[Nic-dorman]

Linear issue

Closes V2-1632

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Proposed, not asserted. zip sits under two client-side paths: ant update self-update and ant node add binary install. Both read Windows release archives through extract_zip. That function's source is unchanged here; only the library under it moves, from 2.x to 9.x. Both paths were exercised against the real releases (see Test evidence). No node, protocol or payment code changes.

Compatibility

• Wire: none.
• Storage: none.
• API: none. ant-core's public API exposes no zip types: extract_zip takes bytes and returns ExtractionResult, and zip errors are carried as strings. One behaviour narrows. ant-core's zip now reads Deflate and Stored entries only, so an archive using bzip2, LZMA, Zstandard, Deflate64, PPMd or AES would fail to open. Every current release archive is Deflate: ant-0.3.11-x86_64-pc-windows-msvc.zip and ant-node v0.23.0's ant-node-cli-windows-x64.zip were checked entry by entry, and ant-cli-release.yml builds archives with 7z a, whose .zip default is Deflate.

Semver impact

• breaking
• feature
• fix

zip's major version changes, but no zip type appears in ant-core's public API.

Test evidence

Rebased 2026-10-23 onto main at 50bc653 (0.3.12 promoted). main now has ant-node 0.23.1, which already uses zip 9 (V2-1633). So with ant-core moved too, zip 2.4.2 leaves Cargo.lock entirely, and the three ci.yml ignores this PR first added are dropped. The only conflict was Cargo.lock: it was re-resolved from main's, and the diff is exactly the removal of zip 2.4.2 and its codec tree. Re-run on Linux (dev2, stable):

• cargo audit with main's ignore list: RUSTSEC-2026-0367, -0368 and -0369 are gone. It still exits non-zero on RUSTSEC-2026-0382 and -0383 (rustls-webpki 0.103.15, webpki-root-certs 1.0.7), which chore(deps): move rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10 for two RustSec advisories #236 fixes. The audit goes green once both have merged.
• cargo fmt --all -- --check and cargo clippy --all-targets --all-features -- -D warnings: pass.
• cargo test -p ant-core --lib node::binary: 20 passed, including the four extract_zip tests.

Original evidence, run on Windows 11 with Rust 1.97.1, one commit on top of main at e47ea7a:

• cargo audit with this PR's original ignore list: exit 0, with only the 8 warnings main had then.
• cargo fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings and cargo doc --all-features --no-deps: all pass.
• cargo test --lib --all: 838 passed. That's 834 before plus the four new extract_zip tests:
  • binary found under a folder as <name>.exe;
  • bootstrap_peers.toml extracted;
  • missing binary errors;
  • a ../ entry skipped.
• unit_self_encrypt 16 passed (2 ignored); merkle_unit 8 passed; daemon_integration 6 passed and node_add_integration 3 passed (--test-threads=1).
• Browser WASM: cargo check and cargo clippy -D warnings for -p ant-core --target wasm32-unknown-unknown --no-default-features --features browser-wasm both pass. zip is behind native.
• cargo build --release -p ant-cli passes.
• Third-party notices, generated with the CI job's arguments, pass: 469 crates. zip 9.0.5 is MIT and typed-path 0.12.3 is MIT OR Apache-2.0. [native.bzip2-sys], [native.lzma-sys] and [native.zstd-sys] are now reported unused, because those C libraries reached the ant build only through zip's default codecs.
• flate2 features in the ant build are unchanged from main (default, rust_backend, miniz_oxide, any_impl). zip 9's own deflate feature would have switched every flate2 user to the zlib-rs backend, so this PR uses deflate-flate2 instead.
• Production compatibility smoke, using the release ant.exe built from this branch with APPDATA pointed at an empty scratch directory, so no real registry or install was touched:
  • Node install: ant node add --version 0.23.0 downloaded ant-node-cli-windows-x64.zip from the v0.23.0 release and extracted ant-node.exe and bootstrap_peers.toml. Both are byte-identical to the archive entries (SHA-256 31b6d670… and 9953eda7…), and the extracted binary reported version 0.23.0.
  • Self-update: ant update --force ran from a throwaway copy of the built binary. It downloaded ant-0.3.11-x86_64-pc-windows-msvc.zip, verified its ML-DSA signature, extracted it and replaced itself. The result is byte-identical to the released ant.exe (SHA-256 a7e53b87…).
• The E2E and merkle E2E suites, which need Anvil, and the Linux and macOS unit runs are left to this PR's CI.

New dependency

None new to the shipped binary beyond the version move. zip goes from 2.4.2 to 9.0.5 for ant-core, with default features off and deflate-flate2 on. zip 9.0.5 and typed-path are already in Cargo.lock through ant-node 0.23.1. Cargo.lock loses zip 2.4.2 and its codec dependencies: bzip2/bzip2-sys, xz2/lzma-sys, lzma-rs, zstd/zstd-safe/zstd-sys, zopfli, deflate64, arbitrary and an older constant_time_eq.

ADR

n/a, Tier 1.

Mitigation / rollback

Revert the commit. That restores zip 2 and the three advisories, with nothing to migrate.

---

What this is

Three advisories published 2026-10-09/10 cover zip 2.4.2. All are fixed only in zip >= 9.0.0, and the 2.x line ends unpatched:

• RUSTSEC-2026-0369 (critical): extract() applies Unix permissions through symlinks.
• RUSTSEC-2026-0367 (high): extract() preserves SUID/SGID bits.
• RUSTSEC-2026-0368: extract() creates symlinks that escape the destination.

