Repository navigation
fix(kdbx): update keepass to correct DeletionTime serialization - #498
Merged
Merged
Conversation
ifiokjr
added a commit
to ifiokjr/monosecret
that referenced
this pull request
Oct 24, 2026
… fixes (#100) * chore: sync upstream SecretSpec 0.21.1 post-release work (b3a2919..50ff51e) Port the upstream post-0.21.1 changes into the fork: - retry transient provider failures (cachix#478) with RetryPolicy plumbing - credential generators and X.509 identities (cachix#483) - preserve encoded X.509 identities on text writes (cachix#493) - profile selection for import (cachix#494) - redact ResolvedSecret values in Debug output (cachix#470) - bound v1 JSON integers for portable clients (cachix#467) - accept additive v1 response fields (cachix#466) - add schema directive to generated manifest (cachix#465) - warn about ignored unknown fields in secret declarations (cachix#485) - make block_on safe inside current-thread runtimes (cachix#468) - accept additive v1 initialize result members in resolver-c (cachix#471) - install fake provider CLIs without holding a write descriptor (cachix#479) sync-report.txt documents the per-path port status. Also fix the local dprint dart exec command to run dart format in stdin mode (the exec plugin contract); the dartfmt wrapper never drained stdin so every local dprint run over dart files failed with a broken pipe. CI never noticed because the lint job runs dart format directly. Two dart files local dprint could never reach are formatted as part of this. * chore: port upstream follow-up fixes and advisory bumps - fix(check): stop persisting as_path temp files (upstream cachix#469, 123cdfb): check never prints the paths, so decrypted secrets accumulated in the temp directory; they now drop with the command. Regression tests pin get/export persistence and check cleanup. - fix(kdbx): keepass 0.13.17 -> 0.13.21 for correct DeletionTime serialization (upstream cachix#498, bd45207). - feat(protonpass): read item fields through `field` refs (upstream cachix#500, 12fe45b); field refs stay read-only because pass-cli only accepts field values as command-line arguments, which would expose them in the process list. - fix(ipc): port the missed C half of additive v1 initialize results (upstream cachix#471, 16cd582): requests stay strict, results tolerate unknown members. Caught by the client-additive-initialize conformance case the sync ported. - restore the wire_integer module and MAX_JSON_INTEGER declarations the rebase dropped from monosecret_rpc's crate root. - chore(deps): rustls 0.23.46, rustls-webpki 0.103.16, webpki-root-certs 1.0.11 for RUSTSEC advisories (secret-exposing Debug impls, KEX downgrade, distrusted intermediates, emSign distrust). * build: regenerate pnpm lockfile for workspace platform deps The sync pointed @monosecret/cli's optional platform dependencies at workspace:* but left pnpm-lock.yaml at the 0.4.4 specifiers, so every CI job's frozen-lockfile install failed during setup. * fix: repair CI breaks in the upstream sync port - pulumi standalone feature: name dep:http like every other reqwest feature; the shared response buffering in provider/http.rs builds an ::http::Response, so --no-default-features --features pulumi failed. - docs: port the VersionCompatibility marker as a local component for the mdx pages and as plain markdown (badge notes and Changed-in callouts) for the md pages, which cannot use components; upstream left a stray closing tag behind the extraction section, now a proper callout. Upstream 0.22 version markers map to the fork's 0.5.0. * fix(provider): gate preferred_env for the vercel feature too vercel.rs reads its team ID through preferred_env, but the re-export was gated on cloudflare/openbao/scaleway/vault only, so a standalone --features vercel check failed to find it. The full standalone feature matrix now passes locally. * fix(ipc): clamp embedded IPC schema integers to the v1 JSON bound The port bounded response integers to the 2^53-1 range every v1 JSON peer can represent, but the checked-in IPC schemas still advertised u64::MAX maximums. The discover document embeds those schemas verbatim, so its own response failed the new integer validation and degraded to an internal error — the wire.notifications conformance case caught it because it is the first case to call rpc.discover. Clamp the schema maximums to 9007199254740991, matching upstream. * fix(ipc): restore ported files the rebase silently reverted The rebase onto main replayed only the sync diff, so rpc and C files that an earlier partial port had already carried but the sync commit itself never touched fell back to their pre-port versions: - error.rs: the wire-integer serde bounds on InteractionReference and ErrorData, and the tolerant (additive) error parsing from upstream 7a2502c — the ported integer_bounds tests failed without them - internal.h, json.c, fake_peer.c, regressions.c in the C resolver - the dead root test crate stays deleted; the shell fixtures the bw tests include_str! are kept - the canonical root schema/ copies now match the clamped crate copies, including the missing cleared maximum the schema-agreement test checks * fix(npm): keep exact platform pins instead of workspace protocols The fork's packaging check requires npm manifests to reference the platform packages by publishable exact versions: registry clients cannot resolve workspace: protocols, and monochange rewrites the pins on release through monochange.toml's versioned_files entries. The sync port had adopted upstream's workspace:* style, which the policy rejects.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KDBX files saved with keepass 0.13.17 can contain an incorrect
deletion_timeXML element, preventing strict KeePass clients from opening them. Require keepass 0.13.21 or newer and update the lockfile to 0.13.25, which includes the upstreamDeletionTimeserialization fix.Fixes #497.
Validation:
cargo test -p secretspec --lib --no-default-features --features cli,kdbx provider::kdbx::tests --locked --offline.cargo fmt --all -- --checkandgit diff --checkpass.