Dependency audit failed on main #252

Activity

1. github-actions

   added

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   on Oct 5, 2026
2. github-actions commented on Oct 12, 2026

   

   github-actionsBot

   on Oct 12, 2026 – with GitHub Actions

   Author

   More actions

   The scheduled audit failed again: https://github.com/HKUDS/DeepCode/actions/runs/38205215450
3. Zongwei9888

   added a commit that references this issue on Oct 12, 2026

   build(desktop): take the patched brace-expansion, source-map-js and u…

   ...

   3d40e25
4. github-actions commented on Oct 19, 2026

   

   github-actionsBot

   on Oct 19, 2026 – with GitHub Actions

   Author

   More actions

   The scheduled audit failed again: https://github.com/HKUDS/DeepCode/actions/runs/39200363456
5. github-actions commented on Oct 26, 2026

   

   github-actionsBot

   on Oct 26, 2026 – with GitHub Actions

   Author

   More actions

   The scheduled audit failed again: https://github.com/HKUDS/DeepCode/actions/runs/40270120497
6. Zongwei9888

   added a commit that references this issue on Oct 26, 2026

   build(desktop): take the patched aiohttp, certifi, mcp, pypdf and set…

   ...

   1aacb67
7. Zongwei9888

   closed this as completedin #278on Oct 26, 2026
8. Zongwei9888

   reopened this on Oct 26, 2026
9. Zongwei9888 commented on Oct 26, 2026

   

   Zongwei9888

   on Oct 26, 2026

   Collaborator

   More actions

   Reopening. #278 (merged as db40882, plus cd7ab47 for the CI lock) fixes the "Audit locked App Server environment" step: pip-audit finds nothing in the new sidecar lock.

   The step after it was skipped in every failing run, and it fails on its own: cargo audit on desktop/src-tauri/Cargo.lock reports rustls 0.23.45 (4 advisories), rustls-webpki 0.103.15, webpki-root-certs 1.0.8 and zip 4.6.1 (3 advisories, one critical, pulled in by tauri-plugin-updater). Keeping this open until those are bumped.