Repository navigation
chore(audit): ignore zip <9 extract() advisories RUSTSEC-2026-0367/0368/0369 (unreachable, no consumer fix) - #979
Merged
Conversation
…68/0369 (unreachable, no consumer fix) The merge queue now fails cargo audit on main: three RustSec advisories against zip 4.6.1 and 8.6.0, fixed only in zip >=9.0.0. All three are in ZipArchive::extract / ZipStreamReader::extract. Reachability, checked 2026-10-17: - 4DA never calls extract(): fastembed.rs, extractors/archive.rs and extractors/office.rs copy chosen entries to paths they name. - calamine 0.36.1 and docx-rs 0.4.22 (latest; zip ^8.6) only read entries. - tauri-plugin-updater 2.13.1 (zip ^4; the latest 2.14.0 too) calls extract() on Windows only, after verify_signature against our updater pubkey, so the archive is one we signed. No consumer ships a zip 9 build yet. Bumping the direct dependency alone would add a third zip copy and change no reachable code. Ignored in both .cargo/audit.toml and deny.toml with a REVISIT note to drop them when the consumers move to zip >=9. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018hjX3pEMmC7CHfG41PiPj7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The merge queue fails
cargo auditon main (runs 38981479618, 38982403693). Three RustSec advisories hit zip 4.6.1 and 8.6.0, and all are fixed only in zip >=9.0.0:All three are in
ZipArchive::extract/ZipStreamReader::extract. Yesterday's transient yanks of these zip versions came from the same disclosure. I closed #971 too early, calling the yank "transient"; the advisories behind it are real.Reachability (checked 2026-10-17)
extract()?fastembed.rs,extractors/archive.rs,extractors/office.rs)updater.rs:1075, afterverify_signatureagainst our updater pubkey (updater.rs:837). The archive is one we signed.No consumer ships a zip 9 build. Bumping only the direct dependency would add a third zip copy without changing any reachable code.
What
src-tauri/.cargo/audit.tomlandsrc-tauri/deny.tomleach ignore the three ids. The reasons and a REVISIT note sit inline: drop the ignores when calamine, docx-rs and tauri-plugin-updater move to zip >=9.cargo auditexits 0 andcargo deny check advisoriesexits 0. Without it,cargo auditexits 1.Unblocks #967 and #972, which were ejected from the queue on this.
🤖 Generated with Claude Code
https://claude.ai/code/session_018hjX3pEMmC7CHfG41PiPj7