From c4d2ae87ee0b81549c4b47b449b7bd227478c2ec Mon Sep 17 00:00:00 2001 From: Irakli Kourtis Date: Sat, 17 Oct 2026 08:49:02 -0400 Subject: [PATCH] =?UTF-8?q?deps:=20zip=203.0.0=20=E2=86=92=209.0.4=20(RUST?= =?UTF-8?q?SEC-2026-0367,=20-0368,=20-0369)=20(#1971)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks @jyviko. --- Cargo.lock | 67 ++++++++++------------ Cargo.toml | 2 +- THIRD-PARTY-LICENSES.txt | 119 +++++++++------------------------------ crates/io/src/design.rs | 12 ++-- crates/io/src/threemf.rs | 6 +- deny.toml | 8 +++ 6 files changed, 78 insertions(+), 136 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3a74eaf0..5bd12deb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -197,15 +197,6 @@ dependencies = [ "num-traits", ] -[[package]] -name = "arbitrary" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "arboard" version = "3.6.1" @@ -1073,17 +1064,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "derive_arbitrary" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac" -dependencies = [ - "proc-macro2", - "quote", - "syn 3.0.6", -] - [[package]] name = "derive_more" version = "0.99.20" @@ -2541,6 +2521,18 @@ dependencies = [ "memoffset", ] +[[package]] +name = "nix" +version = "0.31.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" +dependencies = [ + "bitflags 2.13.2", + "cfg-if", + "cfg_aliases", + "libc", +] + [[package]] name = "nohash-hasher" version = "0.2.0" @@ -4182,7 +4174,7 @@ dependencies = [ "solidcraft-geom", "solidcraft-kernel", "thiserror 2.0.21", - "zip 3.0.0", + "zip 9.0.4", ] [[package]] @@ -4264,7 +4256,7 @@ dependencies = [ "ttf-parser", "web-time", "winreg", - "zip 3.0.0", + "zip 9.0.4", ] [[package]] @@ -5850,7 +5842,7 @@ dependencies = [ "futures-sink", "futures-util", "hex", - "nix", + "nix 0.29.0", "ordered-stream", "rand 0.8.8", "serde", @@ -6090,20 +6082,6 @@ dependencies = [ "syn 3.0.6", ] -[[package]] -name = "zip" -version = "3.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12598812502ed0105f607f941c386f43d441e00148fce9dec3ca5ffb0bde9308" -dependencies = [ - "arbitrary", - "crc32fast", - "flate2", - "indexmap", - "memchr", - "zopfli", -] - [[package]] name = "zip" version = "8.6.0" @@ -6118,6 +6096,21 @@ dependencies = [ "zstd 0.13.3", ] +[[package]] +name = "zip" +version = "9.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22" +dependencies = [ + "crc32fast", + "flate2", + "indexmap", + "memchr", + "nix 0.31.3", + "typed-path", + "zopfli", +] + [[package]] name = "zlib-rs" version = "0.6.8" diff --git a/Cargo.toml b/Cargo.toml index 9f53bb0e..19d95fc8 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -52,7 +52,7 @@ spade = { version = "2.15", default-features = false, features = ["std"] } rayon = "1.12" # packages (3MF) -zip = { version = "3", default-features = false, features = ["deflate"] } +zip = { version = "9", default-features = false, features = ["deflate"] } quick-xml = "0.41" # glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are # read by crates/io itself, so no image decoding or file access comes with it. diff --git a/THIRD-PARTY-LICENSES.txt b/THIRD-PARTY-LICENSES.txt index 829f9393..653870ec 100644 --- a/THIRD-PARTY-LICENSES.txt +++ b/THIRD-PARTY-LICENSES.txt @@ -1,6 +1,6 @@ Third-party software in SolidCraft -SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 550 crates below. +SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 549 crates below. Generated by `cargo xtask licences` from Cargo.lock and the crates' own licence files. SolidCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE. @@ -21,7 +21,6 @@ android-activity 0.6.1 (MIT OR Apache-2.0) android-properties 0.2.2 (MIT) android_system_properties 0.1.6 (MIT OR Apache-2.0) approx 0.4.0 (Apache-2.0) -arbitrary 1.5.0 (MIT OR Apache-2.0) arboard 3.6.1 (MIT OR Apache-2.0) array-macro 2.1.8 (MIT OR Apache-2.0) arrayref 0.3.9 (BSD-2-Clause) @@ -103,7 +102,6 @@ crypto-common 0.2.2 (MIT OR Apache-2.0) cursor-icon 