Not reachable. ant-core's only zip use is node::binary::extract_zip, which opens the archive with ZipArchive::new, walks it with by_index, filters with enclosed_name(), copies the one matching file with std::io::copy and sets 0o755 itself. It never calls extract() or ZipStreamReader. Those three APIs are unchanged in zip 9, so the source needs no change.

Why bump anyway. The Security Audit job fails on every ant-client pull request right now on these three IDs alone, and downstream lockfiles inherit zip 2 from ant-core. ant-sdk's antd is carrying a reasoned ignore (ant-sdk#372) until it can repin to an ant-client release with this change (V2-1634).

No audit ignores needed now. When this PR was opened, zip 2.4.2 also came in through ant-node 0.23.0, so it added three ci.yml ignores pending V2-1633. ant-node 0.23.1, now on main, uses zip 9, so after the rebase nothing in the lockfile pulls zip 2 and the ignores are gone. antd's lockfile has no ant-node, so the bump alone clears antd once released.

Deflate only. zip 9's default features add aes 0.9, sha2 0.11, bzip2 0.6 with libbz2-rs-sys, lzma-rust2, ppmd-rust, zstd 0.14, zopfli and zlib-rs. libbz2-rs-sys is licensed bzip2-1.0.6, which the notices policy doesn't allow, so the notices job would fail. None of those codecs is used by a release archive, so ant-core turns them off. In the ant build this also removes the bundled C of bzip2-sys, lzma-sys and zstd-sys.

zip 9's MSRV is 1.88; the workspace declares no rust-version and CI uses stable.

🤖 Generated with Claude Code

[dirvine]

Review: APPROVE — no evidenced new blocking defect

Reviewed WithAutonomi/ant-client #233 at a24f496880e048cd02b3b1cbbc234d9c5d3c4010 against e47ea7a7803e8c1947b0b254f1d38e5cdd950198. All four changed files are covered. No unresolved material dissent.

Panel: 6/6 substantive reviews, 3/3 named models. GLM 5.3 (z-ai/glm-5.3, OpenRouter), local Qwen 3.8 (qwen38-27b) and local DS4 Flash (deepseek-v4-flash) each completed an independent correctness pass and an adversarial security/platform pass. All six recommend approval. This is three models in two roles, not six-model diversity.

Checked

• ant-core/Cargo.toml:55–57: zip 9.0.5 resolves with default-features = false and deflate-flate2. The direct flate2 dependency supplies the backend. The locked default CLI graph uses zip 9 only; browser-wasm has no zip dependency.
• extract_zip: production extraction is unchanged and compiles against zip 9. Its manual by_index/enclosed_name/copy path does not invoke the extract()/stream-extract APIs implicated by RUSTSEC-2026-0367, -0368 and -0369. New tests exercise subdirectory binaries, bootstrap peers, missing binaries and traversal rejection.
• The lock delta adds zip 9.0.5 and typed-path 0.12.3. It retains zip 2.4.2 through ant-node 0.23.0 in dev/devnet graphs. The checksum-verified published ant-node source also uses manual entry extraction, not the affected extract APIs.
• The archive probes used the real production extractor on two downloaded Windows release archives. All archive entries were Stored/Deflate. Extracted binary/bootstrap SHA-256 values matched an independent Python decoder. Separate mode probes confirmed that archive mode 06755 becomes 0755 on Unix.

Executed verification

Local runtime: macOS 26.4, rustc 1.96.0.

• cargo fmt --all -- --check: passed.
• cargo check --locked -p ant-cli: passed.
• cargo test --locked -p ant-core --lib -- --test-threads=4: 846 passed, 0 failed, including the four new tests.
• Temporary review-only integration target: 4 passed, 0 failed. The target was removed after execution; the checkout is clean. These are separate from the 846 repository tests.
• Locked CLI graphs resolved for macOS and x86_64-pc-windows-msvc; browser-wasm and the inverse zip-2 devnet graph were inspected.
• Audit with the PR's policy: exit 0. With only the three new ignores removed: exit 1 with exactly those three zip-2 advisories. This is a policy pass, not a vulnerability-free lockfile.
• GitHub read-back immediately before submission: 18/18 checks successful on this exact head, including Security Audit, Third-party notices, Browser WASM, E2E and Merkle E2E. Base/head are unchanged and GitHub reports clean mergeability.

Non-blocking limits and follow-up

• The three new audit ignores are workspace-wide. Keep the removal condition in the CI comment (V2-1633): remove them when ant-node upgrades, and reassess them if its extraction path or the release feature graph changes. They do not patch zip 2.4.2 itself.
• Decoder support is now Stored/Deflate rather than every default zip codec. Keep release ZIP packaging compatible; current inspected artifacts satisfy this requirement.
• No Windows build/runtime test or old-toolchain build was executed locally. The Windows result above is graph resolution plus extraction of Windows archives on macOS, not Windows execution. CI has no Windows job. zip 9 requires Rust 1.88; this review used 1.96.

Panel evidence and all six receipts were retained locally. Secondary reviewer platform claims were checked against upstream metadata: zip's nix dependency is gated to macOS/BSD, not Windows. No material finding remains unresolved.

Formal review submitted at Nic's request. This does not merge, release or deploy the PR.