From cf4994f82034fc05f642292aa91e155c7b19aec9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 08:26:08 +0000 Subject: [PATCH 1/5] chore(deps): bump jwalk from 0.8.1 to 0.9.0 in /src-tauri Bumps [jwalk](https://github.com/Byron/jwalk) from 0.8.1 to 0.9.0. - [Release notes](https://github.com/Byron/jwalk/releases) - [Changelog](https://github.com/Byron/jwalk/blob/main/CHANGELOG.md) - [Commits](https://github.com/Byron/jwalk/compare/v0.8.1...v0.9.0) --- updated-dependencies: - dependency-name: jwalk dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- src-tauri/Cargo.lock | 4 ++-- src-tauri/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 53e976f68..3768f525e 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -2289,9 +2289,9 @@ dependencies = [ [[package]] name = "jwalk" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2735847566356cd2179a2a38264839308f7079fa96e6bd5a42d740460e003c56" +checksum = "5e610b2b1eaea9e0e062c47e319d20a2e0f929e7aabf24d58514354de967bfbd" dependencies = [ "crossbeam", "rayon", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 445985b92..3835e769f 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -125,7 +125,7 @@ tauri-plugin-opener = "2" tauri-plugin-dialog = "2" serde = { version = "1", features = ["derive"] } serde_json = "1" -jwalk = "0.8" +jwalk = "0.9" trash = "5.2.6" blake3 = "1.8.5" base64 = "0.23.1" From 20fc074b3f7a4664f2fecba909a285f18e81497f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 20:59:45 +0900 Subject: [PATCH 2/5] test: reject unmaintained jwalk dependency --- .../tests/dependency_maintenance_contract.rs | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 src-tauri/tests/dependency_maintenance_contract.rs diff --git a/src-tauri/tests/dependency_maintenance_contract.rs b/src-tauri/tests/dependency_maintenance_contract.rs new file mode 100644 index 000000000..b6d13a01c --- /dev/null +++ b/src-tauri/tests/dependency_maintenance_contract.rs @@ -0,0 +1,23 @@ +//! Supply-chain maintenance regressions for direct Rust dependencies. +//! +//! These tests intentionally inspect the source-controlled manifest so an unused, +//! abandoned direct dependency cannot be reintroduced by a routine version bump. + +/// DiskSage must not directly depend on the abandoned `jwalk` crate. +/// +/// Upstream's 0.9.0 release explicitly marks the crate unmaintained. DiskSage has +/// no source reference to `jwalk`, so retaining it would add unsupported supply- +/// chain surface without providing product behavior. +#[test] +fn unmaintained_jwalk_is_not_a_direct_dependency() { + let manifest = include_str!("../Cargo.toml"); + let has_jwalk_dependency = manifest.lines().any(|line| { + let trimmed = line.trim_start(); + trimmed.starts_with("jwalk =") || trimmed.starts_with("jwalk=") + }); + + assert!( + !has_jwalk_dependency, + "remove the unused unmaintained jwalk direct dependency instead of upgrading it" + ); +} From 4258c7d763b413aba51a25711e4662e6acf7ea62 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 21:01:57 +0900 Subject: [PATCH 3/5] fix: remove unmaintained unused jwalk dependency --- src-tauri/Cargo.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 3835e769f..e21fbdf86 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -125,7 +125,6 @@ tauri-plugin-opener = "2" tauri-plugin-dialog = "2" serde = { version = "1", features = ["derive"] } serde_json = "1" -jwalk = "0.9" trash = "5.2.6" blake3 = "1.8.5" base64 = "0.23.1" From 9a4d87552ecc2aa803009de56c551847163891c6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 21:04:56 +0900 Subject: [PATCH 4/5] fix: restore jwalk until traversal replacement is integrated --- src-tauri/Cargo.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index e21fbdf86..3835e769f 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -125,6 +125,7 @@ tauri-plugin-opener = "2" tauri-plugin-dialog = "2" serde = { version = "1", features = ["derive"] } serde_json = "1" +jwalk = "0.9" trash = "5.2.6" blake3 = "1.8.5" base64 = "0.23.1" From 47484176ca58b2f0e09fad7ccd187eba7a2eba02 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 21:05:17 +0900 Subject: [PATCH 5/5] test: remove premature jwalk absence assertion --- .../tests/dependency_maintenance_contract.rs | 23 ------------------- 1 file changed, 23 deletions(-) delete mode 100644 src-tauri/tests/dependency_maintenance_contract.rs diff --git a/src-tauri/tests/dependency_maintenance_contract.rs b/src-tauri/tests/dependency_maintenance_contract.rs deleted file mode 100644 index b6d13a01c..000000000 --- a/src-tauri/tests/dependency_maintenance_contract.rs +++ /dev/null @@ -1,23 +0,0 @@ -//! Supply-chain maintenance regressions for direct Rust dependencies. -//! -//! These tests intentionally inspect the source-controlled manifest so an unused, -//! abandoned direct dependency cannot be reintroduced by a routine version bump. - -/// DiskSage must not directly depend on the abandoned `jwalk` crate. -/// -/// Upstream's 0.9.0 release explicitly marks the crate unmaintained. DiskSage has -/// no source reference to `jwalk`, so retaining it would add unsupported supply- -/// chain surface without providing product behavior. -#[test] -fn unmaintained_jwalk_is_not_a_direct_dependency() { - let manifest = include_str!("../Cargo.toml"); - let has_jwalk_dependency = manifest.lines().any(|line| { - let trimmed = line.trim_start(); - trimmed.starts_with("jwalk =") || trimmed.starts_with("jwalk=") - }); - - assert!( - !has_jwalk_dependency, - "remove the unused unmaintained jwalk direct dependency instead of upgrading it" - ); -}