build(deps): Bump rpassword from 7.3.1 to 7.5.4 - #21
Open
dependabot[bot] wants to merge 20 commits into
Open
Conversation
…tact Replace github.com/vault with leocelis/vault across badges, GHSA, and cosign docs; add security email fallback; track public-flip checklist in AUDIT_READINESS. Co-authored-by: Cursor <cursoragent@cursor.com>
Delete all workflows and Dependabot (no paid CI). Releases are maintainer-local per docs/RELEASE.md. OSS scrub: README badges, samples path, UC-19 .sdlc ref, CLI drift. Co-authored-by: Cursor <cursoragent@cursor.com>
SUPPORT.md, README docs/community sections, INSTALL accuracy, public-readiness checklist complete. Bump to 0.1.0-alpha.2; quality gate local-only. Co-authored-by: Cursor <cursoragent@cursor.com>
Implement vault stanzas list/add/remove guidance, headless C27 exit 7, fix constraint index labels, add minimal CI, docs hub, README release-first install. Bump v0.1.0-alpha.3. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Soften stanzas claim, clarify prebuilt platform scope, align CI status with GHA workflow, add docs hub link, and refresh VERIFYING_RELEASES. Co-authored-by: Cursor <cursoragent@cursor.com>
Align RELEASE/SECURITY/AUDIT_READINESS with minimal GHA CI and alpha.3; expand docs/README hub; add vault-clip to ARCHITECTURE; fix THREAT_MODEL footnote; bump UC spec headers from Draft to Accepted v0.2. Co-authored-by: Cursor <cursoragent@cursor.com>
Mark repo public in AUDIT_READINESS/ROADMAP, restore README CI badge, add rust-cache to GHA workflow, remove pre-flip checklist language. Co-authored-by: Cursor <cursoragent@cursor.com>
cargo fmt on stanzas/cli tests; document Stanza::on_disk_len for clippy. Co-authored-by: Cursor <cursoragent@cursor.com>
Land P0–P3 audit items: format freeze (ADR-0005), KDF floor policy, sync provisioning guide, YubiKey strict default, agent broker scaffold (ADR-0006), cargo-vet in audit-ready, ptrace hardening, rotate-data-key crypto-shred, recovery codes, live FIDO2/TPM via subprocess tools, streaming payload parse, GUI in-app TOTP, Padmé research, and doc/threat-model updates. Gate 0 crypto fixes accepted in ADR-0003/0004 without maintainer sign-off ceremony. Third-party audit explicitly declined; automated gates only. Co-authored-by: Cursor <cursoragent@cursor.com>
Fix cargo fmt --check failures on CI (agent, hardware, sys modules). Co-authored-by: Cursor <cursoragent@cursor.com>
Document FIDO2/TPM envelope fields, derive SaveOptions Default, fix needless return/borrow in vault-agent and vault-cli. Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve Option? misuse in vault-agent store on non-macOS Unix. Add --allow-weak-kdf to init-only paths; omit it from upgrade-kdf invocations. Co-authored-by: Cursor <cursoragent@cursor.com>
upgrade-kdf hard-rejects below-floor Argon2id; bump to m=19456 t=2 p=1. Co-authored-by: Cursor <cursoragent@cursor.com>
Pattern YAML lives outside the vault repo; regression tests anchor on in-repo research docs only so GitHub Actions stays self-contained. Co-authored-by: Cursor <cursoragent@cursor.com>
GitHub Actions may expose a readable but non-writable coredump_filter; match C25 best-effort semantics and skip when write fails. Co-authored-by: Cursor <cursoragent@cursor.com>
…repo hygiene - MAINTAINERS.md: flat handle list, authority delegated to CODEOWNERS - GOVERNANCE.md decision tiers: code-owner sign-off (path-scoped), no person-rank labels - cowork.yaml / CLAUDE.md / CODEOWNERS comment: lane split without hierarchy wording - Remove internal work-tracking references from public research notes, ADR metadata, scripts, supply-chain config, and test/doc comments - Update audit_commission doc test to match renamed section Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ted clouds (C61-C66) One sealed blob for any file/folder, droppable on Dropbox/Drive/S3/git: - vault-core: file-archive TLV payload behind the existing STREAM envelope (VLTF magic, fresh data key per seal, no new crypto paths — C61); zero plaintext metadata (C62); bounded-memory streaming seal/open with one KDF run per op (C63); fail-closed staged extraction (C64); zip-slip-safe paths (C65); Padmé padding default-on (C66); new fuzz target file_archive_parse - vault-cli: seal/open/peek + pipe modes, --append, stanza management, upgrade-kdf and rotate-data-key on .vltf, keyfile/YubiKey/FIDO2/TPM unlock - vault-gui: drag-and-drop seal/open, worker-thread progress + cancel, keyfile/YubiKey 2FA at seal time, virtualized peek - vault-tui: seal/open/peek parity with progress gauge - intent v1.8.0: G16 forward constraints C61-C66 + conflict SC9; spec UC-23 Accepted v1.0; PRD, ROADMAP S-22, CONSTRAINT_INDEX, THREAT_MODEL, CLI docs updated; synthetic samples/project_docs for a safe try-it path - research: encrypted_cloud_storage_research.md — the survey grounding the design (tools, academic literature, community practice) Tests: 48 workspace suites green incl. sealed_constraints, joint satisfaction on one artifact, CLI round-trip/auth/append matrices, GUI/TUI wiring; clippy -D warnings clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Renames the project end-to-end (crates, binary, env vars, default data directories, CLI docs, runtime hint strings) and repositions the README around the agent-broker use case instead of the password-manager frame. Why: crates.io names `vault`/`vault-cli`/`vault-core` are already taken by unrelated projects, so `cargo install vault-cli` (promised throughout the old docs) could never work. Infisical's "Agent Vault" (github.com/Infisical/ agent-vault) validated the AI-agent-credential-broker category with 1.9K stars in ~4 months on a research preview, while GitGuardian found ~24,000 secrets in public MCP config files in 2026 — the local-first, no-account, handle-based lane (blindkey-agent) is the differentiated angle this project already had the tech for (C27, ADR-0006) but had buried under a password- manager pitch competing with 10-year-old incumbents. Full research/decision record: limitless/docs/research/ventures/vault/ VAULT_AGENT_SECURITY_PIVOT_DECISION_2026-07.md (private). What changed: - 8 crates renamed vault-* → blindkey-* (dirs, Cargo.toml package/bin names, path deps, all `use` imports); workspace builds and all 404+ tests pass. - Binary `vault` → `blindkey`; env vars VAULT_* → BLINDKEY_*; default data dir `~/.vault` → `~/.blindkey`; `vault_intent.yaml` → `blindkey_intent.yaml`. - Every user-facing runtime hint string in the CLI/TUI/agent broker updated (e.g. "run `vault init` first" → "run `blindkey init` first") — these are real error/help text a user would otherwise follow into a command that no longer exists. - README rewritten: new positioning headline, agent-broker comparison table, MCP/GitGuardian context in "Why Blindkey exists". - Full docs/specs/ADR/guides/research sweep for brand references, while deliberately leaving internal Rust identifiers (the `Vault` struct type, `vault_id`/`vault_version` field names) untouched — those are generic domain vocabulary, not brand references, and renaming them was out of scope and unnecessary risk in a crypto-adjacent codebase. - Root `LICENSE` pointer file's prose replaced with verbatim MIT text: it could not simply be deleted (an earlier hygiene-pass attempt to delete it for GitHub license-detection reasons violated constraint C24, which the test suite caught) — this keeps the file present per C24 while giving GitHub's detector real, recognizable license text instead of custom prose. - Also includes the previously-uncommitted OSS-readiness audit fixes: CI matrix expanded to macOS + experimental Windows, new `audit` and `reproducible` CI jobs, Dependabot config, 3 broken doc links fixed, stale constraint-count fix, quickstart fixed for binary-only installs. Verification: cargo build --workspace, cargo test --workspace --all-features --no-fail-fast (0 failures), cargo clippy --all-targets --all-features -D warnings (0 warnings), cargo fmt --all -- --check (clean). Not included — needs Leo directly: git history rewrite (old commits still reference internal card/limitless paths), crates.io publish (needs `cargo login` token), Apple Developer notarization for macOS binaries, signed v1.0.0 release tag, branch protection on main. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bumps [rpassword](https://github.com/conradkleinespel/rpassword) from 7.3.1 to 7.5.4. - [Release notes](https://github.com/conradkleinespel/rpassword/releases) - [Commits](conradkleinespel/rpassword@v7.3.1...v7.5.4) --- updated-dependencies: - dependency-name: rpassword dependency-version: 7.5.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps rpassword from 7.3.1 to 7.5.4.
Release notes
Sourced from rpassword's releases.
... (truncated)
Commits
1151510add license checks3ca2ecebump to 7.5.3ed863bfremove cargo-tarpaulin build incompatible with rust 1.85 from ci479012dfixes compile errors with rust 1.856ee4708update nix config to use rust 1.856d3518drun ci with rust 1.85e176edcbump to 7.5.26c19a1emake reading utf8 chars more reliable1ecf07dbump to 7.5.160ee071remove errno clean up, not cross-platformYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)