR and between c2699d6 and d99a852.

📒 Files selected for processing (1)

CHANGELOG.md

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

codecov · 2026-10-12T22:56:51Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

codescene-access

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

sourcery-ai Bot reviewed Oct 12, 2026

View reviewed changes

docs(changelog): reference quinn-proto security fix

d99a852

This comment was marked as outdated.

Sign in to view

coderabbitai Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread CHANGELOG.md Outdated

docs(changelog): correct the quinn-proto dependency chain

74343a9

codescene-access Bot approved these changes Oct 12, 2026

View reviewed changes

qnbs merged commit 1d4a0ca into main Oct 12, 2026
49 checks passed

qnbs deleted the fix/osv-quinn-proto-0.11.18 branch October 12, 2026 23:37

qnbs mentioned this pull request Oct 22, 2026

release(v1.29.2): finish Settings, ship verified interim release before remaining Dependabot groups #1139

Open

Conversation

qnbs commented Oct 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Scope and evidence

Not in scope

Summary by Sourcery

Summary by CodeRabbit

Uh oh!

sourcery-ai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

vercel Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codeant-ai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Oct 12, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

codeant-ai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏁 CodeAnt Quality Gate Results

✅ Overall Status: PASSED

Quality Gate Details

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codeant-ai Bot commented Oct 12, 2026

CodeAnt PR Risk: Low Risk

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented Oct 12, 2026

Codecov Report

Uh oh!

codescene-access Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qnbs commented Oct 12, 2026 •

edited by coderabbitai Bot

Loading

sourcery-ai Bot commented Oct 12, 2026 •

edited

Loading

vercel Bot commented Oct 12, 2026 •

edited

Loading

codeant-ai Bot commented Oct 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

codeant-ai Bot commented Oct 12, 2026 •

edited

Loading