kingchenc
8ccfd638b2
Follow-up to the Dependabot action-bump merges and the cargo-deny ignore (#271). Three low-risk supply-chain housekeeping changes — config/docs only, no library code, no runtime change. ## 1. `osv-scanner.toml` (new) The OpenSSF Scorecard *Vulnerabilities* check runs OSV-Scanner over the repo and was flagging five advisory IDs (`score is 5`). These reduce to three findings, all assessed as not affecting Wickra: | Advisory | Assessment | |----------|------------| | RUSTSEC-2026-0176 / GHSA-36hh-v3qg-5jq4 (pyo3) | Vulnerable API unused; fix is pyo3 0.29 but rust-numpy 0.28 pins pyo3 `^0.28` → upstream-blocked. Already in `deny.toml`. | | RUSTSEC-2026-0177 / GHSA-chgr-c6px-7xpp (pyo3) | Same — `PyCFunction::new_closure` not called. Already in `deny.toml`. | | GHSA-72hv-8253-57qq (jackson-core 3.x) | **Not a dependency of this project.** No manifest, Maven plugin, or the GitHub dependency-graph SBOM references `tools.jackson` 3.x; the only jackson present is `com.fasterxml.jackson.core:jackson-databind` 2.17.1. | `osv-scanner.toml` records these as ignored-with-reason at the OSV layer, mirroring `deny.toml` and the SECURITY.md VEX section. The Scorecard finding also flip-flopped (fixed → reappeared) across unrelated release-bump commits, confirming it is not a stable real exposure. ## 2. Bump `central-publishing-maven-plugin` 0.5.0 → 0.10.0 The Java binding pinned a publishing plugin five versions behind. Validated locally with the JDK 22 toolchain (`mvn -Prelease validate`): the extension loads, the existing `publishingServerId`/`autoPublish` config is compatible, and all 14 binding tests pass. The actual `mvn deploy` upload path is only exercised at release time (needs the Central token + GPG key), so it will be confirmed at the next release. ## 3. Add a Maven ecosystem to Dependabot The Java binding had no Dependabot coverage, which is why the stale 0.5.0 plugin went unnoticed. Adds `package-ecosystem: maven` over `/bindings/java`, `/bindings/java/benchmarks`, and `/examples/java` so plugin and dependency updates (incl. the examples' jackson) are tracked going forward.
79 lines
2.3 KiB
YAML
79 lines
2.3 KiB
YAML
version: 2
|
|
updates:
|
|
# Rust workspace (root Cargo.toml + all member crates).
|
|
- package-ecosystem: cargo
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(cargo)"
|
|
|
|
# Node binding npm dependencies.
|
|
- package-ecosystem: npm
|
|
directory: "/bindings/node"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(npm)"
|
|
|
|
# Python binding pip dependencies.
|
|
- package-ecosystem: pip
|
|
directory: "/bindings/python"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(pip)"
|
|
|
|
# Hash-pinned CI/bench Python tooling under .github/requirements/. Each
|
|
# <name>.in is the loose source; the matching hash-locked <name>.txt is the
|
|
# output regenerated by scripts/update-lockfiles.sh (uv). Dependabot keeps the
|
|
# pins fresh; ci-dev-py39.in caps numpy <2.1 so 3.9 stays installable. Any
|
|
# bump that breaks a matrix row surfaces in the PR's CI run.
|
|
- package-ecosystem: pip
|
|
directory: "/.github/requirements"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(ci-pip)"
|
|
|
|
# GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
|
|
# the version comment after each pinned SHA and bumps both together).
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(actions)"
|
|
|
|
# Java binding + examples (Maven). Tracks the C-ABI binding's build plugins
|
|
# (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,
|
|
# which had no Dependabot coverage before — a stale publishing plugin slipped
|
|
# through unnoticed until an OSV scan flagged it.
|
|
- package-ecosystem: maven
|
|
directories:
|
|
- "/bindings/java"
|
|
- "/bindings/java/benchmarks"
|
|
- "/examples/java"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(maven)"
|