Upgraded dependencies (#761)

runtime/Cargo.toml

@@ -16,9 +16,9 @@ tauri-plugin-dialog = "2.7.1"
 tauri-plugin-opener = "2.5.4"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"
-keyring = { version = "3.6.2", features = ["apple-native", "windows-native", "sync-secret-service"] }
+keyring-core = "1.0.0"
 arboard = "3.6.1"
-tokio = { version = "1.50.0", features = ["rt", "rt-multi-thread", "macros", "process"] }
+tokio = { version = "1.52.3", features = ["rt", "rt-multi-thread", "macros", "process"] }
 tokio-stream = "0.1.18"
 futures = "0.3.32"
 async-stream = "0.3.6"
@@ -31,31 +31,32 @@ rustls = { version = "0.23.28", default-features = false, features = ["aws_lc_rs
 rand = "0.10.1"
 rand_chacha = "0.10.0"
 base64 = "0.22.1"
-aes = "0.8.4"
-cbc = "0.1.2"
-pbkdf2 = "0.12.2"
-hmac = "0.12.1"
-sha2 = "0.10.8"
-rcgen = { version = "0.14.7", features = ["pem"] }
+aes = "0.9.0"
+cbc = "0.2.0"
+pbkdf2 = "0.13.0"
+hmac = "0.13.0"
+sha2 = "0.11.0"
+rcgen = { version = "0.14.8", features = ["pem"] }
 file-format = "0.29.0"
-calamine = "0.34.0"
-pdfium-render = "0.8.37"
+calamine = "0.35.0"
+pdfium-render = "0.9.1"
 sys-locale = "0.3.2"
 cfg-if = "1.0.4"
 pptx-to-md = "0.4.0"
 tempfile = "3.27.0"
 strum_macros = "0.28.0"
-sysinfo = "0.38.4"
-
-# Fixes security vulnerability downstream, where the upstream is not fixed yet:
-bytes = "1.11.1" # -> almost every dependency
-
-[target.'cfg(target_os = "linux")'.dependencies]
-# See issue https://github.com/tauri-apps/tauri/issues/4470
-reqwest = { version = "0.13.2", features = ["native-tls-vendored"] }
+sysinfo = "0.39.1"
+bytes = "1.11.1"
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-registry = "0.6.1"
+windows-native-keyring-store = "1.0.0"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+dbus-secret-service-keyring-store = { version = "1.0.0", features = ["crypto-rust"] }
 
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-global-shortcut = "2"

runtime/src/encryption.rs

@@ -2,7 +2,7 @@ use std::fmt;
 use std::time::Instant;
 use base64::Engine;
 use base64::prelude::BASE64_STANDARD;
-use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};
+use aes::cipher::{block_padding::Pkcs7, BlockModeDecrypt, BlockModeEncrypt, KeyIvInit};
 use hmac::Hmac;
 use log::{error, info};
 use once_cell::sync::Lazy;
@@ -107,7 +107,7 @@ impl Encryption {
         let mut buffer = vec![0u8; data.len() + 16];
         buffer[..data.len()].copy_from_slice(data);
         let encrypted = cipher
-            .encrypt_padded_mut::<Pkcs7>(&mut buffer, data.len())
+            .encrypt_padded::<Pkcs7>(&mut buffer, data.len())
             .map_err(|e| format!("Error encrypting data: {e}"))?;
         let mut result = BASE64_STANDARD.encode(self.secret_key_salt);
         result.push_str(&BASE64_STANDARD.encode(encrypted));
@@ -130,7 +130,7 @@ impl Encryption {
         let cipher = Aes256CbcDec::new(&self.key.into(), &self.iv.into());
         let mut buffer = encrypted.to_vec();
         let decrypted = cipher
-            .decrypt_padded_mut::<Pkcs7>(&mut buffer)
+            .decrypt_padded::<Pkcs7>(&mut buffer)
             .map_err(|e| format!("Error decrypting data: {e}"))?;
 
         String::from_utf8(decrypted.to_vec()).map_err(|e| format!("Error converting decrypted data to string: {}", e))

runtime/src/main.rs

@@ -10,6 +10,7 @@ use mindwork_ai_studio::environment::is_dev;
 use mindwork_ai_studio::log::init_logging;
 use mindwork_ai_studio::metadata::MetaData;
 use mindwork_ai_studio::runtime_api::start_runtime_api;
+use mindwork_ai_studio::secret::init_secret_store;
 
 #[tokio::main]
 async fn main() {
@@ -41,6 +42,7 @@ async fn main() {
         info!("Running in production mode.");
     }
 
+    init_secret_store();
     generate_runtime_certificate();
     start_runtime_api();
     

runtime/src/secret.rs

@@ -1,11 +1,43 @@
-use keyring::Entry;
-use log::{error, info, warn};
 use axum::Json;
+use keyring_core::{Entry, Error as KeyringError};
+use log::{error, info, warn};
 use serde::{Deserialize, Serialize};
-use keyring::error::Error::NoEntry;
 use crate::api_token::APIToken;
 use crate::encryption::{EncryptedText, ENCRYPTION};
 
+/// Initializes the native credential store used by keyring-core.
+pub fn init_secret_store() {
+    cfg_if::cfg_if! {
+        if #[cfg(target_os = "macos")] {
+            match apple_native_keyring_store::keychain::Store::new() {
+                Ok(store) => {
+                    keyring_core::set_default_store(store);
+                    info!(Source = "Secret Store"; "Initialized the macOS Keychain credential store.");
+                },
+                Err(e) => error!(Source = "Secret Store"; "Failed to initialize the macOS Keychain credential store: {e}."),
+            }
+        } else if #[cfg(target_os = "windows")] {
+            match windows_native_keyring_store::Store::new() {
+                Ok(store) => {
+                    keyring_core::set_default_store(store);
+                    info!(Source = "Secret Store"; "Initialized the Windows Credential Manager store.");
+                },
+                Err(e) => error!(Source = "Secret Store"; "Failed to initialize the Windows Credential Manager store: {e}."),
+            }
+        } else if #[cfg(target_os = "linux")] {
+            match dbus_secret_service_keyring_store::Store::new() {
+                Ok(store) => {
+                    keyring_core::set_default_store(store);
+                    info!(Source = "Secret Store"; "Initialized the DBus Secret Service credential store.");
+                },
+                Err(e) => error!(Source = "Secret Store"; "Failed to initialize the DBus Secret Service credential store: {e}."),
+            }
+        } else {
+            warn!(Source = "Secret Store"; "No native credential store is configured for this platform.");
+        }
+    }
+}
+
 /// Stores a secret in the secret store using the operating system's keyring.
 pub async fn store_secret(_token: APIToken, request: Json<StoreSecret>) -> Json<StoreSecretResponse> {
     let user_name = request.user_name.as_str();
@@ -21,7 +53,16 @@ pub async fn store_secret(_token: APIToken, request: Json<StoreSecret>) -> Json<
     };
 
     let service = format!("mindwork-ai-studio::{}", request.destination);
-    let entry = Entry::new(service.as_str(), user_name).unwrap();
+    let entry = match Entry::new(service.as_str(), user_name) {
+        Ok(entry) => entry,
+        Err(e) => {
+            error!(Source = "Secret Store"; "Failed to create secret entry for {service} and user {user_name}: {e}.");
+            return Json(StoreSecretResponse {
+                success: false,
+                issue: e.to_string(),
+            });
+        },
+    };
     let result = entry.set_password(decrypted_text.as_str());
     match result {
         Ok(_) => {
@@ -61,7 +102,20 @@ pub struct StoreSecretResponse {
 pub async fn get_secret(_token: APIToken, request: Json<RequestSecret>) -> Json<RequestedSecret> {
     let user_name = request.user_name.as_str();
     let service = format!("mindwork-ai-studio::{}", request.destination);
-    let entry = Entry::new(service.as_str(), user_name).unwrap();
+    let entry = match Entry::new(service.as_str(), user_name) {
+        Ok(entry) => entry,
+        Err(e) => {
+            if !request.is_trying {
+                error!(Source = "Secret Store"; "Failed to create secret entry for '{service}' and user '{user_name}': {e}.");
+            }
+
+            return Json(RequestedSecret {
+                success: false,
+                secret: EncryptedText::new(String::from("")),
+                issue: format!("Failed to create secret entry for '{service}' and user '{user_name}': {e}"),
+            });
+        },
+    };
     let secret = entry.get_password();
     match secret {
         Ok(s) => {
@@ -121,7 +175,17 @@ pub struct RequestedSecret {
 pub async fn delete_secret(_token: APIToken, request: Json<RequestSecret>) -> Json<DeleteSecretResponse> {
     let user_name = request.user_name.as_str();
     let service = format!("mindwork-ai-studio::{}", request.destination);
-    let entry = Entry::new(service.as_str(), user_name).unwrap();
+    let entry = match Entry::new(service.as_str(), user_name) {
+        Ok(entry) => entry,
+        Err(e) => {
+            error!(Source = "Secret Store"; "Failed to create secret entry for {service} and user {user_name}: {e}.");
+            return Json(DeleteSecretResponse {
+                success: false,
+                was_entry_found: false,
+                issue: e.to_string(),
+            });
+        },
+    };
     let result = entry.delete_credential();
 
     match result {
@@ -134,7 +198,7 @@ pub async fn delete_secret(_token: APIToken, request: Json<RequestSecret>) -> Js
             })
         },
 
-        Err(NoEntry) => {
+        Err(KeyringError::NoEntry) => {
             warn!(Source = "Secret Store"; "No secret for {service} and user {user_name} was found.");
             Json(DeleteSecretResponse {
                 success: true,