[kix007]

Summary

Clears most of the open Dependabot / RustSec advisories across the app, the Rust backend and the docs site. It also brings the website
docs and roadmap in line with what the app actually does.

The dependency changes are lockfile-level apart from three upgrades:

• zip 2 → 9 (QueryDen's own dependency)
• vitest 3 → 4 (dev only)
• monaco-editor 0.55 → 0.57, which needed a rework of the slim Monaco entry; a new guard test keeps it complete.

Flagged areas: none of storage.rs, updater.rs, capabilities/ or the AI code path are touched. tauri-plugin-updater stays at
the same version.

Related issue

Partly addresses #185: devalue is fixed. The glib and rand warnings come in through Tauri/GTK and can't be bumped from here.

Related: #186 (Node runtime). The docs site's remaining Astro alert needs Node ≥ 22.23.4.

Changes

Rust (src-tauri/Cargo.lock, Cargo.toml)

• rustls 0.23.40 → 0.23.46 and rustls-webpki 0.103.13 → 0.103.16: TLS 1.3 handshake, downgrade, decompression and distrusted-intermediate
  fixes.
• webpki-roots and webpki-root-certs 1.0.7 → 1.0.11: distrusted emSign roots.
• quinn-proto 0.11.14 → 0.11.19, crossbeam-epoch 0.9.18 → 0.9.21, tokio 1.52.1 → 1.54.1, anyhow, event-listener, spin (yanked).
• plist 1.9 → 1.10.3, which brings quick-xml 0.39 → 0.42 (quadratic parsing and allocation fixes; build-time only).
• zip 2 → 9 for the app's own use (mongosh archive extraction, .xlsx export). extract() no longer follows symlinks out of the
  target directory or keeps SUID/SGID bits. Only the deflate feature is enabled, which drops the bzip2/lzma C libraries zip pulled in by
  default.
• cli.rs: removed the CommandExt import that newer tokio makes unused. Windows clippy -D warnings failed on it.

Frontend (package.json, package-lock.json)

• In-range fixes: vite, postcss, nanoid, brace-expansion, browserslist, source-map-js, @babel/core, baseline-browser-mapping.
• vitest 3 → 4: fixes the Tinypool prototype-pollution RCE (critical). Dev/test only. No config changes needed.
• monaco-editor 0.55 → 0.57: patches the bundled DOMPurify.
  • 0.57 removed edcore.main.js, and its export map now resolves monaco-editor/<path> to esm/vs/<path>.
  • The suggest widget and document semantic tokens are no longer in the shared feature list, so a naive swap silently disables
    autocompletion.
  • monacoSetup.ts now mirrors editor/editor.main.js minus the language packs, plus the built-in SQL language.
  • New monacoSetup.test.ts fails if a future Monaco release adds an editor contribution the slim entry doesn't import. I checked that
    it fails when suggestController is removed.
  • The bundle still ships only the base editor worker, with no language packs.

Docs site (website/package-lock.json)

• In-range fixes: devalue, js-yaml, smol-toml, svgo, zod, http-cache-semantics, nanoid, postcss, source-map-js, vite.

Docs and roadmap (website/src)

