dependency-security-remediation

[KooshaPari]

Summary

Separate dependency/security remediation lane; this does not change the baseline-gates scope in #335.

• Upgrade golang.org/x/text 0.37.0 -> 0.39.0 to remediate GO-2026-5970 (norm.Iter invalid UTF-8 infinite loop; fixed before v0.39.0).
• Upgrade tauri-plugin-log 2.8.0 -> 2.9.0. The 2.9.0 dependency graph removes byte-unit -> rust_decimal -> rkyv 0.7.46, eliminating RUSTSEC-2026-0235 without an advisory suppression.
• Update plist 1.9.0 -> 1.10.0 and quick-xml 0.39.4 -> 0.41.0 to remediate RUSTSEC-2026-0194 and RUSTSEC-2026-0195.
• Update event-listener 5.4.1 -> 5.4.2 to remediate RUSTSEC-2026-0221.
• Add truthful MIT license metadata to the previously unlicensed local byteport-dag crate. pheno-dag already declared Apache-2.0; its unchanged declaration is retained. The new metadata follows the repository's root MIT license (the workspace has pre-existing mixed crate declarations).
• Add explicit 0.1.0 versions to the local path dependencies so cargo-deny wildcard checks can evaluate them.

Evidence and validation

• cargo metadata --locked --no-deps --format-version 1 passes.
• git diff --check passes.
• Locked graph confirms quick-xml=0.41.0, event-listener=5.4.2, plist=1.10.0, tauri-plugin-log=2.9.0; rkyv, rust_decimal, and byte-unit are absent.
• GO-2026-5970 authoritative report: https://pkg.go.dev/vuln/GO-2026-5970 (affected x/text before v0.39.0).
• Local Go is 1.24.3 while this repository requires Go 1.25.0; hosted Go 1.25 CI is required for final Go validation.
• No cargo broad build was run because other active cargo holders are using the shared host; no processes or sessions were stopped.

Review boundary

This PR is draft and additive. It does not suppress advisories or change application behavior. The Cargo.lock file is valid text; repository .gitattributes intentionally marks lockfiles with -diff, so Git displays its change as binary.

Follow-up validation (bcaa846)

• go mod tidy -diff is clean after upgrading the transitive golang.org/x/sync requirement to v0.21.0 for golang.org/x/text v0.39.0.
• go build -mod=readonly ./... passes from backend.
• Exact head: bcaa846946c9a4014598e09be204cd21cf597f59.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tauri-plugin-log@​2.8.0 ⏵ 2.9.0	+1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud