From dabdb1e36c336b795d2d2f6e2c416a1f4dd5df94 Mon Sep 17 00:00:00 2001 From: "Aaron K. White" Date: Sat, 5 Sep 2026 10:25:07 -0400 Subject: [PATCH] docs(changelog): record audit workflow fix and cleared advisories Adds an Unreleased section covering the two commits already on main: the Security Audit toolchain fix and the five RUSTSEC advisories it surfaced once it could run. Reachability for each advisory was checked against the actual dependency graph rather than assumed: crossbeam-epoch via termimad; the affected fmt impl is never invoked h2 via reqwest/hyper; genuinely on the HTTP path quinn-proto lockfile only, absent from the graph on every target anyhow direct dep, but downcast_mut is never called scc dev-only via serial_test, now gone from the tree Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd --- CHANGELOG.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bdbf517..35b9955 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,20 @@ All notable changes to linear-cli will be documented in this file. Versioning follows [CalVer](https://calver.org/) with format `YYYY.MM.PATCH`. +## [Unreleased] + +The weekly Security Audit workflow had been failing since 2026-07-19 without running its audit, so five advisories accumulated undetected. The workflow is fixed and all five are cleared. Severity: LOW — one advisory was reachable in principle and rated low by upstream; the rest were unreachable, dev-only, or lockfile-only. + +### Fixed +- Security Audit workflow now builds `cargo-audit` with the latest stable toolchain. `rustsec/audit-check` installs the tool unlocked, so it resolved `kstring 2.0.4`, which requires rustc 1.96 — the job's pinned 1.94 channel could not compile it, and the audit had not actually run for seven consecutive weeks. `RUSTUP_TOOLCHAIN` now overrides `rust-toolchain.toml` for that job only; the crate's pinned channel is unchanged everywhere else. + +### Security +- Bumped `crossbeam-epoch` to 0.9.20 to patch RUSTSEC-2026-0204 (invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared`). Transitive via `termimad` — `lin` never formats those types. +- Bumped `h2` to 0.4.19 to patch RUSTSEC-2026-0258 (unbounded queueing of empty DATA frames). Transitive via `reqwest`/`hyper` and on the live HTTP path; rated low severity upstream. +- Bumped `quinn-proto` to 0.11.17 to patch RUSTSEC-2026-0185 (remote memory exhaustion in out-of-order stream reassembly). Present in `Cargo.lock` only — `reqwest` is built with `default-features = false`, so no QUIC/HTTP-3 code is in the build graph on any target. +- Bumped `anyhow` to 1.0.104 to clear RUSTSEC-2026-0190 (unsoundness in `Error::downcast_mut()`). `lin` does not call `downcast_mut`. +- Moved the `serial_test` dev-dependency from 3 to 4, dropping `scc` from the tree entirely and clearing RUSTSEC-2026-0205 (exception-safety flaw in `Array::insert`). Dev-only — `scc` never shipped in the binary. + ## [2026.5.5] — 2026-05-10 Peer CLIs (`bosshogg`, etc.) write `command_executed` events to the same PostHog project, so dashboards filtering only on the event name commingle data across tools. This release tags every lin event with a literal `app: "lin"` property so dashboards can partition cleanly. Severity: LOW — additive only, no existing properties changed, no event renamed, no identifier scheme touched.