From 7ad7f22f4df3298ac4f28bad12f2c745fbdffd74 Mon Sep 17 00:00:00 2001 From: Hamza Date: Mon, 26 Oct 2026 17:12:09 +0500 Subject: [PATCH] Pin the indd dependency by rev, as every other git dependency is (#1599) `indd` was the one git dependency taken from a branch: indd = { git = "https://github.com/storytold/indd-utils", branch = "main" } `Cargo.lock` pinned a commit, but any `cargo update` -- and `.github/dependabot.yml` runs them -- pulls whatever is on that branch into a parser of untrusted INDD files, with no review of what changed. The craft-libs dependencies beside it are all `rev = "b926b5c0..."`. Pinned to `7f3060e5bce78d21ea70e0d5eacb96edce15dfbe`, which is the commit the lock already held: the only change in `Cargo.lock` is the source string, `?branch=main` to `?rev=7f3060e5...`, so no code moves with this. Verified: `cargo check --locked -p designcraft-engine` passes, and `indd_files_go_through_the_converter_and_its_errors_are_open_errors` still passes, so the converter is the same one. Audit DC-18. --- Cargo.lock | 2 +- Cargo.toml | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index eabe9e52e..0a0688da5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3120,7 +3120,7 @@ checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c" [[package]] name = "indd" version = "0.1.0" -source = "git+https://github.com/storytold/indd-utils?branch=main#7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" +source = "git+https://github.com/storytold/indd-utils?rev=7f3060e5bce78d21ea70e0d5eacb96edce15dfbe#7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" [[package]] name = "indexmap" diff --git a/Cargo.toml b/Cargo.toml index 195f39e67..2924c8275 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -75,9 +75,12 @@ flo_curves = "0.8" qrcodegen = "1.8" quick-xml = "0.41" zip = { version = "3", default-features = false, features = ["deflate"] } -# INDD/INDT → IDML conversion for File › Open: storytold/indd-utils, tracking its main branch +# INDD/INDT → IDML conversion for File › Open: storytold/indd-utils, pinned by rev as every other +# git dependency here is. It parses untrusted INDD files, and `branch = "main"` meant any +# `cargo update` -- Dependabot runs them -- pulled whatever was on that branch into the parser +# without review (#1599). # (MIT OR Apache-2.0, no dependencies, builds for wasm). -indd = { git = "https://github.com/storytold/indd-utils", branch = "main" } +indd = { git = "https://github.com/storytold/indd-utils", rev = "7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" } # Which paths stored in documents may be followed (craft-libs). craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7" }