From adb8739a2281f44cb70aeaf2f75fc6b5a4eec5ea Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 6 Oct 2026 13:13:00 +0200 Subject: [PATCH 01/10] fix --- src-tauri/Cargo.toml | 7 +++ src-tauri/daemon/src/daemon.rs | 32 +++++++++- src-tauri/daemon/src/ipv6_block.rs | 99 ++++++++++++++++++++++++++++++ src-tauri/daemon/src/lib.rs | 2 + 4 files changed, 138 insertions(+), 2 deletions(-) create mode 100644 src-tauri/daemon/src/ipv6_block.rs diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 732f9e2f9..6d3befacf 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -188,6 +188,13 @@ windows-sys = { version = "0.61", features = [ # Network address change notifications (NotifyAddrChange) "Win32_NetworkManagement_IpHelper", + + # Interface LUIDs (ConvertInterfaceAliasToLuid) + "Win32_NetworkManagement_Ndis", + + # IPv6 block filter for tunnels without an IPv6 address + "Win32_NetworkManagement_WindowsFilteringPlatform", + "Win32_System_Rpc", ] } wmi = {version = "0.18", default-features = false} diff --git a/src-tauri/daemon/src/daemon.rs b/src-tauri/daemon/src/daemon.rs index 3b9622758..69e7f5fc8 100644 --- a/src-tauri/daemon/src/daemon.rs +++ b/src-tauri/daemon/src/daemon.rs @@ -52,9 +52,12 @@ use tonic::{ use tracing::warn; use tracing::{debug, error, info, info_span, Instrument}; -#[cfg(windows)] -use crate::named_pipe::{get_named_pipe_server_stream, PIPE_NAME}; use crate::{config::Config, VERSION}; +#[cfg(windows)] +use crate::{ + ipv6_block::Ipv6Block, + named_pipe::{get_named_pipe_server_stream, PIPE_NAME}, +}; #[cfg(unix)] pub(super) const DAEMON_SOCKET_PATH: &str = "/var/run/defguard.socket"; @@ -99,6 +102,8 @@ pub(crate) struct DaemonService { wgapis: Arc>>, stats_period: Duration, stat_tasks: Arc>>>, + #[cfg(windows)] + ipv6_blocks: Arc>>, #[cfg(any(windows, target_os = "linux"))] service_location_manager: Arc>, } @@ -115,6 +120,8 @@ impl DaemonService { wgapis: Arc::new(RwLock::new(HashMap::new())), stats_period: Duration::from_secs(config.stats_period), stat_tasks: Arc::new(Mutex::new(HashMap::new())), + #[cfg(windows)] + ipv6_blocks: Arc::new(Mutex::new(HashMap::new())), #[cfg(any(windows, target_os = "linux"))] service_location_manager, } @@ -350,6 +357,22 @@ impl DesktopDaemonService for DaemonService { } } + // Windows has no reject route, and the gateway drops link-local IPv6 from a tunnel + // without an IPv6 address, so connections hang until the SYN retries run out. + #[cfg(windows)] + if let Ok(mut blocks) = self.ipv6_blocks.lock() { + blocks.remove(&ifname); + if !config.addresses.iter().any(|addr| addr.address.is_ipv6()) { + match Ipv6Block::new(&ifname) { + Ok(block) => { + blocks.insert(ifname.clone(), block); + debug!("Blocked IPv6 connections through interface {ifname}"); + } + Err(err) => error!("Failed to block IPv6 on interface {ifname}: {err}"), + } + } + } + debug!("Finished creating a new interface {ifname}"); Ok(Response::new(())) } @@ -386,6 +409,11 @@ impl DesktopDaemonService for DaemonService { wgapi }; + #[cfg(windows)] + if let Ok(mut blocks) = self.ipv6_blocks.lock() { + blocks.remove(&ifname); + } + #[cfg(not(windows))] { debug!("Cleaning up interface {ifname} routing"); diff --git a/src-tauri/daemon/src/ipv6_block.rs b/src-tauri/daemon/src/ipv6_block.rs new file mode 100644 index 000000000..5c983ad3e --- /dev/null +++ b/src-tauri/daemon/src/ipv6_block.rs @@ -0,0 +1,99 @@ +use std::{io, iter::once, ptr}; + +use windows_sys::Win32::{ + Foundation::{ERROR_SUCCESS, HANDLE}, + NetworkManagement::{ + IpHelper::ConvertInterfaceAliasToLuid, + Ndis::NET_LUID_LH, + WindowsFilteringPlatform::{ + FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FWPM_ACTION0, + FWPM_CONDITION_IP_LOCAL_INTERFACE, FWPM_DISPLAY_DATA0, FWPM_FILTER0, + FWPM_FILTER_CONDITION0, FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, + FWPM_LAYER_ALE_AUTH_CONNECT_V6, FWPM_SESSION0, FWPM_SESSION_FLAG_DYNAMIC, + FWP_ACTION_BLOCK, FWP_CONDITION_VALUE0, FWP_CONDITION_VALUE0_0, FWP_MATCH_EQUAL, + FWP_UINT64, + }, + }, + System::Rpc::RPC_C_AUTHN_WINNT, +}; + +/// Blocks IPv6 connections that leave through a tunnel interface. +/// +/// The WFP session is dynamic, so Windows removes the filter when this value is dropped or the +/// service process exits. +pub(crate) struct Ipv6Block(HANDLE); + +unsafe impl Send for Ipv6Block {} + +impl Ipv6Block { + pub(crate) fn new(ifname: &str) -> Result { + let alias: Vec = ifname.encode_utf16().chain(once(0)).collect(); + let mut luid = NET_LUID_LH::default(); + let err = unsafe { ConvertInterfaceAliasToLuid(alias.as_ptr(), &mut luid) }; + if err != ERROR_SUCCESS { + return Err(io::Error::from_raw_os_error(err as i32)); + } + let mut luid = unsafe { luid.Value }; + + let session = FWPM_SESSION0 { + flags: FWPM_SESSION_FLAG_DYNAMIC, + ..Default::default() + }; + let mut engine = ptr::null_mut(); + let err = unsafe { + FwpmEngineOpen0( + ptr::null(), + RPC_C_AUTHN_WINNT, + ptr::null(), + &session, + &mut engine, + ) + }; + if err != ERROR_SUCCESS { + return Err(io::Error::from_raw_os_error(err as i32)); + } + // Bound before the filter is added, so an early return drops it and closes the session. + let block = Self(engine); + + let mut condition = FWPM_FILTER_CONDITION0 { + fieldKey: FWPM_CONDITION_IP_LOCAL_INTERFACE, + matchType: FWP_MATCH_EQUAL, + conditionValue: FWP_CONDITION_VALUE0 { + r#type: FWP_UINT64, + Anonymous: FWP_CONDITION_VALUE0_0 { uint64: &mut luid }, + }, + }; + let mut name: Vec = "Defguard IPv6 block" + .encode_utf16() + .chain(once(0)) + .collect(); + // A hard block, so that permit filters in other sublayers cannot override it. + let filter = FWPM_FILTER0 { + displayData: