From ab0b65add9e953f2a3422147290accd71074dd4d Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 12:17:40 +0000 Subject: [PATCH] fix(deps): bump zstd crates for RUSTSEC-2026-0410 and related advisories cargo deny's advisories check started failing on new zstd advisories. Bump zstd 0.14.0 -> 0.14.3, zstd-safe 8.0.0 -> 8.2.0 and zstd-sys 2.1.0 -> 2.1.2 (lockfile only), which fixes RUSTSEC-2026-0410 and the zstd 0.14 / zstd-safe 8 path via parquet. zstd 0.13.3 / zstd-safe 7.3.0 also come in via s3 -> reqx 0.1.41 and have no fixed 0.13.x release. reqx only uses zstd::stream::read::Decoder to decode HTTP responses, which none of RUSTSEC-2026-0391, -0398 and -0403 affect, so ignore those in deny.toml until s3 can be upgraded (s3 0.1.38 needs Rust 1.99.1; we pin 1.96.0). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Ttfb2NaUACpzrJX577oxm8 --- Cargo.lock | 16 ++++++++-------- deny.toml | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f67d9545..f93b0280 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2131,7 +2131,7 @@ dependencies = [ "parquet-geospatial", "seq-macro", "twox-hash", - "zstd 0.14.0", + "zstd 0.14.3", ] [[package]] @@ -4093,11 +4093,11 @@ dependencies = [ [[package]] name = "zstd" -version = "0.14.0" +version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf06bd8162af0734b344780deb55b42a2429ae430870d13fcc12f238e880fe6e" +checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70" dependencies = [ - "zstd-safe 8.0.0", + "zstd-safe 8.2.0", ] [[package]] @@ -4111,18 +4111,18 @@ dependencies = [ [[package]] name = "zstd-safe" -version = "8.0.0" +version = "8.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae42c0555055784c70058d19ba8e275528e8a99a706684868ace5da4e716a4ab" +checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b" dependencies = [ "zstd-sys", ] [[package]] name = "zstd-sys" -version = "2.1.0+zstd.1.5.7" +version = "2.1.2+zstd.1.5.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0" +checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3" dependencies = [ "cc", "pkg-config", diff --git a/deny.toml b/deny.toml index 9c5d59c5..fecf3426 100644 --- a/deny.toml +++ b/deny.toml @@ -35,6 +35,20 @@ ignore = [ # only `--target all` shows it). Drop this line once postcard moves to # heapless 0.8, or phonenumber stops using postcard. "RUSTSEC-2023-0089", + # zstd 0.13.3 / zstd-safe 7.3.0 come in via s3 -> reqx 0.1.41, which uses + # zstd only to decode `Content-Encoding: zstd` HTTP responses from the S3 + # endpoint, through `zstd::stream::read::Decoder::new`. None of these three + # advisories reach that path: 0391 needs `with_context` with a reused + # context, 0398 needs the `seekable` feature (not enabled), and 0403 only + # affects `zstd::stream::write::Decoder` (the advisory says the read decoder + # is not affected). The fixed releases are zstd >=0.14.3 / zstd-safe >=8.2.0, + # which reqx 0.1.x can't use; s3 0.1.38 moves to reqx 0.2 but needs Rust + # 1.99.1 (we pin 1.96.0 in rust-toolchain.toml). Our direct zstd use, via + # parquet, is already on the fixed versions. Drop these three lines once s3 + # is upgraded. + "RUSTSEC-2026-0391", # abandoned stream data leaks into the next stream + "RUSTSEC-2026-0398", # Seekable::decompress sets Vec length past capacity + "RUSTSEC-2026-0403", # uninitialized memory on failed legacy-frame streaming ] # ── licenses: only accept licenses we've reviewed as OK to redistribute ─────