Skip to content

Bump pnpm to v11 and ignore unfixable quick-xml advisories #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ScriptSmith merged 5 commits into from
Jul 2, 2026
Merged

Bump pnpm to v11 and ignore unfixable quick-xml advisories #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d22f8f4
Bump pnpm to v11 and ignore unfixable quick-xml advisories
ScriptSmith Jul 2, 2026
5795d5b
Review fixes
ScriptSmith Jul 2, 2026
f816e52
Fix CI for pnpm 11: Node 24 and node24 action runtimes
ScriptSmith Jul 2, 2026
dd7a200
Pin exact pnpm version in Dockerfile to match packageManager
ScriptSmith Jul 2, 2026
99b60bc
Fix dropdown
ScriptSmith Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .cargo/audit.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,15 @@ ignore = [
# microsandbox bump. Hadrian's own resolver uses hickory-resolver 0.26.1.
"RUSTSEC-2026-0118",
"RUSTSEC-2026-0119",
# quick-xml < 0.41 DoS: quadratic duplicate-attribute check (0194) and unbounded
# namespace-declaration allocation in NsReader (0195). Both fixed only in 0.41.0
# (published 2026-06-29); no dependent has released a 0.41 bump yet:
# - 0.37.5 via samael ^0.37.2 (latest 0.0.21, git master unchanged) — SAML SSO
# - 0.39.2 via calamine ^0.39 (latest 0.35.0) — xberg excel extraction
# - 0.40.1 via xberg/pdf_oxide/office_oxide ^0.40 (all latest) — xberg office/pdf
# DoS only (CPU/memory exhaustion), no memory unsafety or code execution. SAML and
# document extraction do parse untrusted XML, so drop these ignores as soon as
# upstream releases pick up quick-xml 0.41.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
]
86 changes: 43 additions & 43 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
name: Backend
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Configure Docker Hub mirror
run: |
Expand Down Expand Up @@ -73,7 +73,7 @@ jobs:
matrix:
features: [tiny, minimal, standard, full, headless]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Configure Docker Hub mirror
run: |
Expand Down Expand Up @@ -121,7 +121,7 @@ jobs:
name: WASM Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand All @@ -146,14 +146,14 @@ jobs:
run: ./scripts/build-wasm.sh --release

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: "20"
node-version: "24"

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
version: 9
version: 11

- name: Install UI dependencies
working-directory: ui
Expand Down Expand Up @@ -193,7 +193,7 @@ jobs:
os: windows-latest
features: minimal
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand Down Expand Up @@ -242,7 +242,7 @@ jobs:
name: Security Audit (cargo-audit)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Install cargo-audit
run: cargo install cargo-audit --locked
Expand All @@ -255,7 +255,7 @@ jobs:
name: Dependency Check (cargo-deny)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Install cargo-deny
run: cargo install cargo-deny --locked
Expand All @@ -271,24 +271,24 @@ jobs:
run:
working-directory: ui
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: '20'
node-version: '24'

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
version: 9
version: 11

- name: Get pnpm store directory
shell: bash
run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- name: Cache pnpm
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ${{ env.STORE_PATH }}
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
Expand Down Expand Up @@ -336,17 +336,17 @@ jobs:
run:
working-directory: ui
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: '20'
node-version: '24'

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
version: 9
version: 11

- name: Install dependencies
run: pnpm install --frozen-lockfile
Expand All @@ -359,24 +359,24 @@ jobs:
name: Documentation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: '20'
node-version: '24'

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
version: 9
version: 11

- name: Get pnpm store directory
shell: bash
run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- name: Cache pnpm
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ${{ env.STORE_PATH }}
key: ${{ runner.os }}-pnpm-docs-${{ hashFiles('docs/pnpm-lock.yaml', 'ui/pnpm-lock.yaml') }}
Expand Down Expand Up @@ -422,10 +422,10 @@ jobs:
name: OpenAPI Conformance
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Install uv
uses: astral-sh/setup-uv@v4
uses: astral-sh/setup-uv@v7

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand Down Expand Up @@ -463,7 +463,7 @@ jobs:

- name: Upload conformance report
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: openapi-conformance-report
path: conformance-report.json
Expand All @@ -473,7 +473,7 @@ jobs:
name: Docker Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Configure Docker Hub mirror
run: |
Expand All @@ -482,10 +482,10 @@ jobs:
sudo systemctl restart docker

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

- name: Build and export Docker image
uses: docker/build-push-action@v6
uses: docker/build-push-action@v7
with:
context: .
tags: hadrian:local
Expand All @@ -494,7 +494,7 @@ jobs:
cache-to: type=gha,mode=max,scope=docker

- name: Upload Docker image artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: docker-image
path: ${{ runner.temp }}/hadrian.tar
Expand All @@ -508,7 +508,7 @@ jobs:
timeout-minutes: 60

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Configure Docker Hub mirror
run: |
Expand All @@ -517,7 +517,7 @@ jobs:
sudo systemctl restart docker

- name: Download Docker image artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@v8
with:
name: docker-image
path: ${{ runner.temp }}
Expand All @@ -526,21 +526,21 @@ jobs:
run: docker load --input ${{ runner.temp }}/hadrian.tar

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: '20'
node-version: '24'

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
version: 9
version: 11

- name: Get pnpm store directory
shell: bash
run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- name: Cache pnpm
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ${{ env.STORE_PATH }}
key: ${{ runner.os }}-pnpm-e2e-${{ hashFiles('deploy/tests/pnpm-lock.yaml') }}
Expand Down Expand Up @@ -593,15 +593,15 @@ jobs:

- name: Upload coverage report
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: e2e-api-coverage
path: deploy/tests/coverage/api-coverage.json
retention-days: 30

- name: Upload test artifacts on failure
if: failure()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: e2e-test-artifacts
path: |
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/deploy-wasm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
contents: read
deployments: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand All @@ -40,21 +40,21 @@ jobs:
shared-key: wasm

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: "20"
node-version: "24"

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
version: 9
version: 11

- name: Get pnpm store directory
shell: bash
run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- name: Cache pnpm
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ${{ env.STORE_PATH }}
key: ${{ runner.os }}-pnpm-wasm-${{ hashFiles('ui/pnpm-lock.yaml') }}
Expand Down Expand Up @@ -106,7 +106,7 @@ jobs:
EOF

- name: Deploy to Cloudflare Pages
uses: cloudflare/wrangler-action@v3
uses: cloudflare/wrangler-action@v4
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
Expand Down
Loading
Loading