Skip to content

build(deps): bump shared-core from v3.0.33 to v3.0.39 - #23

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/shared-core-v3.0.39
Closed

build(deps): bump shared-core from v3.0.33 to v3.0.39#23
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/shared-core-v3.0.39

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps shared-core from v3.0.33 to v3.0.39.

Changelog

Sourced from shared-core's changelog.

[3.0.39] - 2026-07-23

Removed

  • session_id::generate_session_id — moved to per-app backend/src/session_id.rs. Each app now uses getrandom directly, so a bug in the session-id path compromises only that app. The shared impl had 2 unit tests; the per-app impl preserves them.
  • cookie_auth::{build_cookie, build_clear_cookie, cookie_should_be_secure} — moved to per-app backend/src/cookie_auth.rs. Each app's cookie name is now baked into the local module (e.g. BEAM_PIN, DEFEND_PIN, TODO_PIN, TRACE_PIN); apps no longer share a generic build_cookie(name, value, ...) API. The shared impl had 8 unit tests; the per-app impl preserves them.

Why

  • A bug in shared session_id (e.g. an OsRng fallback that returns all zeros under some edge case) would have compromised every app at once. Per-app code limits blast radius.
  • Each app tunes its own cookie semantics (clamp range, cookie name, SameSite policy); the shared signature was a leaky abstraction.

[3.0.38] - 2026-07-23and this project adheres to Semantic Versioning.

[Unreleased] - 2026-07-23

Changed

  • Audit Wave: Org-wide consolidation of shared-assets usage. The shared crate (v3.0.34..v3.0.37) now hosts the workspace inheritance, the rate_limit::RateLimiter, session_id::generate_session_id, cookie_auth::{build_cookie, cookie_should_be_secure}, the shared Login component, app_error::AppError, and auth::origin_check::{origin_matches, forbidden_response, ...}. The web apps' duplicated auth helpers, config, types, security headers, CSS, and bin/sh/tui.rs shells have been removed in favour of the shared implementations.
  • Pre-wave: Removed the per-app interactive TUI admin console in favour of the existing CUI subcommands.
  • Per-app refactor: file size cap enforcement (≤ 250 LoC/.rs) applied where the audit flagged oversize files.

[3.0.36] - 2026-07-23

Added

  • shared_backend::app_error::AppError — generic axum::IntoResponse error envelope covering I/O, JSON, and catch-all internal cases. Replaces the byte-identical error.rs files in defend/scan/snake (97 LoC each). Apps wrap this with their own #[error("...")] variants.
  • shared_backend::cookie_auth::cookie_should_be_secure — pure

... (truncated)

Commits
  • d9d716b feat(shared-assets): remove session_id + cookie_auth modules (de-merge)
  • 2a4bd99 docs(changelog): document shared-assets consolidation (Waves A-H)
  • 46ed34c docs(readme): drop Native Package Manager + Unraid NAS sections (repos retired)
  • 5af127c feat(shared-assets): add app_error, cookie_should_be_secure, origin_check hel...
  • 24d4c8d feat(shared-assets): promote RateLimiter, session_id, cookie_auth, Login to s...
  • 839f051 refactor(shared-assets): infrastructure hardening v3.0.34
  • f3f7e14 chore: remove unused corgi-footer asset
  • 5dcc586 docs: remove corgi footer image from README
  • 249845a style(branding): update footer banner with 2D cel art anime female corgi in d...
  • 6fd3727 style(branding): update footer picture bar with cute corgi illustration
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 26, 2026
@dependabot
build(deps): bump shared-core from v3.0.33 to v3.0.39
206c563 
Bumps [shared-core](https://github.com/studio2201/shared-assets) from v3.0.33 to v3.0.39.
- [Changelog](https://github.com/studio2201/shared-assets/blob/master/CHANGELOG.md)
- [Commits](studio2201/shared-assets@5c1f076...d9d716b)

---
updated-dependencies:
- dependency-name: shared-core
  dependency-version: d9d716ba42b270f2dc3519357f915956d8ff79be
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/shared-core-v3.0.39 branch from 04adb47 to 206c563 Compare July 27, 2026 00:27
@UberMetroid UberMetroid mentioned this pull request Jul 27, 2026
Merged
UberMetroid added a commit that referenced this pull request Jul 27, 2026
@UberMetroid @dependabot
build(deps): bump shared-frontend to v3.0.39 + shared-core to v3.0.39 (…
e252860 
…#25)

Combines the valid scope of dependabot PRs #22 and #23:

- frontend shared-frontend: v3.0.33 -> v3.0.39
- frontend shared-core:     v3.0.33 -> v3.0.39
- backend  shared-core:     v3.0.33 -> v3.0.39
- backend  shared-backend:  v3.0.33 (preserved, not in scope of either PR)

Regenerates Cargo.lock with both shared-core 3.0.33 (still
required transitively by shared-backend 3.0.33) and the new
shared-core 3.0.39.

API surface used by rustle (shared_backend::{auth::PinState,
auth::attempts, auth::session, middleware::cors_layer,
server::ServerConfig, server::ip::get_client_ip,
tracing_init::{init_tracing, default_log_dir}};
shared_core::i18n::Language; shared_frontend::{Header, Footer,
detect_browser_locale, set_saved_locale}) is unchanged across
v3.0.33..v3.0.39, so no source edits are required.

Validated:
- cargo check --workspace  (exit 0)
- cargo test  --workspace  (25 passed, 0 failed, 9 ignored)

Co-authored-by: dependabot[bot] <dependabot[bot]@users.noreply.github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Author

Looks like shared-core is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 27, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/shared-core-v3.0.39 branch July 27, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants