From 6d97f257d28ffcf937703d0079af8af6f2b2e671 Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Mon, 2 Nov 2026 21:30:06 +0700 Subject: [PATCH 1/2] build(linux): update pulldown-cmark to 0.13.6 cargo deny fails every pull request that runs the Linux checks on RUSTSEC-2026-0433, quadratic parsing of nested image wikilinks in pulldown-cmark 0.13.5, fixed in 0.13.6. The assistant's Markdown renderer does not enable wikilinks, so the app was not affected. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index c2d818872c..b53d06fd5b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4532,9 +4532,9 @@ dependencies = [ [[package]] name = "pulldown-cmark" -version = "0.13.5" +version = "0.13.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" +checksum = "3db2be46835f013dd3f4fa7f5f7402c537787b54ebb6fe2b94bbdd7e2669bb7b" dependencies = [ "bitflags 2.13.2", "memchr", From 93329264b1f34eeb072d47c28017270b2d4e5f9c Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Mon, 2 Nov 2026 23:20:15 +0700 Subject: [PATCH 2/2] build(linux): regenerate the license files for pulldown-cmark 0.13.6 --- linux/build-aux/debian/copyright | 2 +- linux/data/licenses/THIRD-PARTY-NOTICE.md | 2 +- linux/data/licenses/third-party.json | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/linux/build-aux/debian/copyright b/linux/build-aux/debian/copyright index 91b4cfd92f..c7c133a944 100644 --- a/linux/build-aux/debian/copyright +++ b/linux/build-aux/debian/copyright @@ -6807,7 +6807,7 @@ License: Expat OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -Files: vendor/pulldown-cmark-0.13.5/* +Files: vendor/pulldown-cmark-0.13.6/* Copyright: 2015 Google Inc. All rights reserved. License: Expat The MIT License diff --git a/linux/data/licenses/THIRD-PARTY-NOTICE.md b/linux/data/licenses/THIRD-PARTY-NOTICE.md index b91f660aaa..e0db46c3a3 100644 --- a/linux/data/licenses/THIRD-PARTY-NOTICE.md +++ b/linux/data/licenses/THIRD-PARTY-NOTICE.md @@ -9632,7 +9632,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI Used by: -- pulldown-cmark 0.13.5 +- pulldown-cmark 0.13.6 ~~~~text The MIT License diff --git a/linux/data/licenses/third-party.json b/linux/data/licenses/third-party.json index eb4f2e38a4..20a585533b 100644 --- a/linux/data/licenses/third-party.json +++ b/linux/data/licenses/third-party.json @@ -1827,7 +1827,7 @@ "name": "MIT License", "text": "The MIT License\n\nCopyright 2015 Google Inc. All rights reserved.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n", "used_by": [ - { "crate": { "name": "pulldown-cmark", "version": "0.13.5" } } + { "crate": { "name": "pulldown-cmark", "version": "0.13.6" } } ] }, { @@ -2719,7 +2719,7 @@ { "name": "pretty-hex", "version": "0.4.2", "license": "MIT" }, { "name": "proc-macro-crate", "version": "3.5.0", "license": "MIT OR Apache-2.0" }, { "name": "proc-macro2", "version": "1.0.107", "license": "MIT OR Apache-2.0" }, - { "name": "pulldown-cmark", "version": "0.13.5", "license": "MIT" }, + { "name": "pulldown-cmark", "version": "0.13.6", "license": "MIT" }, { "name": "quote", "version": "1.0.47", "license": "MIT OR Apache-2.0" }, { "name": "radium", "version": "0.7.0", "license": "MIT" }, { "name": "rand", "version": "0.9.5", "license": "MIT OR Apache-2.0" },