FWPM_DISPLAY_DATA0 { + name: name.as_mut_ptr(), + description: ptr::null_mut(), + }, + flags: FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, + layerKey: FWPM_LAYER_ALE_AUTH_CONNECT_V6, + numFilterConditions: 1, + filterCondition: &mut condition, + action: FWPM_ACTION0 { + r#type: FWP_ACTION_BLOCK, + ..Default::default() + }, + ..Default::default() + }; + let err = unsafe { FwpmFilterAdd0(engine, &filter, ptr::null_mut(), ptr::null_mut()) }; + if err != ERROR_SUCCESS { + return Err(io::Error::from_raw_os_error(err as i32)); + } + + Ok(block) + } +} + +impl Drop for Ipv6Block { + fn drop(&mut self) { + unsafe { FwpmEngineClose0(self.0) }; + } +} diff --git a/src-tauri/daemon/src/lib.rs b/src-tauri/daemon/src/lib.rs index fca6123ae..29adf57c1 100644 --- a/src-tauri/daemon/src/lib.rs +++ b/src-tauri/daemon/src/lib.rs @@ -3,6 +3,8 @@ pub mod daemon; pub mod error; pub mod utils; +#[cfg(windows)] +mod ipv6_block; #[cfg(windows)] pub mod named_pipe; #[cfg(windows)] From b911ba07204af64fa918ef675dc758c127957cf4 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 6 Oct 2026 13:22:10 +0200 Subject: [PATCH 02/10] fix vulnerability --- new-ui/pnpm-lock.yaml | 12 ++++++------ new-ui/pnpm-workspace.yaml | 1 + 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/new-ui/pnpm-lock.yaml b/new-ui/pnpm-lock.yaml index 8d9aa1913..364a1da07 100644 --- a/new-ui/pnpm-lock.yaml +++ b/new-ui/pnpm-lock.yaml @@ -1893,8 +1893,8 @@ packages: resolution: {integrity: sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==} engines: {node: '>=10'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} space-separated-tokens@2.0.2: @@ -3005,7 +3005,7 @@ snapshots: css-tree@3.2.1: dependencies: mdn-data: 2.27.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 cssesc@3.0.0: {} @@ -3842,7 +3842,7 @@ snapshots: dependencies: nanoid: 3.3.19 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 prettier@3.9.8: {} @@ -3980,7 +3980,7 @@ snapshots: dependencies: chokidar: 5.0.0 immutable: 5.1.9 - source-map-js: 1.2.1 + source-map-js: 1.2.2 optionalDependencies: '@parcel/watcher': 2.6.0 @@ -4006,7 +4006,7 @@ snapshots: astral-regex: 2.0.0 is-fullwidth-code-point: 3.0.0 - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} space-separated-tokens@2.0.2: {} diff --git a/new-ui/pnpm-workspace.yaml b/new-ui/pnpm-workspace.yaml index bf441ee6d..b3f6ee0dc 100644 --- a/new-ui/pnpm-workspace.yaml +++ b/new-ui/pnpm-workspace.yaml @@ -8,3 +8,4 @@ minimumReleaseAgeExclude: - vite@8.0.16 - fast-uri@3.1.4 || 3.1.5 - js-yaml@4.3.1 + - source-map-js@1.2.2 From 4cf836cbade59d3fafb492cd3d1be483617ab655 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 6 Oct 2026 11:23:25 +0000 Subject: [PATCH 03/10] chore(nix): update new-ui pnpm deps hash --- nix/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix/package.nix b/nix/package.nix index 95e5c8e23..96cfe4fe3 100644 --- a/nix/package.nix +++ b/nix/package.nix @@ -90,7 +90,7 @@ inherit version pnpm; src = ../new-ui; fetcherVersion = 4; - hash = "sha256-0Cuvz/UwioZ9nX8yTlJ1tl4op04TOpo+i5WDIIt7ELM="; + hash = "sha256-hweM8A9UL2vxq7DH+5+cmfrg9IoI2li+3yMreeN3s0k="; }; # Pre-build the new UI frontend so Tauri can serve it as WebviewUrl::App("compact/") and "full/". From d59583621b23c73ac97eec938e58b7af02817316 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:37:13 +0200 Subject: [PATCH 04/10] also block ipv4 --- src-tauri/daemon/src/daemon.rs | 27 ++++--- .../daemon/src/{ipv6_block.rs => ip_block.rs} | 71 ++++++++++--------- src-tauri/daemon/src/lib.rs | 2 +- 3 files changed, 55 insertions(+), 45 deletions(-) rename src-tauri/daemon/src/{ipv6_block.rs => ip_block.rs} (50%) diff --git a/src-tauri/daemon/src/daemon.rs b/src-tauri/daemon/src/daemon.rs index 69e7f5fc8..b83929cfa 100644 --- a/src-tauri/daemon/src/daemon.rs +++ b/src-tauri/daemon/src/daemon.rs @@ -55,7 +55,7 @@ use tracing::{debug, error, info, info_span, Instrument}; use crate::{config::Config, VERSION}; #[cfg(windows)] use crate::{ - ipv6_block::Ipv6Block, + ip_block::IpBlock, named_pipe::{get_named_pipe_server_stream, PIPE_NAME}, }; @@ -103,7 +103,7 @@ pub(crate) struct DaemonService { stats_period: Duration, stat_tasks: Arc>>>, #[cfg(windows)] - ipv6_blocks: Arc>>, + ip_blocks: Arc>>, #[cfg(any(windows, target_os = "linux"))] service_location_manager: Arc>, } @@ -121,7 +121,7 @@ impl DaemonService { stats_period: Duration::from_secs(config.stats_period), stat_tasks: Arc::new(Mutex::new(HashMap::new())), #[cfg(windows)] - ipv6_blocks: Arc::new(Mutex::new(HashMap::new())), + ip_blocks: Arc::new(Mutex::new(HashMap::new())), #[cfg(any(windows, target_os = "linux"))] service_location_manager, } @@ -357,18 +357,23 @@ impl DesktopDaemonService for DaemonService { } } - // Windows has no reject route, and the gateway drops link-local IPv6 from a tunnel - // without an IPv6 address, so connections hang until the SYN retries run out. + // Windows has no reject route, and the gateway drops link-local sources from a tunnel + // without an address of that family, so block that family to fail connections at once. #[cfg(windows)] - if let Ok(mut blocks) = self.ipv6_blocks.lock() { + if let Ok(mut blocks) = self.ip_blocks.lock() { blocks.remove(&ifname); - if !config.addresses.iter().any(|addr| addr.address.is_ipv6()) { - match Ipv6Block::new(&ifname) { + let has_ipv4 = config.addresses.iter().any(|addr| addr.address.is_ipv4()); + let has_ipv6 = config.addresses.iter().any(|addr| addr.address.is_ipv6()); + if !has_ipv4 || !has_ipv6 { + match IpBlock::new(&ifname, !has_ipv4, !has_ipv6) { Ok(block) => { blocks.insert(ifname.clone(), block); - debug!("Blocked IPv6 connections through interface {ifname}"); + debug!