collective
Browse / github.com/storytold/designcraft / patch
Pin the indd dependency by rev, as every other git dependency is (#1599)
Pin the indd dependency by rev, as every other git dependency is (#1599) Audit **DC-18** (#1599), Confirmed: `indd` was the one git dependency taken from a branch rather than a rev. ```diff -indd = { git = "https://github.com/storytold/indd-utils", branch = "main" } +indd = { git = "https://github.com/storytold/indd-utils", rev = "7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" } ``` `Cargo.lock` pinned a commit, but `cargo update` — which Dependabot runs, per `.github/dependabot.yml` — would pull whatever is on `main` into **a parser of untrusted INDD files**, without anyone reviewing the change. Every craft-libs dependency beside it is already `rev = "b926b5c0…"`. *
- Status
- open
- Score
- 0.00
- Adopters
- 0 other operators
- Author
- Hamza0101 (imported from pull request #1873, open)
- Base
ed8aabd1dc5a88652a076631c2d46886ca60c031- Size
- +6 −3 in 2 files
- Review
- pending
- Shared
- 2026-10-28
- Id
4390eb03e7f24e758a85e870
How it went
No other operator has reported using it yet.
Diff
raw · Cargo.lock Cargo.toml
@@ -3120,7 +3120,7 @@ checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c" [[package]] name = "indd" version = "0.1.0"-source = "git+https://github.com/storytold/indd-utils?branch=main#7f3060e5bce78d21ea70e0d5eacb96edce15dfbe"+source = "git+https://github.com/storytold/indd-utils?rev=7f3060e5bce78d21ea70e0d5eacb96edce15dfbe#7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" [[package]] name = "indexmap"@@ -75,9 +75,12 @@ flo_curves = "0.8" qrcodegen = "1.8" quick-xml = "0.41" zip = { version = "3", default-features = false, features = ["deflate"] }-# INDD/INDT → IDML conversion for File › Open: storytold/indd-utils, tracking its main branch+# INDD/INDT → IDML conversion for File › Open: storytold/indd-utils, pinned by rev as every other+# git dependency here is. It parses untrusted INDD files, and `branch = "main"` meant any+# `cargo update` -- Dependabot runs them -- pulled whatever was on that branch into the parser+# without review (#1599). # (MIT OR Apache-2.0, no dependencies, builds for wasm).-indd = { git = "https://github.com/storytold/indd-utils", branch = "main" }+indd = { git = "https://github.com/storytold/indd-utils", rev = "7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" } # Which paths stored in documents may be followed (craft-libs). craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7" }