Repository navigation
fix(deps): bump zstd crates for RUSTSEC-2026-0410 - #869
Merged
Merged
Conversation
cargo deny's advisories check started failing on new zstd advisories. Bump zstd 0.14.0 -> 0.14.3, zstd-safe 8.0.0 -> 8.2.0 and zstd-sys 2.1.0 -> 2.1.2 (lockfile only), which fixes RUSTSEC-2026-0410 and the zstd 0.14 / zstd-safe 8 path via parquet. zstd 0.13.3 / zstd-safe 7.3.0 also come in via s3 -> reqx 0.1.41 and have no fixed 0.13.x release. reqx only uses zstd::stream::read::Decoder to decode HTTP responses, which none of RUSTSEC-2026-0391, -0398 and -0403 affect, so ignore those in deny.toml until s3 can be upgraded (s3 0.1.38 needs Rust 1.99.1; we pin 1.96.0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ttfb2NaUACpzrJX577oxm8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Sascha · project thread
Fixes the failing
cargo denyadvisories check (seen on #841, the release PR).s3→reqx0.1.41. There is no fixed 0.13.x release. reqx only useszstd::stream::read::Decoder::newto decode HTTP responses, and none of the three affect that path (nowith_context, noseekablefeature, and 0403 only hits the write decoder). The real fix is s3 0.1.38 (reqx 0.2), but it needs Rust 1.99.1 andrust-toolchain.tomlpins 1.96.0.Checked locally:
cargo deny checkpasses (advisories, bans, licenses, sources) andcargo check --all-targetsbuilds.Once merged, release-please will refresh #841 and its check should go green.
Generated by Claude Code