( + "Blocked connections through interface {ifname}: IPv4 {}, IPv6 {}", + !has_ipv4, !has_ipv6 + ); } - Err(err) => error!("Failed to block IPv6 on interface {ifname}: {err}"), + Err(err) => error!("Failed to block IP on interface {ifname}: {err}"), } } } @@ -410,7 +415,7 @@ impl DesktopDaemonService for DaemonService { }; #[cfg(windows)] - if let Ok(mut blocks) = self.ipv6_blocks.lock() { + if let Ok(mut blocks) = self.ip_blocks.lock() { blocks.remove(&ifname); } diff --git a/src-tauri/daemon/src/ipv6_block.rs b/src-tauri/daemon/src/ip_block.rs similarity index 50% rename from src-tauri/daemon/src/ipv6_block.rs rename to src-tauri/daemon/src/ip_block.rs index 5c983ad3e..ce475512f 100644 --- a/src-tauri/daemon/src/ipv6_block.rs +++ b/src-tauri/daemon/src/ip_block.rs @@ -9,24 +9,24 @@ use windows_sys::Win32::{ FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FWPM_ACTION0, FWPM_CONDITION_IP_LOCAL_INTERFACE, FWPM_DISPLAY_DATA0, FWPM_FILTER0, FWPM_FILTER_CONDITION0, FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, - FWPM_LAYER_ALE_AUTH_CONNECT_V6, FWPM_SESSION0, FWPM_SESSION_FLAG_DYNAMIC, - FWP_ACTION_BLOCK, FWP_CONDITION_VALUE0, FWP_CONDITION_VALUE0_0, FWP_MATCH_EQUAL, - FWP_UINT64, + FWPM_LAYER_ALE_AUTH_CONNECT_V4, FWPM_LAYER_ALE_AUTH_CONNECT_V6, FWPM_SESSION0, + FWPM_SESSION_FLAG_DYNAMIC, FWP_ACTION_BLOCK, FWP_CONDITION_VALUE0, + FWP_CONDITION_VALUE0_0, FWP_MATCH_EQUAL, FWP_UINT64, }, }, System::Rpc::RPC_C_AUTHN_WINNT, }; -/// Blocks IPv6 connections that leave through a tunnel interface. +/// Blocks connections of the given IP families that leave through a tunnel interface. /// -/// The WFP session is dynamic, so Windows removes the filter when this value is dropped or the +/// The WFP session is dynamic, so Windows removes the filters when this value is dropped or the /// service process exits. -pub(crate) struct Ipv6Block(HANDLE); +pub(crate) struct IpBlock(HANDLE); -unsafe impl Send for Ipv6Block {} +unsafe impl Send for IpBlock {} -impl Ipv6Block { - pub(crate) fn new(ifname: &str) -> Result { +impl IpBlock { + pub(crate) fn new(ifname: &str, ipv4: bool, ipv6: bool) -> Result { let alias: Vec = ifname.encode_utf16().chain(once(0)).collect(); let mut luid = NET_LUID_LH::default(); let err = unsafe { ConvertInterfaceAliasToLuid(alias.as_ptr(), &mut luid) }; @@ -52,7 +52,7 @@ impl Ipv6Block { if err != ERROR_SUCCESS { return Err(io::Error::from_raw_os_error(err as i32)); } - // Bound before the filter is added, so an early return drops it and closes the session. + // Bound before the filters are added, so an early return drops it and closes the session. let block = Self(engine); let mut condition = FWPM_FILTER_CONDITION0 { @@ -63,36 +63,41 @@ impl Ipv6Block { Anonymous: FWP_CONDITION_VALUE0_0 { uint64: &mut luid }, }, }; - let mut name: Vec = "Defguard IPv6 block" - .encode_utf16() - .chain(once(0)) - .collect(); - // A hard block, so that permit filters in other sublayers cannot override it. - let filter = FWPM_FILTER0 { - displayData: FWPM_DISPLAY_DATA0 { - name: name.as_mut_ptr(), - description: ptr::null_mut(), - }, - flags: FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, - layerKey: FWPM_LAYER_ALE_AUTH_CONNECT_V6, - numFilterConditions: 1, - filterCondition: &mut condition, - action: FWPM_ACTION0 { - r#type: FWP_ACTION_BLOCK, + for (enabled, layer, name) in [ + (ipv4, FWPM_LAYER_ALE_AUTH_CONNECT_V4, "Defguard IPv4 block"), + (ipv6, FWPM_LAYER_ALE_AUTH_CONNECT_V6, "Defguard IPv6 block"), + ] { + if !enabled { + continue; + } + let mut name: Vec = name.encode_utf16().chain(once(0)).collect(); + // A hard block, so that permit filters in other sublayers cannot override it. + let filter = FWPM_FILTER0 { + displayData: FWPM_DISPLAY_DATA0 { + name: name.as_mut_ptr(), + description: ptr::null_mut(), + }, + flags: FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, + layerKey: layer, + numFilterConditions: 1, + filterCondition: &mut condition, + action: FWPM_ACTION0 { + r#type: FWP_ACTION_BLOCK, + ..Default::default() + }, ..Default::default() - }, - ..Default::default() - }; - let err = unsafe { FwpmFilterAdd0(engine, &filter, ptr::null_mut(), ptr::null_mut()) }; - if err != ERROR_SUCCESS { - return Err(io::Error::from_raw_os_error(err as i32)); + }; + let err = unsafe { FwpmFilterAdd0(engine, &filter, ptr::null_mut(), ptr::null_mut()) }; + if err != ERROR_SUCCESS { + return Err(io::Error::from_raw_os_error(err as i32)); + } } Ok(block) } } -impl Drop for Ipv6Block { +impl Drop for IpBlock { fn drop(&mut self) { unsafe { FwpmEngineClose0(self.0) }; } diff --git a/src-tauri/daemon/src/lib.rs b/src-tauri/daemon/src/lib.rs index 29adf57c1..cbb163741 100644 --- a/src-tauri/daemon/src/lib.rs +++ b/src-tauri/daemon/src/lib.rs @@ -4,7 +4,7 @@ pub mod error; pub mod utils; #[cfg(windows)] -mod ipv6_block; +mod ip_block; #[cfg(windows)] pub mod named_pipe; #[cfg(windows)] From 6dd206ef880ecb9b667d6c029ff19cdf9ba8e351 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Fri, 23 Oct 2026 14:24:20 +0200 Subject: [PATCH 05/10] revert ipv4 changes --- src-tauri/daemon/src/daemon.rs | 27 +++---- .../daemon/src/{ip_block.rs => ipv6_block.rs} | 71 +++++++++---------- src-tauri/daemon/src/lib.rs | 2 +- 3 files changed, 45 insertions(+), 55 deletions(-) rename src-tauri/daemon/src/{ip_block.rs => ipv6_block.rs} (50%) diff --git a/src-tauri/daemon/src/daemon.rs b/src-tauri/daemon/src/daemon.rs index b83929cfa..69e7f5fc8 100644 --- a/src-tauri/daemon/src/daemon.rs +++ b/src-tauri/daemon/src/daemon.rs @@ -55,7 +55,7 @@ use tracing::{debug, error, info, info_span, Instrument}; use crate::{config::Config, VERSION}; #[cfg(windows)] use