From 908352c42a8177aca17f722a4f331b820bc8ce1f Mon Sep 17 00:00:00 2001 From: thestreamcode Date: Wed, 4 Nov 2026 05:14:52 +0100 Subject: [PATCH] fix(deps): clear the new RustSec advisories Update pulldown-cmark 0.13.5 -> 0.13.6 for RUSTSEC-2026-0433 (quadratic parsing with ENABLE_WIKILINKS). Except RUSTSEC-2026-0429 (zip extract() aborts on a symlink entry with a large declared size) with the same reachability check as the existing zip entries: no ZipArchive::extract() call exists in this tree or in the transitive office_oxide/pdf_oxide crates; PPTX reads entries by name in memory and the Windows updater copies entries manually with symlinks refused. Only a major 3->9 migration closes it. Verified: cargo deny check advisories licenses bans sources. --- Cargo.lock | 4 ++-- deny.toml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index b4b280ee..e83cad39 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -10843,9 +10843,9 @@ dependencies = [ [[package]] name = "pulldown-cmark" -version = "0.13.5" +version = "0.13.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb" +checksum = "3db2be46835f013dd3f4fa7f5f7402c537787b54ebb6fe2b94bbdd7e2669bb7b" dependencies = [ "bitflags 2.13.0", "getopts", diff --git a/deny.toml b/deny.toml index ca81c17a..61e08715 100644 --- a/deny.toml +++ b/deny.toml @@ -38,6 +38,7 @@ ignore = [ { id = "RUSTSEC-2026-0367", reason = "zip preserves SUID/SGID bits through ZipArchive::extract(). We never call extract(): pptx reads entries in memory by name, the Windows updater copies entries manually behind enclosed_name() with symlinks refused and created files never take archive modes, and the transitive office_oxide copy (zip 8.6) has zero .extract( call sites. Only a major 3→9 migration closes it." }, { id = "RUSTSEC-2026-0368", reason = "zip extract() follows attacker symlinks. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide, and our manual copy path refuses symlinks outright. Only a major 3→9 migration closes it." }, { id = "RUSTSEC-2026-0369", reason = "zip extract() applies Unix permissions through symlinks. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide. Only a major 3→9 migration closes it." }, + { id = "RUSTSEC-2026-0429", reason = "zip extract() sizes a symlink-target buffer from the archive's declared uncompressed size. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide; pptx reads entries by name in memory and the Windows updater copies entries manually behind enclosed_name() with symlinks refused. Only a major 3→9 migration closes it." }, { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is unmaintained (repository archived 2024-03-25), not vulnerable — there is no affected API to avoid. Transitive through serde_yaml 0.9 (mermaid-to-svg), already at its last release 0.2.11, so no bump closes it; the maintained replacement is serde_yaml's call to make." }, { id = "RUSTSEC-2026-0370", reason = "zvariant is unmaintained as a standalone crate (merged into zbus 6), not vulnerable. Transitive through zbus 5.14 (ashpd, dark-light theme detection); only a zbus 5→6 migration closes it." }, { id = "RUSTSEC-2026-0371", reason = "zbus_names is unmaintained as a standalone crate (merged into zbus 6), not vulnerable. Transitive through zbus 5.14 (ashpd, dark-light theme detection); only a zbus 5→6 migration closes it." },