Repository navigation
Move to zip 9 and calamine 0.37, and allow the retired zbus crates - #48
Merged
Merged
Conversation
Three zip advisories and three unmaintained notices for crates folded into zbus 6 failed cargo-deny. zip 9 brings calamine 0.37 and quick-xml 0.42 with it; entry names now come as a Result and XML names as str. zip also checks a part's declared size itself now, so the viewer reads the claimed bytes first and treats anything past them as the bomb it is.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cargo-deny started failing on main on six advisories published after the last green run (see #47's CI).
zip (RUSTSEC-2026-0367, -0368, -0369): three extraction bugs around SUID bits and symlinks. The app only reads and writes archives in memory, so none is reachable here, but the fix is zip 9. calamine 0.37 moved to it too, and brings quick-xml 0.42, so all three move together and stay single in the tree. zip 9 adds
nixon Unix.Two API changes followed: zip hands out entry names as a
Result<Cow<str>>(the archive viewer falls back to the raw bytes, lossily; a workbook part that doesn't decode is simply not one looked for), and quick-xml names and attribute values arestrnow. zip also enforces a part's declared uncompressed size itself, erroring as soon as a read runs past it; the viewer's own bomb check now reads exactly the claimed bytes and treats one byte more, or zip's refusal to give it, as the bomb. One test caught that.zbus (RUSTSEC-2026-0370, -0371, -0372): zvariant, zbus_names and zvariant_derive were folded into zbus 6 and retired. Nothing here names them; they come with zbus 5 through accesskit, ashpd, ksni, notify-rust and the fastframe crates, none of which is on zbus 6 yet. Ignored in deny.toml with that reason, to drop once they move.
Checked locally with the pinned 1.98 toolchain: fmt, clippy with
-D warnings, the whole test suite, rustdoc andcargo deny check.+91 / −43 lines, of which 54 in Cargo.lock.
🤖 Generated with Claude Code