crate::{ - ip_block::IpBlock, + ipv6_block::Ipv6Block, named_pipe::{get_named_pipe_server_stream, PIPE_NAME}, }; @@ -103,7 +103,7 @@ pub(crate) struct DaemonService { stats_period: Duration, stat_tasks: Arc>>>, #[cfg(windows)] - ip_blocks: Arc>>, + ipv6_blocks: Arc>>, #[cfg(any(windows, target_os = "linux"))] service_location_manager: Arc>, } @@ -121,7 +121,7 @@ impl DaemonService { stats_period: Duration::from_secs(config.stats_period), stat_tasks: Arc::new(Mutex::new(HashMap::new())), #[cfg(windows)] - ip_blocks: Arc::new(Mutex::new(HashMap::new())), + ipv6_blocks: Arc::new(Mutex::new(HashMap::new())), #[cfg(any(windows, target_os = "linux"))] service_location_manager, } @@ -357,23 +357,18 @@ impl DesktopDaemonService for DaemonService { } } - // Windows has no reject route, and the gateway drops link-local sources from a tunnel - // without an address of that family, so block that family to fail connections at once. + // Windows has no reject route, and the gateway drops link-local IPv6 from a tunnel + // without an IPv6 address, so connections hang until the SYN retries run out. #[cfg(windows)] - if let Ok(mut blocks) = self.ip_blocks.lock() { + if let Ok(mut blocks) = self.ipv6_blocks.lock() { blocks.remove(&ifname); - let has_ipv4 = config.addresses.iter().any(|addr| addr.address.is_ipv4()); - let has_ipv6 = config.addresses.iter().any(|addr| addr.address.is_ipv6()); - if !has_ipv4 || !has_ipv6 { - match IpBlock::new(&ifname, !has_ipv4, !has_ipv6) { + if !config.addresses.iter().any(|addr| addr.address.is_ipv6()) { + match Ipv6Block::new(&ifname) { Ok(block) => { blocks.insert(ifname.clone(), block); - debug!( - "Blocked connections through interface {ifname}: IPv4 {}, IPv6 {}", - !has_ipv4, !has_ipv6 - ); + debug!("Blocked IPv6 connections through interface {ifname}"); } - Err(err) => error!("Failed to block IP on interface {ifname}: {err}"), + Err(err) => error!("Failed to block IPv6 on interface {ifname}: {err}"), } } } @@ -415,7 +410,7 @@ impl DesktopDaemonService for DaemonService { }; #[cfg(windows)] - if let Ok(mut blocks) = self.ip_blocks.lock() { + if let Ok(mut blocks) = self.ipv6_blocks.lock() { blocks.remove(&ifname); } diff --git a/src-tauri/daemon/src/ip_block.rs b/src-tauri/daemon/src/ipv6_block.rs similarity index 50% rename from src-tauri/daemon/src/ip_block.rs rename to src-tauri/daemon/src/ipv6_block.rs index ce475512f..5c983ad3e 100644 --- a/src-tauri/daemon/src/ip_block.rs +++ b/src-tauri/daemon/src/ipv6_block.rs @@ -9,24 +9,24 @@ use windows_sys::Win32::{ FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FWPM_ACTION0, FWPM_CONDITION_IP_LOCAL_INTERFACE, FWPM_DISPLAY_DATA0, FWPM_FILTER0, FWPM_FILTER_CONDITION0, FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, - FWPM_LAYER_ALE_AUTH_CONNECT_V4, FWPM_LAYER_ALE_AUTH_CONNECT_V6, FWPM_SESSION0, - FWPM_SESSION_FLAG_DYNAMIC, FWP_ACTION_BLOCK, FWP_CONDITION_VALUE0, - FWP_CONDITION_VALUE0_0, FWP_MATCH_EQUAL, FWP_UINT64, + FWPM_LAYER_ALE_AUTH_CONNECT_V6, FWPM_SESSION0, FWPM_SESSION_FLAG_DYNAMIC, + FWP_ACTION_BLOCK, FWP_CONDITION_VALUE0, FWP_CONDITION_VALUE0_0, FWP_MATCH_EQUAL, + FWP_UINT64, }, }, System::Rpc::RPC_C_AUTHN_WINNT, }; -/// Blocks connections of the given IP families that leave through a tunnel interface. +/// Blocks IPv6 connections that leave through a tunnel interface. /// -/// The WFP session is dynamic, so Windows removes the filters when this value is dropped or the +/// The WFP session is dynamic, so Windows removes the filter when this value is dropped or the /// service process exits. -pub(crate) struct IpBlock(HANDLE); +pub(crate) struct Ipv6Block(HANDLE); -unsafe impl Send for IpBlock {} +unsafe impl Send for Ipv6Block {} -impl IpBlock { - pub(crate) fn new(ifname: &str, ipv4: bool, ipv6: bool) -> Result { +impl Ipv6Block { + pub(crate) fn new(ifname: &str) -> Result { let alias: Vec = ifname.encode_utf16().chain(once(0)).collect(); let mut luid = NET_LUID_LH::default(); let err = unsafe { ConvertInterfaceAliasToLuid(alias.as_ptr(), &mut luid) }; @@ -52,7 +52,7 @@ impl IpBlock { if err != ERROR_SUCCESS { return Err(io::Error::from_raw_os_error(err as i32)); } - // Bound before the filters are added, so an early return drops it and closes the session. + // Bound before the filter is added, so an early return drops it and closes the session. let block = Self(engine); let mut condition = FWPM_FILTER_CONDITION0 { @@ -63,41 +63,36 @@ impl IpBlock { Anonymous: FWP_CONDITION_VALUE0_0 { uint64: &mut luid }, }, }; - for (enabled, layer, name) in [ - (ipv4, FWPM_LAYER_ALE_AUTH_CONNECT_V4, "Defguard IPv4 block"), - (ipv6, FWPM_LAYER_ALE_AUTH_CONNECT_V6, "Defguard IPv6 block"), - ] { - if !enabled { - continue; - } - let mut name: Vec = name.encode_utf16().chain(once(0)).collect(); - // A hard block, so that permit filters in other sublayers cannot override it. - let filter = FWPM_FILTER0 { - displayData: FWPM_DISPLAY_DATA0 { - name: name.as_mut_ptr(), - description: ptr::null_mut(), - }, - flags: FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, - layerKey: layer, - numFilterConditions: 1, - filterCondition: &mut condition, - action: FWPM_ACTION0 { - r#type: FWP_ACTION_BLOCK, - ..Default::default() - }, + let mut name: Vec = "Defguard IPv6 block" + .encode_utf16() + .chain(once(0)) + .collect(); + // A hard block, so that permit filters in other sublayers cannot override it. + let filter = FWPM_FILTER0 { + displayData: FWPM_DISPLAY_DATA0 { + name: name.as_mut_ptr(), + description: ptr::null_mut(), + }, + flags: FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT, + layerKey: FWPM_LAYER_ALE_AUTH_CONNECT_V6, + numFilterConditions: 1, + filterCondition: &mut condition, + action: FWPM_ACTION0 { + r#type: FWP_ACTION_BLOCK, ..Default::default() - }; - let err = unsafe { FwpmFilterAdd0(engine, &filter, ptr::null_mut(), ptr::null_mut()) }; - if err != ERROR_SUCCESS { - return Err(io::Error::from_raw_os_error(err as i32)); - } + }, + ..Default::default() + }; + let err = unsafe { FwpmFilterAdd0(engine, &filter, ptr::null_mut(), ptr::null_mut()) }; + if err != ERROR_SUCCESS { + return Err(io::Error::from_raw_os_error(err as i32)); } Ok(block) } } -impl Drop for IpBlock { +impl Drop for Ipv6Block { fn drop(&mut self) { unsafe { FwpmEngineClose0(self.0) }; } diff --git a/src-tauri/daemon/src/lib.rs b/src-tauri/daemon/src/lib.rs index cbb163741..29adf57c1 100644 --- a/src-tauri/daemon/src/lib.rs +++ b/src-tauri/daemon/src/lib.rs @@ -4,7 +4,7 @@ pub mod error; pub mod utils; #[cfg(windows)] -mod ip_block; +mod ipv6_block; #[cfg(windows)] pub mod named_pipe; #[cfg(windows)] From f19d257501dd63e97e4b20a5c441f6e11c7447cb Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Fri, 23 Oct 2026 15:25:18 +0200 Subject: [PATCH 06/10] bump --- src-tauri/Cargo.lock | 22 +++++++++++----------- src-tauri/deny.toml | 4 ++++ 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 8bb36bd58..e3b9705b0 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -1048,9 +1048,9 @@ checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486" [[package]] name = "clipboard-win" -version = "5.4.1" +version = "5.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4" +checksum = "052af7878466feccda12ba7a6a67d019d712f296809559b47c12c8cc196d3a9a" dependencies = [ "error-code", ] @@ -5999,9 +5999,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -6064,9 +6064,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -7554,7 +7554,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2", @@ -8700,18 +8700,18 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171" dependencies = [ "rustls-pki-types", ] diff --git a/src-tauri/deny.toml b/src-tauri/deny.toml index 4dea52818..a52dce6f4 100644 --- a/src-tauri/deny.toml +++ b/src-tauri/deny.toml @@ -94,6 +94,10 @@ ignore = [ { id = "RUSTSEC-2025-0100", reason = "Tauri v2 dependency (unmaintained)" }, { id = "RUSTSEC-2026-0194", reason = "Tauri v2 dependency (unmaintained)" }, { id = "RUSTSEC-2026-0195", reason = "Tauri v2 dependency (unmaintained)" }, + # zbus 5 pulls these split crates; Tauri plugins and dark-light do not support zbus 6 yet. + { id = "RUSTSEC-2026-0370", reason = "zvariant merged into zbus 6; pulled by zbus 5" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names merged into zbus 6; pulled by zbus 5" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive merged into zbus 6; pulled by zbus 5" }, ] # If this is true, then cargo deny will use the git executable to fetch advisory database. # If this is false, then it uses a built-in git library. From db6a566fc5c7353325b381f7095836cd72fc29ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= Date: Mon, 26 Oct 2026 09:44:46 +0100 Subject: [PATCH 07/10] update nix hash --- nix/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix/package.nix b/nix/package.nix index 3bf99da5d..bf4f68b6e 100644 --- a/nix/package.nix +++ b/nix/package.nix @@ -90,7 +90,7 @@ inherit version pnpm; src = ../new-ui; fetcherVersion = 4; - hash = "sha256-oM4G21ZuvQz34bTeo8txqlw2N8gm8U6BFrTJPgIcb0A="; + hash = "sha256-2+7Wzqrj00q21LMbmz6WGsHmg5vTupTOJeHMGusbMkY="; }; # Pre-build the new UI frontend so Tauri can serve it as WebviewUrl::App("compact/") and "full/". From c885c3630e21971ab31e42186b57e001b9668950 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 26 Oct 2026 09:59:38 +0100 Subject: [PATCH 08/10] bump zod --- new-ui/package.json | 2 +- new-ui/pnpm-lock.yaml | 182 +++++++++++++++++++++--------------------- 2 files changed, 91 insertions(+), 93 deletions(-) diff --git a/new-ui/package.json b/new-ui/package.json index 22b02c858..f18abf64b 100644 --- a/new-ui/package.json +++ b/new-ui/package.json @@ -48,7 +48,7 @@ "remark-gfm": "^4.0.1", "rxjs": "^7.8.2", "sass": "^1.104.1", - "zod": "^4.6.5", + "zod": "^4.6.7", "zustand": "^5.0.15" }, "devDependencies": { diff --git a/new-ui/pnpm-lock.yaml b/new-ui/pnpm-lock.yaml index 364a1da07..6a38b48c4 100644 --- a/new-ui/pnpm-lock.yaml +++ b/new-ui/pnpm-lock.yaml @@ -97,7 +97,7 @@ importers: version: 3.5.0(react@19.3.0) react-markdown: specifier: ^10.1.0 - version: 10.1.0(@types/react@19.3.0)(react@19.3.0)(supports-color@10.2.2) + version: 10.1.0(@types/react@19.3.0)(react@19.3.0) rehype-raw: specifier: ^7.0.0 version: 7.0.0 @@ -106,7 +106,7 @@ importers: version: 6.0.0 remark-gfm: specifier: ^4.0.1 - version: 4.0.1(supports-color@10.2.2) + version: 4.0.1 rxjs: specifier: ^7.8.2 version: 7.8.2 @@ -114,8 +114,8 @@ importers: specifier: ^1.104.1 version: 1.104.1 zod: - specifier: ^4.6.5 - version: 4.6.5 + specifier: ^4.6.7 + version: 4.6.7 zustand: specifier: ^5.0.15 version: 5.0.15(@types/react@19.3.0)(react@19.3.0)(use-sync-external-store@1.7.0(react@19.3.0)) @@ -125,7 +125,7 @@ importers: version: 0.8.5(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(vite@8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1)) '@tanstack/router-plugin': specifier: ^1.168.40 - version: 1.168.40(@tanstack/react-router@1.170.38(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(rolldown@1.2.9)(supports-color@10.2.2)(vite@8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1)) + version: 1.168.40(@tanstack/react-router@1.170.38(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(rolldown@1.2.9)(vite@8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1)) '@types/byte-size': specifier: ^8.1.2 version: 8.1.2 @@ -149,13 +149,13 @@ importers: version: 17.12.0 stylelint: specifier: ^17.15.0 - version: 17.15.0(supports-color@10.2.2)(typescript@6.0.3) + version: 17.15.0(typescript@6.0.3) stylelint-config-standard-scss: specifier: ^17.0.0 - version: 17.0.0(postcss@8.5.28)(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) + version: 17.0.0(postcss@8.5.28)(stylelint@17.15.0(typescript@6.0.3)) stylelint-scss: specifier: ^7.3.0 - version: 7.3.