1b-agent/OneCAD-Simulation
1
0 Fork 0
forked from 1b-agent/fieldcraft-upstream
Code Pull Requests Activity

deps: zip 9.0.4; ignore the zip 3 extract advisories that come through solidcraft-io

Browse Source 
RUSTSEC-2026-0367/0368/0369 are in ZipArchive::extract and
ZipStreamReader::extract. Our zip 9 is updated to the fixed 9.0.4. zip 3
comes only through the pinned solidcraft-io, which never calls extract
(3MF parts are read by name), so the three are ignored with that reason
until SolidCraft moves to a fixed zip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo
This commit is contained in:
jyvikoandClaude Opus 5.5 authored and Irakli Kourtis committed 2026-10-17 00:50:21 -04:00
1 parent ec8e165fbb
commit 3977a0b630
2 files changed
+15 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Cargo.lock
Generated
+6 -6
View File
@@ -1327,7 +1327,7 @@ dependencies = [
"serde",
"serde_json",
"thiserror 2.0.21",
"zip 9.0.3",
"zip 9.0.4",
]
[[package]]
@@ -1363,7 +1363,7 @@ dependencies = [
"solidcraft-io",
"solidcraft-kernel",
"thiserror 2.0.21",
"zip 9.0.3",
"zip 9.0.4",
]
[[package]]
@@ -1388,7 +1388,7 @@ dependencies = [
"serde_json",
"sha2 0.11.1",
"thiserror 2.0.21",
"zip 9.0.3",
"zip 9.0.4",
]
[[package]]
@@ -1512,7 +1512,7 @@ dependencies = [
"tar",
"thiserror 2.0.21",
"ureq",
"zip 9.0.3",
"zip 9.0.4",
]
[[package]]
@@ -5563,9 +5563,9 @@ dependencies = [
[[package]]
name = "zip"
version = "9.0.3"
version = "9.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2d98561b612a84ae525331a7a094429ef8a5772514ed507ff6db5f54badc971"
checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
dependencies = [
"crc32fast",
"flate2",
deny.toml
+9
View File
@@ -1,6 +1,15 @@
[advisories]
unmaintained = "all"
yanked = "warn"
# zip 3 comes only through solidcraft-io (pinned rev, still on zip 3; our own zip is 9.0.4,
# which is fixed). All three are in `ZipArchive::extract` / `ZipStreamReader::extract`, which
# neither FieldCraft nor solidcraft-io calls: 3MF parts are read by name into memory. Drop these
# once SolidCraft moves to a fixed zip.
ignore = [
{ id = "RUSTSEC-2026-0367", reason = "zip 3 via solidcraft-io; extract() is never called" },
{ id = "RUSTSEC-2026-0368", reason = "zip 3 via solidcraft-io; extract() is never called" },
{ id = "RUSTSEC-2026-0369", reason = "zip 3 via solidcraft-io; extract() is never called" },
]
[bans]
multiple-versions = "warn"