1.2.0 (MIT OR Apache-2.0 OR Zlib) dbus 0.9.12 (Apache-2.0/MIT) dbus-secret-service 4.1.0 (MIT OR Apache-2.0) -derive_arbitrary 1.5.0 (MIT OR Apache-2.0) derive_more 0.99.20 (MIT) digest 0.10.7 (MIT OR Apache-2.0) digest 0.11.3 (MIT OR Apache-2.0) @@ -238,6 +236,7 @@ ndk 0.9.0 (MIT OR Apache-2.0) ndk-context 0.1.1 (MIT OR Apache-2.0) ndk-sys 0.6.0+11769913 (MIT OR Apache-2.0) nix 0.29.0 (MIT) +nix 0.31.3 (MIT) nohash-hasher 0.2.0 (Apache-2.0 OR MIT) num 0.4.3 (MIT OR Apache-2.0) num-bigint 0.4.8 (MIT OR Apache-2.0) @@ -536,8 +535,8 @@ zeroize_derive 1.5.0 (Apache-2.0 OR MIT) zerotrie 0.2.5 (Unicode-3.0) zerovec 0.11.8 (Unicode-3.0) zerovec-derive 0.11.6 (Unicode-3.0) -zip 3.0.0 (MIT) zip 8.6.0 (MIT) +zip 9.0.4 (MIT) zlib-rs 0.6.8 (Zlib) zmij 1.0.23 (MIT) zopfli 0.8.3 (Apache-2.0) @@ -1091,30 +1090,29 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ================================================================================ -ahash 0.8.12, arbitrary 1.5.0, arrayvec 0.7.8, async-channel 2.5.0, async-executor 1.14.0, async-fs -2.2.0, async-io 2.6.0, async-lock 3.4.2, async-process 2.5.0, async-recursion 1.2.0, async-signal -0.2.14, async-task 4.7.1, atomic-waker 1.1.2, base64 0.23.1, bitflags 1.3.2, bitflags 2.13.2, -blocking 1.7.0, bumpalo 3.20.3, cfg-if 1.0.5, cgl 0.3.2, concurrent-queue 2.5.0, core-foundation -0.10.1, core-foundation 0.9.4, core-foundation-sys 0.8.7, core-graphics 0.23.2, core-graphics-types -0.1.3, core_detect 1.0.0, crossbeam-deque 0.8.8, crossbeam-epoch 0.9.21, crossbeam-utils 0.8.23, -dbus-secret-service 4.1.0, derive_arbitrary 1.5.0, displaydoc 0.2.7, either 1.19.0, equivalent -1.0.2, errno 0.3.14, euclid 0.22.14, event-listener 5.4.2, event-listener-strategy 0.5.4, fastrand -2.5.0, flate2 1.1.10, form_urlencoded 1.2.2, futures-lite 2.6.1, gethostname 1.1.0, glow 0.17.0, -gltf 1.4.1, gltf-derive 1.4.1, gltf-json 1.4.1, hashbrown 0.16.1, hashbrown 0.17.1, hermit-abi -0.5.3, httparse 1.10.1, idna 1.1.0, idna_adapter 1.2.2, indexmap 2.14.2, itertools 0.13.0, itertools -0.15.0, js-sys 0.3.106, khronos-egl 6.0.0, lazy_static 1.5.1, linux-raw-sys 0.12.1, linux-raw-sys -0.4.15, lock_api 0.4.14, log 0.4.34, num 0.4.3, num-bigint 0.4.8, num-complex 0.4.6, num-integer -0.1.47, num-iter 0.1.46, num-rational 0.4.2, num-traits 0.2.19, once_cell 1.21.4, openssl-probe -0.2.1, ordered-stream 0.2.0, parking 2.2.1, parking_lot 0.12.5, parking_lot_core 0.9.12, -percent-encoding 2.3.2, piper 0.2.5, plain 0.2.3, png 0.18.1, polling 3.11.0, pollster 0.4.0, -pollster 1.0.1, rayon 1.12.0, rayon-core 1.13.0, renderdoc-sys 1.1.0, robust 1.2.0, ron 0.12.2, -roxmltree 0.21.1, rustc-hash 1.1.0, rustix 0.38.44, rustix 1.1.5, rustls 0.23.46, -rustls-native-certs 0.8.5, scoped-tls 1.0.1, scopeguard 1.2.0, secret-service 4.0.0, -security-framework 2.11.1, security-framework 3.7.0, security-framework-sys 2.17.0, -signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.16.2, smol_str 0.2.2, stable_deref_trait -1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-segmentation 1.13.3, unicode-width -0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, -wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129, +ahash 0.8.12, arrayvec 0.7.8, async-channel 2.5.0, async-executor 1.14.0, async-fs 2.2.0, async-io +2.6.0, async-lock 3.4.2, async-process 2.5.0, async-recursion 1.2.0, async-signal 0.2.14, async-task +4.7.1, atomic-waker 1.1.2, base64 0.23.1, bitflags 1.3.2, bitflags 2.13.2, blocking 1.7.0, bumpalo +3.20.3, cfg-if 1.0.5, cgl 0.3.2, concurrent-queue 2.5.0, core-foundation 0.10.1, core-foundation +0.9.4, core-foundation-sys 0.8.7, core-graphics 0.23.2, core-graphics-types 0.1.3, core_detect +1.0.0, crossbeam-deque 0.8.8, crossbeam-epoch 0.9.21, crossbeam-utils 0.8.23, dbus-secret-service +4.1.0, displaydoc 0.2.7, either 1.19.0, equivalent 1.0.2, errno 0.3.14, euclid 0.22.14, +event-listener 5.4.2, event-listener-strategy 0.5.4, fastrand 2.5.0, flate2 1.1.10, form_urlencoded +1.2.2, futures-lite 2.6.1, gethostname 1.1.0, glow 0.17.0, gltf 1.4.1, gltf-derive 1.4.1, gltf-json +1.4.1, hashbrown 0.16.1, hashbrown 0.17.1, hermit-abi 0.5.3, httparse 1.10.1, idna 1.1.0, +idna_adapter 1.2.2, indexmap 2.14.2, itertools 0.13.0, itertools 0.15.0, js-sys 0.3.106, khronos-egl +6.0.0, lazy_static 1.5.1, linux-raw-sys 0.12.1, linux-raw-sys 0.4.15, lock_api 0.4.14, log 0.4.34, +num 0.4.3, num-bigint 0.4.8, num-complex 0.4.6, num-integer 0.1.47, num-iter 0.1.46, num-rational +0.4.2, num-traits 0.2.19, once_cell 1.21.4, openssl-probe 0.2.1, ordered-stream 0.2.0, parking +2.2.1, parking_lot 0.12.5, parking_lot_core 0.9.12, percent-encoding 2.3.2, piper 0.2.5, plain +0.2.3, png 0.18.1, polling 3.11.0, pollster 0.4.0, pollster 1.0.1, rayon 1.12.0, rayon-core 1.13.0, +renderdoc-sys 1.1.0, robust 1.2.0, ron 0.12.2, roxmltree 0.21.1, rustc-hash 1.1.0, rustix 0.38.44, +rustix 1.1.5, rustls 0.23.46, rustls-native-certs 0.8.5, scoped-tls 1.0.1, scopeguard 1.2.0, +secret-service 4.0.0, security-framework 2.11.1, security-framework 3.7.0, security-framework-sys +2.17.0, signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.16.2, smol_str 0.2.2, +stable_deref_trait 1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-segmentation +1.13.3, unicode-width 0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2 +1.0.4+wasi-0.2.12, wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129, wasm-bindgen-macro-support 0.2.129, wasm-bindgen-shared 0.2.129, web-sys 0.3.106, weezl 0.1.12, wit-bindgen 0.57.1 ================================================================================ @@ -2029,38 +2027,6 @@ Apache License See the License for the specific language governing permissions and limitations under the License. -================================================================================ -arbitrary 1.5.0, derive_arbitrary 1.5.0 -================================================================================ - -MIT License - -Copyright (c) 2019 Manish Goregaokar - -Permission is hereby granted, free of charge, to any -person obtaining a copy of this software and associated -documentation files (the "Software"), to deal in the -Software without restriction, including without -limitation the rights to use, copy, modify, merge, -publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software -is furnished to do so, subject to the following -conditions: - -The above copyright notice and this permission notice -shall be included in all copies or substantial portions -of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF -ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED -TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A -PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT -SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR -IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. - ================================================================================ arboard 3.6.1 ================================================================================ @@ -9455,7 +9421,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ================================================================================ -nix 0.29.0 +nix 0.29.0, nix 0.31.3 ================================================================================ The MIT License (MIT) @@ -15591,36 +15557,7 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ================================================================================ -zip 3.0.0 -================================================================================ - -The MIT License (MIT) - -Copyright (c) 2014 Mathijs van de Nes - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - -Some files in the "tests/data" subdirectory of this repository are under other -licences; see files named LICENSE.*.txt for details. - -================================================================================ -zip 8.6.0 +zip 8.6.0, zip 9.0.4 ================================================================================ The MIT License (MIT) diff --git a/crates/io/src/design.rs b/crates/io/src/design.rs index 0d321760..e3fbf151 100644 --- a/crates/io/src/design.rs +++ b/crates/io/src/design.rs @@ -294,7 +294,11 @@ impl PackageReader { if declared > MAX_ENTRIES || u16_at(4)? != 0 || u16_at(6)? != 0 || u16_at(8)? as usize != declared || end.len() != 22 + u16_at(20)? as usize { return Err(invalid("too many entries or unsupported ZIP directory")); } - let mut zip = zip::ZipArchive::new(source).map_err(invalid)?; + // A design file is a ZIP with nothing in front of it. Saying so skips zip's search for a + // prefix, which reads back through the stored parts and would load a large embedded + // source before the preview can be shown. + let config = zip::read::Config { archive_offset: zip::read::ArchiveOffset::Known(0) }; + let mut zip = zip::ZipArchive::with_config(config, source).map_err(invalid)?; if u16_at(4)? != 0 || u16_at(6)? != 0 || u16_at(8)? as usize != zip.len() @@ -307,7 +311,7 @@ impl PackageReader { let mut total = 0u64; for i in 0..zip.len() { let part = zip.by_index_raw(i).map_err(invalid)?; - let name = part.name(); + let name = part.name().map_err(invalid)?.into_owned(); if name.is_empty() || name.contains('\\') || name.split('/').any(|c| c.is_empty() || c == "." || c == "..") @@ -768,7 +772,7 @@ mod tests { let doc = document(); let preview = DesignPreview { meshes: vec![mesh()] }; let bytes = write_design_container_with_preview(&doc, DesignCompression::Fast, Some(&preview)).unwrap(); - let offset = zip::ZipArchive::new(Cursor::new(&bytes)).unwrap().by_name("document.json").unwrap().data_start() as usize; + let offset = zip::ZipArchive::new(Cursor::new(&bytes)).unwrap().by_name("document.json").unwrap().data_start().unwrap() as usize; let bytes = Rc::new(RefCell::new(bytes)); let mut reader = DesignContainerReader::new(Shared { bytes: bytes.clone(), position: 0 }).unwrap(); assert!(reader.preview().is_some()); @@ -850,7 +854,7 @@ mod tests { (0..zip.len()) .map(|i| { let mut entry = zip.by_index(i).unwrap(); - let name = entry.name().to_owned(); + let name = entry.name().unwrap().into_owned(); let mut bytes = Vec::new(); entry.read_to_end(&mut bytes).unwrap(); (name, bytes) diff --git a/crates/io/src/threemf.rs b/crates/io/src/threemf.rs index 362e03a1..351f0f83 100644 --- a/crates/io/src/threemf.rs +++ b/crates/io/src/threemf.rs @@ -352,9 +352,9 @@ fn bad(msg: impl Into) -> Result { fn read_part(zip: &mut zip::ZipArchive>, name: &str) -> Result>> { let want = name.trim_start_matches('/').to_ascii_lowercase(); - let Some(idx) = - (0..zip.len()).find(|i| zip.name_for_index(*i).is_some_and(|n| n.replace('\\', "/").trim_start_matches('/').to_ascii_lowercase() == want)) - else { + let Some(idx) = (0..zip.len()).find(|i| { + zip.name_for_index(*i).and_then(|n| n.ok()).is_some_and(|n| n.replace('\\', "/").trim_start_matches('/').to_ascii_lowercase() == want) + }) else { return Ok(None); }; let mut f = zip.by_index(idx).map_err(|e| IoError::Invalid(format!("3MF {name}: {e}")))?; diff --git a/deny.toml b/deny.toml index c24dbb4c..c5b57291 100644 --- a/deny.toml +++ b/deny.toml @@ -3,6 +3,14 @@ # The nightly command downgrades only this diagnostic with --warn unmaintained. unmaintained = "all" yanked = "warn" +# zip 8.6 comes only through cadmpeg-codec-freecad 0.6.1 (`zip = "^8"`); all three advisories +# are in ZipArchive::extract / ZipStreamReader::extract, which neither it nor solidcraft-io +# calls. Remove these when cadmpeg moves to zip 9. +ignore = [ + { id = "RUSTSEC-2026-0367", reason = "zip 8 via cadmpeg-codec-freecad; extract() is never called" }, + { id = "RUSTSEC-2026-0368", reason = "zip 8 via cadmpeg-codec-freecad; extract() is never called" }, + { id = "RUSTSEC-2026-0369", reason = "zip 8 via cadmpeg-codec-freecad; extract() is never called" }, +] [bans] multiple-versions = "warn"