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) + version: 7.3.0(stylelint@17.15.0(typescript@6.0.3)) typescript: specifier: ~6.0.3 version: 6.0.3 @@ -2164,8 +2164,8 @@ packages: yallist@3.1.1: resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==} - zod@4.6.5: - resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==} + zod@4.6.7: + resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} zustand@5.0.15: resolution: {integrity: sha512-MpSEjRiBkA9crSYeOUH32rJC7SVqAbm0Fqcqge/bUi2PPoLcBWKOsG+C8mevmpr8TwXHBVkChbbJiyvkE+i/3A==} @@ -2198,20 +2198,20 @@ snapshots: '@babel/compat-data@7.29.7': {} - '@babel/core@7.29.7(supports-color@10.2.2)': + '@babel/core@7.29.7': dependencies: '@babel/code-frame': 7.29.7 '@babel/generator': 7.29.8 '@babel/helper-compilation-targets': 7.29.7 - '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2) + '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7) '@babel/helpers': 7.29.7 '@babel/parser': 7.29.9 '@babel/template': 7.29.7 - '@babel/traverse': 7.29.8(supports-color@10.2.2) + '@babel/traverse': 7.29.8 '@babel/types': 7.29.8 '@jridgewell/remapping': 2.3.5 convert-source-map: 2.0.0 - debug: 4.4.3(supports-color@10.2.2) + debug: 4.4.3 gensync: 1.0.0-beta.2 json5: 2.2.3 semver: 6.3.1 @@ -2236,19 +2236,19 @@ snapshots: '@babel/helper-globals@7.29.7': {} - '@babel/helper-module-imports@7.29.7(supports-color@10.2.2)': + '@babel/helper-module-imports@7.29.7': dependencies: - '@babel/traverse': 7.29.8(supports-color@10.2.2) + '@babel/traverse': 7.29.8 '@babel/types': 7.29.8 transitivePeerDependencies: - supports-color - '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2)': + '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)': dependencies: - '@babel/core': 7.29.7(supports-color@10.2.2) - '@babel/helper-module-imports': 7.29.7(supports-color@10.2.2) + '@babel/core': 7.29.7 + '@babel/helper-module-imports': 7.29.7 '@babel/helper-validator-identifier': 7.29.7 - '@babel/traverse': 7.29.8(supports-color@10.2.2) + '@babel/traverse': 7.29.8 transitivePeerDependencies: - supports-color @@ -2273,7 +2273,7 @@ snapshots: '@babel/parser': 7.29.9 '@babel/types': 7.29.8 - '@babel/traverse@7.29.8(supports-color@10.2.2)': + '@babel/traverse@7.29.8': dependencies: '@babel/code-frame': 7.29.7 '@babel/generator': 7.29.8 @@ -2281,7 +2281,7 @@ snapshots: '@babel/parser': 7.29.9 '@babel/template': 7.29.7 '@babel/types': 7.29.8 - debug: 4.4.3(supports-color@10.2.2) + debug: 4.4.3 transitivePeerDependencies: - supports-color @@ -2747,30 +2747,30 @@ snapshots: seroval: 1.6.7 seroval-plugins: 1.6.7(seroval@1.6.7) - '@tanstack/router-generator@1.167.38(supports-color@10.2.2)': + '@tanstack/router-generator@1.167.38': dependencies: '@babel/types': 7.29.8 '@tanstack/router-core': 1.171.32 - '@tanstack/router-utils': 1.162.3(supports-color@10.2.2) + '@tanstack/router-utils': 1.162.3 '@tanstack/virtual-file-routes': 1.162.0 jiti: 2.7.0 magic-string: 0.30.21 prettier: 3.9.8 - zod: 4.6.5 + zod: 4.6.7 transitivePeerDependencies: - supports-color - '@tanstack/router-plugin@1.168.40(@tanstack/react-router@1.170.38(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(rolldown@1.2.9)(supports-color@10.2.2)(vite@8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1))': + '@tanstack/router-plugin@1.168.40(@tanstack/react-router@1.170.38(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(rolldown@1.2.9)(vite@8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1))': dependencies: - '@babel/core': 7.29.7(supports-color@10.2.2) + '@babel/core': 7.29.7 '@babel/template': 7.29.7 '@babel/types': 7.29.8 '@tanstack/router-core': 1.171.32 - '@tanstack/router-generator': 1.167.38(supports-color@10.2.2) - '@tanstack/router-utils': 1.162.3(supports-color@10.2.2) + '@tanstack/router-generator': 1.167.38 + '@tanstack/router-utils': 1.162.3 chokidar: 5.0.0 unplugin: 3.4.0(rolldown@1.2.9)(vite@8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1)) - zod: 4.6.5 + zod: 4.6.7 optionalDependencies: '@tanstack/react-router': 1.170.38(react-dom@19.3.0(react@19.3.0))(react@19.3.0) vite: 8.3.0(@types/node@26.6.2)(jiti@2.7.0)(sass@1.104.1) @@ -2784,13 +2784,13 @@ snapshots: - supports-color - unloader - '@tanstack/router-utils@1.162.3(supports-color@10.2.2)': + '@tanstack/router-utils@1.162.3': dependencies: '@babel/generator': 7.29.8 '@babel/parser': 7.29.9 '@babel/types': 7.29.8 ansis: 4.4.0 - babel-dead-code-elimination: 1.0.12(supports-color@10.2.2) + babel-dead-code-elimination: 1.0.12 diff: 8.0.4 pathe: 2.0.3 tinyglobby: 0.2.17 @@ -2916,11 +2916,11 @@ snapshots: postcss: 8.5.28 postcss-value-parser: 4.2.0 - babel-dead-code-elimination@1.0.12(supports-color@10.2.2): + babel-dead-code-elimination@1.0.12: dependencies: - '@babel/core': 7.29.7(supports-color@10.2.2) + '@babel/core': 7.29.7 '@babel/parser': 7.29.9 - '@babel/traverse': 7.29.8(supports-color@10.2.2) + '@babel/traverse': 7.29.8 '@babel/types': 7.29.8 transitivePeerDependencies: - supports-color @@ -3013,11 +3013,9 @@ snapshots: dayjs@1.11.23: {} - debug@4.4.3(supports-color@10.2.2): + debug@4.4.3: dependencies: ms: 2.1.3 - optionalDependencies: - supports-color: 10.2.2 decode-named-character-reference@1.3.0: dependencies: @@ -3180,7 +3178,7 @@ snapshots: '@ungap/structured-clone': 1.4.0 unist-util-position: 5.0.0 - hast-util-to-jsx-runtime@2.3.6(supports-color@10.2.2): + hast-util-to-jsx-runtime@2.3.6: dependencies: '@types/estree': 1.0.9 '@types/hast': 3.0.5 @@ -3189,9 +3187,9 @@ snapshots: devlop: 1.1.0 estree-util-is-identifier-name: 3.0.0 hast-util-whitespace: 3.0.0 - mdast-util-mdx-expression: 2.0.1(supports-color@10.2.2) - mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) - mdast-util-mdxjs-esm: 2.0.1(supports-color@10.2.2) + mdast-util-mdx-expression: 2.0.1 + mdast-util-mdx-jsx: 3.2.0 + mdast-util-mdxjs-esm: 2.0.1 property-information: 7.2.0 space-separated-tokens: 2.0.2 style-to-js: 1.1.21 @@ -3383,14 +3381,14 @@ snapshots: unist-util-is: 6.0.1 unist-util-visit-parents: 6.0.2 - mdast-util-from-markdown@2.0.3(supports-color@10.2.2): + mdast-util-from-markdown@2.0.3: dependencies: '@types/mdast': 4.0.4 '@types/unist': 3.0.3 decode-named-character-reference: 1.3.0 devlop: 1.1.0 mdast-util-to-string: 4.0.0 - micromark: 4.0.2(supports-color@10.2.2) + micromark: 4.0.2 micromark-util-decode-numeric-character-reference: 2.0.2 micromark-util-decode-string: 2.0.1 micromark-util-normalize-identifier: 2.0.1 @@ -3408,67 +3406,67 @@ snapshots: mdast-util-find-and-replace: 3.0.2 micromark-util-character: 2.1.1 - mdast-util-gfm-footnote@2.1.0(supports-color@10.2.2): + mdast-util-gfm-footnote@2.1.0: dependencies: '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 micromark-util-normalize-identifier: 2.0.1 transitivePeerDependencies: - supports-color - mdast-util-gfm-strikethrough@2.0.0(supports-color@10.2.2): + mdast-util-gfm-strikethrough@2.0.0: dependencies: '@types/mdast': 4.0.4 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-gfm-table@2.0.0(supports-color@10.2.2): + mdast-util-gfm-table@2.0.0: dependencies: '@types/mdast': 4.0.4 devlop: 1.1.0 markdown-table: 3.0.4 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-gfm-task-list-item@2.0.0(supports-color@10.2.2): + mdast-util-gfm-task-list-item@2.0.0: dependencies: '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-gfm@3.1.0(supports-color@10.2.2): + mdast-util-gfm@3.1.0: dependencies: - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-gfm-autolink-literal: 2.0.1 - mdast-util-gfm-footnote: 2.1.0(supports-color@10.2.2) - mdast-util-gfm-strikethrough: 2.0.0(supports-color@10.2.2) - mdast-util-gfm-table: 2.0.0(supports-color@10.2.2) - mdast-util-gfm-task-list-item: 2.0.0(supports-color@10.2.2) + mdast-util-gfm-footnote: 2.1.0 + mdast-util-gfm-strikethrough: 2.0.0 + mdast-util-gfm-table: 2.0.0 + mdast-util-gfm-task-list-item: 2.0.0 mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-mdx-expression@2.0.1(supports-color@10.2.2): + mdast-util-mdx-expression@2.0.1: dependencies: '@types/estree-jsx': 1.0.5 '@types/hast': 3.0.5 '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-mdx-jsx@3.2.0(supports-color@10.2.2): + mdast-util-mdx-jsx@3.2.0: dependencies: '@types/estree-jsx': 1.0.5 '@types/hast': 3.0.5 @@ -3476,7 +3474,7 @@ snapshots: '@types/unist': 3.0.3 ccount: 2.0.1 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 parse-entities: 4.0.2 stringify-entities: 4.0.4 @@ -3485,13 +3483,13 @@ snapshots: transitivePeerDependencies: - supports-color - mdast-util-mdxjs-esm@2.0.1(supports-color@10.2.2): + mdast-util-mdxjs-esm@2.0.1: dependencies: '@types/estree-jsx': 1.0.5 '@types/hast': 3.0.5 '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color @@ -3704,10 +3702,10 @@ snapshots: micromark-util-types@2.0.2: {} - micromark@4.0.2(supports-color@10.2.2): + micromark@4.0.2: dependencies: '@types/debug': 4.1.13 - debug: 4.4.3(supports-color@10.2.2) + debug: 4.4.3 decode-named-character-reference: 1.3.0 devlop: 1.1.0 micromark-core-commonmark: 2.0.3 @@ -3874,17 +3872,17 @@ snapshots: dependencies: react: 19.3.0 - react-markdown@10.1.0(@types/react@19.3.0)(react@19.3.0)(supports-color@10.2.2): + react-markdown@10.1.0(@types/react@19.3.0)(react@19.3.0): dependencies: '@types/hast': 3.0.5 '@types/mdast': 4.0.4 '@types/react': 19.3.0 devlop: 1.1.0 - hast-util-to-jsx-runtime: 2.3.6(supports-color@10.2.2) + hast-util-to-jsx-runtime: 2.3.6 html-url-attributes: 3.0.1 mdast-util-to-hast: 13.2.1 react: 19.3.0 - remark-parse: 11.0.0(supports-color@10.2.2) + remark-parse: 11.0.0 remark-rehype: 11.1.2 unified: 11.0.5 unist-util-visit: 5.1.0 @@ -3907,21 +3905,21 @@ snapshots: '@types/hast': 3.0.5 hast-util-sanitize: 5.0.2 - remark-gfm@4.0.1(supports-color@10.2.2): + remark-gfm@4.0.1: dependencies: '@types/mdast': 4.0.4 - mdast-util-gfm: 3.1.0(supports-color@10.2.2) + mdast-util-gfm: 3.1.0 micromark-extension-gfm: 3.0.0 - remark-parse: 11.0.0(supports-color@10.2.2) + remark-parse: 11.0.0 remark-stringify: 11.0.0 unified: 11.0.5 transitivePeerDependencies: - supports-color - remark-parse@11.0.0(supports-color@10.2.2): + remark-parse@11.0.0: dependencies: '@types/mdast': 4.0.4 - mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-from-markdown: 2.0.3 micromark-util-types: 2.0.2 unified: 11.0.5 transitivePeerDependencies: @@ -4042,33 +4040,33 @@ snapshots: dependencies: inline-style-parser: 0.2.7 - stylelint-config-recommended-scss@17.0.1(postcss@8.5.28)(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)): + stylelint-config-recommended-scss@17.0.1(postcss@8.5.28)(stylelint@17.15.0(typescript@6.0.3)): dependencies: postcss-scss: 4.0.9(postcss@8.5.28) - stylelint: 17.15.0(supports-color@10.2.2)(typescript@6.0.3) - stylelint-config-recommended: 18.0.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) - stylelint-scss: 7.3.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) + stylelint: 17.15.0(typescript@6.0.3) + stylelint-config-recommended: 18.0.0(stylelint@17.15.0(typescript@6.0.3)) + stylelint-scss: 7.3.0(stylelint@17.15.0(typescript@6.0.3)) optionalDependencies: postcss: 8.5.28 - stylelint-config-recommended@18.0.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)): + stylelint-config-recommended@18.0.0(stylelint@17.15.0(typescript@6.0.3)): dependencies: - stylelint: 17.15.0(supports-color@10.2.2)(typescript@6.0.3) + stylelint: 17.15.0(typescript@6.0.3) - stylelint-config-standard-scss@17.0.0(postcss@8.5.28)(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)): + stylelint-config-standard-scss@17.0.0(postcss@8.5.28)(stylelint@17.15.0(typescript@6.0.3)): dependencies: - stylelint: 17.15.0(supports-color@10.2.2)(typescript@6.0.3) - stylelint-config-recommended-scss: 17.0.1(postcss@8.5.28)(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) - stylelint-config-standard: 40.0.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) + stylelint: 17.15.0(typescript@6.0.3) + stylelint-config-recommended-scss: 17.0.1(postcss@8.5.28)(stylelint@17.15.0(typescript@6.0.3)) + stylelint-config-standard: 40.0.0(stylelint@17.15.0(typescript@6.0.3)) optionalDependencies: postcss: 8.5.28 - stylelint-config-standard@40.0.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)): + stylelint-config-standard@40.0.0(stylelint@17.15.0(typescript@6.0.3)): dependencies: - stylelint: 17.15.0(supports-color@10.2.2)(typescript@6.0.3) - stylelint-config-recommended: 18.0.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)) + stylelint: 17.15.0(typescript@6.0.3) + stylelint-config-recommended: 18.0.0(stylelint@17.15.0(typescript@6.0.3)) - stylelint-scss@7.3.0(stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3)): + stylelint-scss@7.3.0(stylelint@17.15.0(typescript@6.0.3)): dependencies: '@csstools/css-calc': 3.4.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.1))(@csstools/css-tokenizer@4.0.1) '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.1) @@ -4081,9 +4079,9 @@ snapshots: postcss-resolve-nested-selector: 0.1.6 postcss-selector-parser: 7.1.6 postcss-value-parser: 4.2.0 - stylelint: 17.15.0(supports-color@10.2.2)(typescript@6.0.3) + stylelint: 17.15.0(typescript@6.0.3) - stylelint@17.15.0(supports-color@10.2.2)(typescript@6.0.3): + stylelint@17.15.0(typescript@6.0.3): dependencies: '@csstools/css-calc': 3.4.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.1))(@csstools/css-tokenizer@4.0.1) '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.1) @@ -4096,7 +4094,7 @@ snapshots: cosmiconfig: 9.0.2(typescript@6.0.3) css-functions-list: 3.3.3 css-tree: 3.2.1 - debug: 4.4.3(supports-color@10.2.2) + debug: 4.4.3 fast-glob: 3.3.3 fastest-levenshtein: 1.0.16 file-entry-cache: 11.1.5 @@ -4262,7 +4260,7 @@ snapshots: yallist@3.1.1: {} - zod@4.6.5: {} + zod@4.6.7: {} zustand@5.0.15(@types/react@19.3.0)(react@19.3.0)(use-sync-external-store@1.7.0(react@19.3.0)): optionalDependencies: From 0ae9440010406f207c2efef7e50878439c8f9e01 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 09:39:41 +0000 Subject: [PATCH 09/10] chore(nix): update new-ui pnpm deps hash --- nix/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix/package.nix b/nix/package.nix index 96cfe4fe3..20ef94ea4 100644 --- a/nix/package.nix +++ b/nix/package.nix @@ -90,7 +90,7 @@ inherit version pnpm; src = ../new-ui; fetcherVersion = 4; - hash = "sha256-hweM8A9UL2vxq7DH+5+cmfrg9IoI2li+3yMreeN3s0k="; + hash = "sha256-1lCDd2pNRpRq0mA4T3JBFDUw+T2WAAszHdVDWjcP2g4="; }; # Pre-build the new UI frontend so Tauri can serve it as WebviewUrl::App("compact/") and "full/". From 51ecf0d96c59af1281cfa903c966fe8a85a2af70 Mon Sep 17 00:00:00 2001 From: Aleksander <170264518+t-aleksander@users.noreply.github.com> Date: Mon, 26 Oct 2026 10:57:42 +0100 Subject: [PATCH 10/10] bump tokio --- src-tauri/Cargo.lock | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index e3b9705b0..df68dcf19 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -128,7 +128,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -139,7 +139,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -1971,7 +1971,7 @@ dependencies = [ "libc", "option-ext", "redox_users 0.5.3", - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -2252,7 +2252,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3484,7 +3484,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3735,7 +3735,7 @@ version = "1.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a1886916523694cd6ea3d175f03a1e5010699a2a4cc13696d83d7bea1d80638" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4076,7 +4076,7 @@ dependencies = [ "png 0.18.1", "serde", "thiserror 2.0.21", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -4295,7 +4295,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -4855,7 +4855,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.45.0", ] [[package]] @@ -5513,7 +5513,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5994,7 +5994,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6053,7 +6053,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6520,7 +6520,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -7557,7 +7557,7 @@ dependencies = [ "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7691,9 +7691,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -8123,7 +8123,7 @@ dependencies = [ "png 0.18.1", "serde", "thiserror 2.0.21", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -8180,7 +8180,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e" dependencies = [ "memoffset", "tempfile", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -8802,7 +8802,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]]