• Roadmap: every item on it was already closed (release: build universal-apple-darwin to cover Intel macOS #7, bug: in-app updater does not work on macOS (pick_asset misses .dmg, install_update has no darwin branch) #8, ~14 shortcuts advertised in DataGrip keymap preset are not wired #11, psql console: auto-LIMIT appended after trailing semicolon produces syntax error #38, PostgreSQL CLI auto-download is broken end-to-end #40, BIGINT and BIGINT[] values beyond JS safe-integer range lose precision in the results grid #41, Connection Dialog Layout - All settings in the connection must be shown clearly #44, SSH Tunneling connection not working #46). They move to a "Recently shipped" list, and
  Now/Next/Later are rebuilt from open issues (AIAssistantDialog.tsx is a setTimeout stub — no LLM is actually called #10, Expose a CLI tools management UI (Settings → CLI Tools) #39, Resolve 3 open Dependabot alerts (devalue high, glib medium, rand low) #185, Refresh database list #237, Establish design system and apply it consistently across the app #149, Testing infrastructure roadmap #24, CI: GitHub Actions still on Node.js 20 runtime (forced to Node 24 on 2026-06-02) #186, Feature: allow downgrading to a previous version #91, refactor: split ConnectionContext into focused hooks #1–refactor: extract EXPLAIN parsers and AI client from VisualOptimizer #6, Adopt ESLint for frontend static analysis #33) plus the vault, SSH and signing
  follow-ups.
• New pages: Completion and navigation, psql console, Exporting results, Saved queries and Multi Query.
• Corrected claims that didn't match the code:
  • vault: no master-password/unlock step and no exponential lockout; the master key isn't in the OS keychain; there's no magic-header
    file format;
  • psql isn't auto-downloaded or version-matched;
  • wrong shortcuts (Ctrl+T, Ctrl+Alt+H, Ctrl+Y, Ctrl+W), and keymap edits aren't applied to the editor yet;
  • no SSL selector exists;
  • a dead /docs/editor/explain link.
• Security pages no longer link to the encryption source file.
• Home, security and download pages: only the false lines changed (lockout row, "per-version psql" tile, master-password/keychain
  pillars, Linux glibc 2.35, macOS universal).
• site.ts recognises _universal.dmg assets, so the download page keeps its macOS button once the universal build ships.
• CHANGELOG.md: new Security section under Unreleased.

Not fixable in this PR

• zip 4.6.1 inside tauri-plugin-updater: even 2.14 requires zip ^4, and there's no patched 4.x. Update archives are
  minisign-verified before extraction.
• rsa (RUSTSEC-2023-0071) in sqlx's MySQL driver: no fixed release. QueryDen only encrypts with the server's public key.
• rkyv 0.7: present in Cargo.lock as an optional dependency of rust_decimal, not compiled in.
• Docs site astro (critical, AVIF image optimization at build time), sharp and esbuild need Astro 7, which requires Node ≥
  22.23.4 on the build host (Vercel). Astro 6 already requires ≥ 22.12.

Testing notes

• npx tsc --noEmit: clean.
• npm test: 27 files, 395 tests pass on Vitest 4, including the new Monaco guard test.
• npx vite build: OK. Only editor.worker is bundled, no language packs.
• cargo clippy --all-targets -- -D warnings: clean on Linux and on x86_64-pc-windows-msvc (cargo-xwin).
• Website npm run build on Node 22.23.4: 31 pages built, Pagefind indexed 19 docs pages, all internal doc links resolve.
• Needs a manual check (Monaco 0.57): open a query tab and confirm autocomplete (Ctrl+Space, schema.), parameter hints, find
  (Ctrl+F), Ctrl+Enter and table/alias colouring. Also confirm the Definition and Compare dialogs highlight SQL.
• Merge order: some docs pages describe features from the fix/cli-tools-editor-intelligence PR (per-tab sessions, completion, psql
  console, exports). The site deploys on release, so merge both before the next release. Expect small conflicts in install.mdx and
  byo-key.mdx when the second one merges.

Checklist

• I built the app locally (npm run tauri dev or npm run tauri build) and verified the change works.
• Frontend typecheck passes (npx tsc --noEmit).
• Rust build passes (cargo check --manifest-path src-tauri/Cargo.toml). Also clippy -D warnings on Linux and the Windows MSVC
  target.
• If I added a new #[tauri::command], I registered it in src-tauri/src/lib.rs's generate_handler!. (No new commands.)
• If user-visible: I added a line to CHANGELOG.md under ## [Unreleased].
• If this touches storage.rs, updater.rs, capabilities/, or the AI assistant code path, I flagged it in the summary above.
  (None touched.)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
queryden	Ready	Preview	Oct 26, 2026 7:28am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1a2f8eff-6543-4665-88e2-984a959974f8

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}