89c5849539
- modules_mgmt.rs: reject module names containing path separators, `..`,
or absolute paths before joining onto modules_dir (install_from_local,
remove_module, read_module_manifest); adds canonicalized containment
check as defense in depth. Manifest-supplied names and CLI args were
previously joined unsanitized, allowing path traversal on install/remove.
- breadd/src/lua/mod.rs: bread.exec now runs via `sh -c` instead of
`sh -lc`; no documented reason was found for login-shell semantics.
- Unify the two independently hand-written glob matchers (subscription
dispatch in breadd/src/core/subscriptions.rs vs. the CLI --filter path
in breadd/src/ipc/mod.rs) into one implementation in
bread-shared/src/glob.rs, used by both call sites.
- Remove the dead bread-sync/ tree (already excluded from the workspace
and fully unreferenced) and its stale PKGBUILD deps (libgit2, git
optdepend) and packaging docs mention.
- Correct the version-number transposition bug ("6.2.0" instead of
"0.6.2"/"0.6.6") across bread-shared, breadd, and bread-cli Cargo.toml,
and fix PKGBUILD's stale pkgver, so Cargo.toml/doctor/PKGBUILD all agree
with the latest git tag (v0.6.6).
26 lines
650 B
TOML
26 lines
650 B
TOML
[package]
|
|
name = "breadd"
|
|
version = "0.6.6"
|
|
edition = "2021"
|
|
|
|
[dependencies]
|
|
bread-shared = { path = "../bread-shared" }
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio.workspace = true
|
|
anyhow.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
mlua = { version = "0.9", features = ["lua54", "vendored", "async", "serialize"] }
|
|
async-trait = "0.1"
|
|
toml = "0.8"
|
|
udev = { version = "0.9", features = ["send"] }
|
|
rtnetlink = "0.9"
|
|
zbus = { version = "3.13", features = ["tokio"] }
|
|
futures-util = "0.3"
|
|
netlink-packet-route = "0.11"
|
|
netlink-packet-core = "0.4"
|
|
libc = "0.2"
|
|
|
|
[dev-dependencies]
|
|
tempfile.workspace = true
|