chore(deps): update dependency @dallay/agentsync-darwin-arm64 to v1.43.0 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@dallay/agentsync-darwin-arm64	1.42.10 → 1.43.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

dallay/agentsync (@​dallay/agentsync-darwin-arm64)

v1.43.0

Compare Source

Features

• skills: add React/frontend parity with autoskills (6050d89)
• skills: add React/frontend parity with autoskills (211297f)
• skills: expand suggestion catalog coverage (bd2ea4d)
• skills: expand suggestion catalog coverage (48dcca9)
• suggest: add JS frontend autoskills parity (ebc8deb)
• suggest: add JS frontend autoskills parity (0c5a2e2)
• suggest: add Python dependency detection (69431c5)
• suggest: add Python dependency detection (444428e)

Bug Fixes

• apply CodeRabbit auto-fixes (84318f9)
• e2e: update install-all Python expectations (578c47f)
• harden tar archive path validation (bf1d505)
• remove catalog dependency from root to fix CI release workflow (d7c1836)
• resolve merge conflicts with origin/main (Python suggest parity) (10a9de4)
• security: harden archive extraction against cross-platform path traversal (226bfa3)
• security: harden archive extraction against path traversal (9008c31)
• suggest: address Python detection review feedback (346dc09)
• suggest: use local skill sources in E2E (1e2dc03)
• update rustls-webpki to patched version (15721c3)

Performance

• optimize technology detection via single-pass metadata collection (0cd4158)
• optimize technology detection via single-pass metadata collection (c101dcc)

Documentation

• update CLI reference for accuracy and supported technologies (1de4592)

Tests

• fix tar path generation for Windows test runners (e1e31bd)

Chores

• deps: bump all rate-limited and major dependencies (ccd3d9a)
• deps: lock file maintenance (f89605c)
• deps: lock file maintenance (5cef41c)
• deps: update actions/create-github-app-token digest to 1b10c78 (4fa1018)
• deps: update all rate-limited and major dependency upgrades (c20480d)
• deps: update cargo dependencies (4d61ca3)
• deps: update dependency astro to v6.1.6 [security] (e014410)
• deps: update dependency astro to v6.1.6 [security] (02cdda5)
• deps: update github actions (674b6d0)
• deps: update github actions (63be8c5)
• deps: update node.js to v24.15.0 (8975f8c)
• update opencode plugin dependencies (ccaaee5)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yacosta738]

Lockfile-only platform package update looks safe. CI is green except for the inherited rustls-webpki Security Audit failure from base, which is addressed by #376.

[semgrep-code-dallay]

Semgrep found 3 tainted-path findings:

• src/skills/detect.rs
  • L516 - Triage
  • L592 - Triage
  • L637 - Triage

The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>src/skills/detect.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/dallay/agentsync/blob/d7716003de6f83832becfa84a750741a6c4f507d/src/skills/detect.rs#L586 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 586] path</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/dallay/agentsync/blob/d7716003de6f83832becfa84a750741a6c4f507d/src/skills/detect.rs#L636 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 636] canonical_existing_path</a>"]

            v3["<a href=https://github.com/dallay/agentsync/blob/d7716003de6f83832becfa84a750741a6c4f507d/src/skills/detect.rs#L636 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 636] path</a>"]
        end
            v2 --> v3
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/dallay/agentsync/blob/d7716003de6f83832becfa84a750741a6c4f507d/src/skills/detect.rs#L637 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 637] path</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud