From 328fa8dd5f5d293e90a2fe581da6cff0f56e8372 Mon Sep 17 00:00:00 2001 From: grumbach Date: Tue, 20 Oct 2026 10:18:31 +0900 Subject: [PATCH 1/3] chore(deps): move zip to 9 for three RustSec advisories `cargo audit` reports RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 against zip 2.4.2, which `zip = "2"` resolves to. All three are patched only in zip 9.0.0 and later. They concern `ZipArchive::extract()` and `ZipStreamReader::extract()`, which this crate never calls: the auto-upgrader's `extract_from_zip` walks entries with `by_index`, keeps only `enclosed_name()` paths and copies the one binary out itself. So the bump clears the audit rather than closing a path that was reachable here. zip 9 is taken with `default-features = false` and only the `deflate-flate2` feature. The upgrader only reads release archives, and every entry in the v0.23.0 Windows archive is Deflate; zip reads Stored entries without any feature. `deflate-flate2` decodes through the flate2 this crate already depends on, so flate2 keeps its miniz_oxide backend. zip 9's own `deflate` feature would also enable flate2's zlib-rs backend, which would switch every flate2 user in the build, including the tar.gz upgrade path, to zlib-rs. zip 2's default features built AES, bzip2, Deflate64, LZMA, XZ, zstd and Zopfli support that nothing here uses. Cargo.lock drops zip 2.4.2 and the thirteen crates only it needed (eleven for its default features, two for its fuzzing target), adds zip 9.0.5 and typed-path, and moves no other package. getrandom 0.3.4 loses its wasm-only js-sys and wasm-bindgen entries, because zip 2 was what enabled its `wasm_js` feature, and blake3's entry drops a version qualifier now that one constant_time_eq is left. zip 9 needs Rust 1.88, below this crate's `rust-version` of 1.95. No source change is needed: `ZipArchive::new`, `by_index`, `enclosed_name`, `ZipWriter` and `SimpleFileOptions` are unchanged for the calls made here. --- Cargo.lock | 155 ++++------------------------------------------------- Cargo.toml | 2 +- 2 files changed, 12 insertions(+), 145 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 751d4f04..c7bf66c7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -917,15 +917,6 @@ version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" -[[package]] -name = "arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "arc-swap" version = "1.9.2" @@ -1531,7 +1522,7 @@ dependencies = [ "arrayvec", "cc", "cfg-if", - "constant_time_eq 0.4.2", + "constant_time_eq", "cpufeatures 0.3.1", ] @@ -1670,25 +1661,6 @@ dependencies = [ "serde", ] -[[package]] -name = "bzip2" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47" -dependencies = [ - "bzip2-sys", -] - -[[package]] -name = "bzip2-sys" -version = "0.1.13+1.0.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14" -dependencies = [ - "cc", - "pkg-config", -] - [[package]] name = "c-kzg" version = "2.1.8" @@ -1949,12 +1921,6 @@ dependencies = [ "unicode-xid", ] -[[package]] -name = "constant_time_eq" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6" - [[package]] name = "constant_time_eq" version = "0.4.2" @@ -2211,12 +2177,6 @@ version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06" -[[package]] -name = "deflate64" -version = "0.1.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac6b926516df9c60bfa16e107b21086399f8285a44ca9711344b9e553c5146e2" - [[package]] name = "defmt" version = "1.1.1" @@ -2307,17 +2267,6 @@ dependencies = [ "syn 1.0.109", ] -[[package]] -name = "derive_arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.119", -] - [[package]] name = "derive_more" version = "2.1.1" @@ -2977,11 +2926,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", - "js-sys", "libc", "r-efi 5.3.0", "wasip2", - "wasm-bindgen", ] [[package]] @@ -3887,27 +3834,6 @@ version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" -[[package]] -name = "lzma-rs" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e" -dependencies = [ - "byteorder", - "crc", -] - -[[package]] -name = "lzma-sys" -version = "0.1.20" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27" -dependencies = [ - "cc", - "libc", - "pkg-config", -] - [[package]] name = "macro-string" version = "0.2.0" @@ -6625,6 +6551,12 @@ dependencies = [ "webrtc-util 0.12.0", ] +[[package]] +name = "typed-path" +version = "0.12.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" + [[package]] name = "typenum" version = "1.20.1" @@ -7516,15 +7448,6 @@ dependencies = [ "tiny-keccak", ] -[[package]] -name = "xz2" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2" -dependencies = [ - "lzma-sys", -] - [[package]] name = "yasna" version = "0.5.2" @@ -7663,32 +7586,16 @@ dependencies = [ [[package]] name = "zip" -version = "2.4.2" +version = "9.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50" +checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e" dependencies = [ - "aes", - "arbitrary", - "bzip2", - "constant_time_eq 0.3.1", "crc32fast", - "crossbeam-utils", - "deflate64", - "displaydoc", "flate2", - "getrandom 0.3.4", - "hmac", "indexmap 2.14.1", - "lzma-rs", "memchr", - "pbkdf2", - "sha1", - "thiserror 2.0.20", - "time", - "xz2", - "zeroize", - "zopfli", - "zstd", + "nix 0.31.3", + "typed-path", ] [[package]] @@ -7702,43 +7609,3 @@ name = "zmij" version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b" - -[[package]] -name = "zopfli" -version = "0.8.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249" -dependencies = [ - "bumpalo", - "crc32fast", - "log", - "simd-adler32", -] - -[[package]] -name = "zstd" -version = "0.13.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" -dependencies = [ - "zstd-safe", -] - -[[package]] -name = "zstd-safe" -version = "7.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882" -dependencies = [ - "zstd-sys", -] - -[[package]] -name = "zstd-sys" -version = "2.0.16+zstd.1.5.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748" -dependencies = [ - "cc", - "pkg-config", -] diff --git a/Cargo.toml b/Cargo.toml index 0ba1d2cb..23ff68de 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -96,7 +96,7 @@ serde_json = "1" # Archive extraction for auto-upgrade flate2 = "1" tar = "0.4" -zip = "2" +zip = { version = "9", default-features = false, features = ["deflate-flate2"] } # SHA-256 hashing for binary cache integrity sha2 = "0.10" From 7d5754d387bd1ccfcc3c13d9fd6522e64d60d6d1 Mon Sep 17 00:00:00 2001 From: grumbach Date: Fri, 16 Oct 2026 12:28:58 +0900 Subject: [PATCH 2/3] chore(deps): move rustls to 0.23.46 for four RustSec advisories `cargo audit` fails on RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 against `rustls` 0.23.45. All four are fixed in 0.23.46. They reached the RustSec database on 2026-10-14. Since then `main`'s lockfile fails `cargo audit`, and the Security Audit job fails whenever CI runs on a PR that still locks `rustls` 0.23.45. Only the `rustls` entry in `Cargo.lock` changes (version and checksum). 0.23.45 and 0.23.46 declare the same dependencies and `rust-version`, every existing requirement on `rustls` already allows the new patch, and the unique package lines of `cargo tree --locked --workspace --all-features --target all -e normal,build,dev --prefix none` differ only in the `rustls` version. `cargo update -p rustls` also moves `tempfile` from `getrandom` 0.4.3 to 0.3.4, a crate this fix has no reason to touch, so that line is kept as it was. Cargo 1.95, 1.98 and 1.99 accept the lockfile under `--locked` and find nothing to change with `--precise 0.23.46`. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index c7bf66c7..a913c52d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5144,9 +5144,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", From 62ee59efce02b8f6ba519b6d8c3478b08e931da3 Mon Sep 17 00:00:00 2001 From: grumbach Date: Tue, 20 Oct 2026 15:35:16 +0900 Subject: [PATCH 3/3] test(upgrade): cover extraction from a Deflate-compressed zip The zip tests in `upgrade::apply` build their archives with Stored entries, so none of them decodes Deflate. Release zips use Deflate, and Deflate is the only compression method this crate now enables for zip. `create_zip_archive` now delegates to `create_zip_archive_with_method`, which takes the compression method. The new `test_extract_binary_from_deflated_zip` writes a compressible payload with Deflate, checks that the entry really is Deflate and smaller than its payload, then extracts it through `AutoApplyUpgrader::extract_binary` and compares the bytes. --- src/upgrade/apply.rs | 40 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/src/upgrade/apply.rs b/src/upgrade/apply.rs index 88bdd8ee..a95f84f9 100644 --- a/src/upgrade/apply.rs +++ b/src/upgrade/apply.rs @@ -776,13 +776,22 @@ mod tests { /// Helper: create a zip archive containing a fake binary. fn create_zip_archive(dir: &Path, binary_name: &str, content: &[u8]) -> PathBuf { + create_zip_archive_with_method(dir, binary_name, content, zip::CompressionMethod::Stored) + } + + /// Helper: create a zip archive containing a fake binary compressed with `method`. + fn create_zip_archive_with_method( + dir: &Path, + binary_name: &str, + content: &[u8], + method: zip::CompressionMethod, + ) -> PathBuf { use std::io::Write; let archive_path = dir.join("test.zip"); let file = File::create(&archive_path).unwrap(); let mut zip_writer = zip::ZipWriter::new(file); - let options = zip::write::SimpleFileOptions::default() - .compression_method(zip::CompressionMethod::Stored); + let options = zip::write::SimpleFileOptions::default().compression_method(method); zip_writer.start_file(binary_name, options).unwrap(); zip_writer.write_all(content).unwrap(); zip_writer.finish().unwrap(); @@ -835,6 +844,33 @@ mod tests { assert_eq!(fs::read(&extracted).unwrap(), content); } + #[test] + fn test_extract_binary_from_deflated_zip() { + let dir = tempfile::tempdir().unwrap(); + let content = b"fake-deflated-binary-content".repeat(1024); + let archive = create_zip_archive_with_method( + dir.path(), + "ant-node", + &content, + zip::CompressionMethod::Deflated, + ); + + // Release zips use Deflate, so check the entry really is compressed. + { + let mut zip_archive = zip::ZipArchive::new(File::open(&archive).unwrap()).unwrap(); + let entry = zip_archive.by_index(0).unwrap(); + assert_eq!(entry.compression(), zip::CompressionMethod::Deflated); + assert!(entry.compressed_size() < entry.size()); + } + + let dest = tempfile::tempdir().unwrap(); + let result = AutoApplyUpgrader::extract_binary(&archive, dest.path()); + assert!(result.is_ok()); + + let extracted = result.unwrap(); + assert_eq!(fs::read(&extracted).unwrap(), content); + } + #[test] fn test_extract_binary_from_tar_gz_nested_path() { let dir = tempfile::tempdir().unwrap();