Skip to content

fix: regenerate dependencies-cargo.json for direct objc2 deps#166

Open
dormouse-bot wants to merge 1 commit into
mainfrom
fix/regenerate-cargo-deps-objc2
Open

fix: regenerate dependencies-cargo.json for direct objc2 deps#166
dormouse-bot wants to merge 1 commit into
mainfrom
fix/regenerate-cargo-deps-objc2

Conversation

@dormouse-bot

Copy link
Copy Markdown
Collaborator

Regenerates website/src/data/dependencies-cargo.json so it matches a clean node website/scripts/generate-deps.js run against the current Cargo.lock. This resolves the Dependency Supply Chain Check 1 failure reported in #165.

What drifted

The macOS dock-icon work (c2383c7 "Improve macOS relaunch and dock icon", merged via #163) added objc2, objc2-app-kit, and objc2-foundation as direct Cargo dependencies in standalone/src-tauri/Cargo.toml, but the committed dependency manifest was not regenerated afterward. The parallel regen PR (#160) landed on a branch that predated those direct deps, so the merge left the three crates listed in the transitive section without a declaredName field.

A clean regeneration moves them into the direct-dependency section and adds the declaredName field — exactly the 45-line delta (24 insertions, 21 deletions) the security audit flagged. The npm and runtime manifests are unchanged.

Verification

$ node website/scripts/generate-deps.js
Wrote 12 direct and 489 transitive Cargo dependencies to src/data/dependencies-cargo.json
$ git diff --stat website/src/data/
 1 file changed, 24 insertions(+), 21 deletions(-)

After committing this regeneration, re-running the generator produces no further diff.

On regression testing

This is a regenerated data file, not logic, so there's no unit test to add. The drift guard is the security audit itself (the generate-deps.js clean-checkout check that filed #165); it will pass once this lands. The underlying recurrence risk — a Cargo.toml dependency change merging without a matching manifest regen — is a process gap the audit already covers.

Closes #165.

The macOS dock-icon work made objc2/objc2-app-kit/objc2-foundation
direct Cargo dependencies without regenerating the manifest, leaving
them in the transitive section without declaredName. A clean
generate-deps.js run moves them to the direct section.

Closes #165

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying mouseterm with  Cloudflare Pages  Cloudflare Pages

Latest commit: 71d9fc1
Status: ✅  Deploy successful!
Preview URL: https://500c7d5b.mouseterm.pages.dev
Branch Preview URL: https://fix-regenerate-cargo-deps-ob.mouseterm.pages.dev

View logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[security-audit] FAIL on 2026-06-21

1 participant