Skip to content

Ignore unresolvable glib Dependabot update#15

Draft
dashenbibi wants to merge 1 commit into
mainfrom
agent/ignore-unresolvable-glib
Draft

Ignore unresolvable glib Dependabot update#15
dashenbibi wants to merge 1 commit into
mainfrom
agent/ignore-unresolvable-glib

Conversation

@dashenbibi

Copy link
Copy Markdown
Owner

What changed

  • tell Dependabot to ignore automated glib updates for the Cargo workspace;
  • document the exact Tauri Linux GTK3 constraint and the condition for removing the exception.

Why

Dependabot security update run 29904771188 fails with security_update_not_possible: Tauri 2's Linux-only GTK3 dependency requires glib ^0.18, while GHSA-wrw7-89jp-8q8g is fixed only in glib >=0.20. No resolvable lockfile update exists.

The current TestHarbor release target is macOS. Neither macOS Rust target includes glib, and the packaged macOS binary does not link GTK or glib. This exception must be reconsidered before enabling Linux support.

Impact

  • stops the unresolvable Dependabot update job from repeating;
  • leaves other Cargo, npm, and GitHub Actions dependency updates enabled;
  • does not modify Cargo.lock or dismiss the underlying security alert.

Verification

  • parsed .github/dependabot.yml as YAML;
  • asserted that only the Cargo entry contains the exact glib ignore rule;
  • git diff --check passed;
  • reproduced the upstream resolver conflict with cargo update -p glib --precise 0.20.0 --dry-run.

Signed-off-by: dashenbibi <15820727+dashenbibi@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant