deps: zip 3.0.0 → 9.0.4 (RUSTSEC-2026-0367, -0368, -0369) (#1971)

Thanks @jyviko.

Cargo.lock

@@ -197,15 +197,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "arboard"
 version = "3.6.1"
@@ -1073,17 +1064,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.6",
-]
-
 [[package]]
 name = "derive_more"
 version = "0.99.20"
@@ -2541,6 +2521,18 @@ dependencies = [
  "memoffset",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -4182,7 +4174,7 @@ dependencies = [
  "solidcraft-geom",
  "solidcraft-kernel",
  "thiserror 2.0.21",
- "zip 3.0.0",
+ "zip 9.0.4",
 ]
 
 [[package]]
@@ -4264,7 +4256,7 @@ dependencies = [
  "ttf-parser",
  "web-time",
  "winreg",
- "zip 3.0.0",
+ "zip 9.0.4",
 ]
 
 [[package]]
@@ -5850,7 +5842,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "hex",
- "nix",
+ "nix 0.29.0",
  "ordered-stream",
  "rand 0.8.8",
  "serde",
@@ -6090,20 +6082,6 @@ dependencies = [
  "syn 3.0.6",
 ]
 
-[[package]]
-name = "zip"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12598812502ed0105f607f941c386f43d441e00148fce9dec3ca5ffb0bde9308"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "flate2",
- "indexmap",
- "memchr",
- "zopfli",
-]
-
 [[package]]
 name = "zip"
 version = "8.6.0"
@@ -6118,6 +6096,21 @@ dependencies = [
  "zstd 0.13.3",
 ]
 
+[[package]]
+name = "zip"
+version = "9.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "nix 0.31.3",
+ "typed-path",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"

Cargo.toml

@@ -52,7 +52,7 @@ spade = { version = "2.15", default-features = false, features = ["std"] }
 rayon = "1.12"
 
 # packages (3MF)
-zip = { version = "3", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 quick-xml = "0.41"
 # glTF 2.0 import (MIT OR Apache-2.0): the document model and GLB container only; buffers are
 # read by crates/io itself, so no image decoding or file access comes with it.

THIRD-PARTY-LICENSES.txt

@@ -1,6 +1,6 @@
 Third-party software in SolidCraft
 
-SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 550 crates below.
+SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 549 crates below.
 Generated by `cargo xtask licences` from Cargo.lock and the crates' own licence files.
 SolidCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE.
 
@@ -21,7 +21,6 @@ android-activity 0.6.1  (MIT OR Apache-2.0)
 android-properties 0.2.2  (MIT)
 android_system_properties 0.1.6  (MIT OR Apache-2.0)
 approx 0.4.0  (Apache-2.0)
-arbitrary 1.5.0  (MIT OR Apache-2.0)
 arboard 3.6.1  (MIT OR Apache-2.0)
 array-macro 2.1.8  (MIT OR Apache-2.0)
 arrayref 0.3.9  (BSD-2-Clause)
@@ -103,7 +102,6 @@ crypto-common 0.2.2  (MIT OR Apache-2.0)
 cursor-icon 1.2.0  (MIT OR Apache-2.0 OR Zlib)
 dbus 0.9.12  (Apache-2.0/MIT)
 dbus-secret-service 4.1.0  (MIT OR Apache-2.0)
-derive_arbitrary 1.5.0  (MIT OR Apache-2.0)
 derive_more 0.99.20  (MIT)
 digest 0.10.7  (MIT OR Apache-2.0)
 digest 0.11.3  (MIT OR Apache-2.0)
@@ -238,6 +236,7 @@ ndk 0.9.0  (MIT OR Apache-2.0)
 ndk-context 0.1.1  (MIT OR Apache-2.0)
 ndk-sys 0.6.0+11769913  (MIT OR Apache-2.0)
 nix 0.29.0  (MIT)
+nix 0.31.3  (MIT)
 nohash-hasher 0.2.0  (Apache-2.0 OR MIT)
 num 0.4.3  (MIT OR Apache-2.0)
 num-bigint 0.4.8  (MIT OR Apache-2.0)
@@ -536,8 +535,8 @@ zeroize_derive 1.5.0  (Apache-2.0 OR MIT)
 zerotrie 0.2.5  (Unicode-3.0)
 zerovec 0.11.8  (Unicode-3.0)
 zerovec-derive 0.11.6  (Unicode-3.0)
-zip 3.0.0  (MIT)
 zip 8.6.0  (MIT)
+zip 9.0.4  (MIT)
 zlib-rs 0.6.8  (Zlib)
 zmij 1.0.23  (MIT)
 zopfli 0.8.3  (Apache-2.0)
@@ -1091,30 +1090,29 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.
 
 ================================================================================
-ahash 0.8.12, arbitrary 1.5.0, arrayvec 0.7.8, async-channel 2.5.0, async-executor 1.14.0, async-fs
+ahash 0.8.12, arrayvec 0.7.8, async-channel 2.5.0, async-executor 1.14.0, async-fs 2.2.0, async-io
-2.2.0, async-io 2.6.0, async-lock 3.4.2, async-process 2.5.0, async-recursion 1.2.0, async-signal
+2.6.0, async-lock 3.4.2, async-process 2.5.0, async-recursion 1.2.0, async-signal 0.2.14, async-task
-0.2.14, async-task 4.7.1, atomic-waker 1.1.2, base64 0.23.1, bitflags 1.3.2, bitflags 2.13.2,
+4.7.1, atomic-waker 1.1.2, base64 0.23.1, bitflags 1.3.2, bitflags 2.13.2, blocking 1.7.0, bumpalo
-blocking 1.7.0, bumpalo 3.20.3, cfg-if 1.0.5, cgl 0.3.2, concurrent-queue 2.5.0, core-foundation
+3.20.3, cfg-if 1.0.5, cgl 0.3.2, concurrent-queue 2.5.0, core-foundation 0.10.1, core-foundation
-0.10.1, core-foundation 0.9.4, core-foundation-sys 0.8.7, core-graphics 0.23.2, core-graphics-types
+0.9.4, core-foundation-sys 0.8.7, core-graphics 0.23.2, core-graphics-types 0.1.3, core_detect
-0.1.3, core_detect 1.0.0, crossbeam-deque 0.8.8, crossbeam-epoch 0.9.21, crossbeam-utils 0.8.23,
+1.0.0, crossbeam-deque 0.8.8, crossbeam-epoch 0.9.21, crossbeam-utils 0.8.23, dbus-secret-service
-dbus-secret-service 4.1.0, derive_arbitrary 1.5.0, displaydoc 0.2.7, either 1.19.0, equivalent
+4.1.0, displaydoc 0.2.7, either 1.19.0, equivalent 1.0.2, errno 0.3.14, euclid 0.22.14,
-1.0.2, errno 0.3.14, euclid 0.22.14, event-listener 5.4.2, event-listener-strategy 0.5.4, fastrand
+event-listener 5.4.2, event-listener-strategy 0.5.4, fastrand 2.5.0, flate2 1.1.10, form_urlencoded
-2.5.0, flate2 1.1.10, form_urlencoded 1.2.2, futures-lite 2.6.1, gethostname 1.1.0, glow 0.17.0,
+1.2.2, futures-lite 2.6.1, gethostname 1.1.0, glow 0.17.0, gltf 1.4.1, gltf-derive 1.4.1, gltf-json
-gltf 1.4.1, gltf-derive 1.4.1, gltf-json 1.4.1, hashbrown 0.16.1, hashbrown 0.17.1, hermit-abi
+1.4.1, hashbrown 0.16.1, hashbrown 0.17.1, hermit-abi 0.5.3, httparse 1.10.1, idna 1.1.0,
-0.5.3, httparse 1.10.1, idna 1.1.0, idna_adapter 1.2.2, indexmap 2.14.2, itertools 0.13.0, itertools
+idna_adapter 1.2.2, indexmap 2.14.2, itertools 0.13.0, itertools 0.15.0, js-sys 0.3.106, khronos-egl
-0.15.0, js-sys 0.3.106, khronos-egl 6.0.0, lazy_static 1.5.1, linux-raw-sys 0.12.1, linux-raw-sys
+6.0.0, lazy_static 1.5.1, linux-raw-sys 0.12.1, linux-raw-sys 0.4.15, lock_api 0.4.14, log 0.4.34,
-0.4.15, lock_api 0.4.14, log 0.4.34, num 0.4.3, num-bigint 0.4.8, num-complex 0.4.6, num-integer
+num 0.4.3, num-bigint 0.4.8, num-complex 0.4.6, num-integer 0.1.47, num-iter 0.1.46, num-rational
-0.1.47, num-iter 0.1.46, num-rational 0.4.2, num-traits 0.2.19, once_cell 1.21.4, openssl-probe
+0.4.2, num-traits 0.2.19, once_cell 1.21.4, openssl-probe 0.2.1, ordered-stream 0.2.0, parking
-0.2.1, ordered-stream 0.2.0, parking 2.2.1, parking_lot 0.12.5, parking_lot_core 0.9.12,
+2.2.1, parking_lot 0.12.5, parking_lot_core 0.9.12, percent-encoding 2.3.2, piper 0.2.5, plain
-percent-encoding 2.3.2, piper 0.2.5, plain 0.2.3, png 0.18.1, polling 3.11.0, pollster 0.4.0,
+0.2.3, png 0.18.1, polling 3.11.0, pollster 0.4.0, pollster 1.0.1, rayon 1.12.0, rayon-core 1.13.0,
-pollster 1.0.1, rayon 1.12.0, rayon-core 1.13.0, renderdoc-sys 1.1.0, robust 1.2.0, ron 0.12.2,
+renderdoc-sys 1.1.0, robust 1.2.0, ron 0.12.2, roxmltree 0.21.1, rustc-hash 1.1.0, rustix 0.38.44,
-roxmltree 0.21.1, rustc-hash 1.1.0, rustix 0.38.44, rustix 1.1.5, rustls 0.23.46,
+rustix 1.1.5, rustls 0.23.46, rustls-native-certs 0.8.5, scoped-tls 1.0.1, scopeguard 1.2.0,
-rustls-native-certs 0.8.5, scoped-tls 1.0.1, scopeguard 1.2.0, secret-service 4.0.0,
+secret-service 4.0.0, security-framework 2.11.1, security-framework 3.7.0, security-framework-sys
-security-framework 2.11.1, security-framework 3.7.0, security-framework-sys 2.17.0,
+2.17.0, signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.16.2, smol_str 0.2.2,
-signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.16.2, smol_str 0.2.2, stable_deref_trait
+stable_deref_trait 1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-segmentation
-1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-segmentation 1.13.3, unicode-width
+1.13.3, unicode-width 0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2
-0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12,
+1.0.4+wasi-0.2.12, wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129,
-wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129,
 wasm-bindgen-macro-support 0.2.129, wasm-bindgen-shared 0.2.129, web-sys 0.3.106, weezl 0.1.12,
 wit-bindgen 0.57.1
 ================================================================================
@@ -2029,38 +2027,6 @@ Apache License
    See the License for the specific language governing permissions and
    limitations under the License.
 
-================================================================================
-arbitrary 1.5.0, derive_arbitrary 1.5.0
-================================================================================
-
-MIT License
-
-Copyright (c) 2019 Manish Goregaokar
-
-Permission is hereby granted, free of charge, to any
-person obtaining a copy of this software and associated
-documentation files (the "Software"), to deal in the
-Software without restriction, including without
-limitation the rights to use, copy, modify, merge,
-publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software
-is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice
-shall be included in all copies or substantial portions
-of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
-TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
-SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.
-
 ================================================================================
 arboard 3.6.1
 ================================================================================
@@ -9455,7 +9421,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ================================================================================
-nix 0.29.0
+nix 0.29.0, nix 0.31.3
 ================================================================================
 
 The MIT License (MIT)
@@ -15591,36 +15557,7 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.
 
 ================================================================================
-zip 3.0.0
+zip 8.6.0, zip 9.0.4
-================================================================================
-
-The MIT License (MIT)
-
-Copyright (c) 2014 Mathijs van de Nes
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-Some files in the "tests/data" subdirectory of this repository are under other
-licences; see files named LICENSE.*.txt for details.
-
-================================================================================
-zip 8.6.0
 ================================================================================
 
 The MIT License (MIT)

crates/io/src/design.rs

@@ -294,7 +294,11 @@ impl<R: Read + Seek> PackageReader<R> {
         if declared > MAX_ENTRIES || u16_at(4)? != 0 || u16_at(6)? != 0 || u16_at(8)? as usize != declared || end.len() != 22 + u16_at(20)? as usize {
             return Err(invalid("too many entries or unsupported ZIP directory"));
         }
-        let mut zip = zip::ZipArchive::new(source).map_err(invalid)?;
+        // A design file is a ZIP with nothing in front of it. Saying so skips zip's search for a
+        // prefix, which reads back through the stored parts and would load a large embedded
+        // source before the preview can be shown.
+        let config = zip::read::Config { archive_offset: zip::read::ArchiveOffset::Known(0) };
+        let mut zip = zip::ZipArchive::with_config(config, source).map_err(invalid)?;
         if u16_at(4)? != 0
             || u16_at(6)? != 0
             || u16_at(8)? as usize != zip.len()
@@ -307,7 +311,7 @@ impl<R: Read + Seek> PackageReader<R> {
         let mut total = 0u64;
         for i in 0..zip.len() {
             let part = zip.by_index_raw(i).map_err(invalid)?;
-            let name = part.name();
+            let name = part.name().map_err(invalid)?.into_owned();
             if name.is_empty()
                 || name.contains('\\')
                 || name.split('/').any(|c| c.is_empty() || c == "." || c == "..")
@@ -768,7 +772,7 @@ mod tests {
         let doc = document();
         let preview = DesignPreview { meshes: vec![mesh()] };
         let bytes = write_design_container_with_preview(&doc, DesignCompression::Fast, Some(&preview)).unwrap();
-        let offset = zip::ZipArchive::new(Cursor::new(&bytes)).unwrap().by_name("document.json").unwrap().data_start() as usize;
+        let offset = zip::ZipArchive::new(Cursor::new(&bytes)).unwrap().by_name("document.json").unwrap().data_start().unwrap() as usize;
         let bytes = Rc::new(RefCell::new(bytes));
         let mut reader = DesignContainerReader::new(Shared { bytes: bytes.clone(), position: 0 }).unwrap();
         assert!(reader.preview().is_some());
@@ -850,7 +854,7 @@ mod tests {
         (0..zip.len())
             .map(|i| {
                 let mut entry = zip.by_index(i).unwrap();
-                let name = entry.name().to_owned();
+                let name = entry.name().unwrap().into_owned();
                 let mut bytes = Vec::new();
                 entry.read_to_end(&mut bytes).unwrap();
                 (name, bytes)

crates/io/src/threemf.rs

@@ -352,9 +352,9 @@ fn bad<T>(msg: impl Into<String>) -> Result<T> {
 
 fn read_part(zip: &mut zip::ZipArchive<Cursor<&[u8]>>, name: &str) -> Result<Option<Vec<u8>>> {
     let want = name.trim_start_matches('/').to_ascii_lowercase();
-    let Some(idx) =
+    let Some(idx) = (0..zip.len()).find(|i| {
-        (0..zip.len()).find(|i| zip.name_for_index(*i).is_some_and(|n| n.replace('\\', "/").trim_start_matches('/').to_ascii_lowercase() == want))
+        zip.name_for_index(*i).and_then(|n| n.ok()).is_some_and(|n| n.replace('\\', "/").trim_start_matches('/').to_ascii_lowercase() == want)
-    else {
+    }) else {
         return Ok(None);
     };
     let mut f = zip.by_index(idx).map_err(|e| IoError::Invalid(format!("3MF {name}: {e}")))?;

deny.toml

@@ -3,6 +3,14 @@
 # The nightly command downgrades only this diagnostic with --warn unmaintained.
 unmaintained = "all"
 yanked = "warn"
+# zip 8.6 comes only through cadmpeg-codec-freecad 0.6.1 (`zip = "^8"`); all three advisories
+# are in ZipArchive::extract / ZipStreamReader::extract, which neither it nor solidcraft-io
+# calls. Remove these when cadmpeg moves to zip 9.
+ignore = [
+    { id = "RUSTSEC-2026-0367", reason = "zip 8 via cadmpeg-codec-freecad; extract() is never called" },
+    { id = "RUSTSEC-2026-0368", reason = "zip 8 via cadmpeg-codec-freecad; extract() is never called" },
+    { id = "RUSTSEC-2026-0369", reason = "zip 8 via cadmpeg-codec-freecad; extract() is never called" },
+]
 
 [bans]
 multiple-versions = "warn"