Repository navigation
fix(deps): refresh secure document and HTTP dependencies - #8
Merged
Merged
Conversation
Updates the requirements on [reqwest](https://github.com/seanmonstar/reqwest) to permit the latest version. Updates `reqwest` to 0.12.28 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.12.0...v0.12.28) --- updated-dependencies: - dependency-name: reqwest dependency-version: 0.12.28 dependency-type: direct:production dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
chaliy
changed the title
dependabot
Bot
deleted the
dependabot/cargo/rust-dependencies-f519650509
branch
October 22, 2026 14:05
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Refresh Markkit's HTTP and document parsing dependencies, preserve Unicode/CP437 archive lookup with ZIP9, and use Node.js24.22.1 for JavaScript build and packaging. Commit the workspace lockfile so CLI/bindings and advisory checks share an exact resolution.
Why
The previous graph allowed vulnerable TLS/trust and ZIP dependencies; Node20 no longer receives the October security fixes. This extends the existing dependency PR and incorporates current main without discarding subsequent document-parser work.
Before / After
Before: reqwest0.12, calamine0.36/ZIP8, Node20 workflows, no committed Cargo.lock.
After: reqwest0.13.5, calamine0.37.0/ZIP9.0.5, rustls0.23.46, rustls-webpki0.103.16, root-certs1.0.10; Node24.22.1. Offline RustSec: zero vulnerability findings.
Validation:
just pre-prpassed (fmt, Clippy, workspace tests, cargo-deny advisories/bans/licenses/sources); workspace all-features tests passed; rustdoc with-D warningspassed; local HTML-to-Markdown CLI smoke passed. Added Unicode/case-insensitive and CP437 filename regressions for the ZIP9 API migration.Risk
Medium: HTTP and ZIP API upgrades. Archive name decoding errors propagate; bounded entry reads and decompression budgets remain enforced. No filesystem archive extraction was introduced.
No version bump, tag, release, package publication or deployment. Main release workflow runs only for an explicit release-preparation commit or manual dispatch; this security change does not trigger it.
Checklist