Repository navigation
deps: move webdriver-downloader, csvs_convert and spreadsheet-ods to zip 9 - #4828
Merged
Merged
Conversation
…zip 9 zip-rs yanked every zip release before 9.0.3 over security advisories (zip-rs/zip2#1075: GHSA-vv5m-jxxh-4627, GHSA-4v9h-p7m9-rh26, GHSA-4684-h2q9-2vcp, with more due this month), so a fresh `cargo update` can no longer resolve `zip = "^8"`. - webdriver-downloader: patch to our fork (zip 9 + an extract_zip test), pending ik1ne/webdriver-downloader#67. Pinned by rev; it is semver-breaking upstream, so expect 0.18.0. - csvs_convert, spreadsheet-ods: re-lock our fork branches, now on zip 9. calamine, rust_xlsxwriter, self_update (and plotly_static's unused build-dependency) still require zip 8; none calls the vulnerable extract() APIs. Their upstream zip 9 bumps are in progress. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Up to standards ✅🟢 Issues
|
zip-rs yanks all but the latest release, so stay on the newest. 9.0.4 fixes `enclosed_name` for separators inside a verbatim path component and returns `Ok(None)` for read_zipfile_from_stream on an empty archive; it also pulls lzma-rust2 0.21 -> 0.22. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
zip-rs has yanked every
ziprelease except 9.0.3 because of security advisories (zip-rs/zip2#1075): GHSA-vv5m-jxxh-4627, GHSA-4v9h-p7m9-rh26 and GHSA-4684-h2q9-2vcp, with more due later this month. As a result, a freshcargo updatefails:failed to select a version for the requirement zip = "^8".What
[patch.crates-io]to our fork (zip 9 + anextract_zipunit test), pinned by rev, pending ik1ne/webdriver-downloader#67. That bump is semver-breaking upstream (ZipErroris in its public API), so expect 0.18.0, and update the[dependencies]requirement when dropping the patch.Still on zip 8
cargo updatestays blocked until these crates move:excel): upstream PR chore(deps): upgrade zip to 9.0 tafia/calamine#741zipsign-api(fix(deps): update zip crate jaemk/self_update#214)build.rs(build(deps): update zip requirement from 8.0 to 9.0 plotly/plotly.rs#441)None of the three published advisories reaches qsv. They all concern
ZipArchive::extract()/ZipStreamReader::extract(), which none of these crates calls. self_update has its own extraction loop that already masks to0o777and rejects escaping symlinks. The unpublished advisories are unknown, so calamine (which reads untrusted.xlsx) is the one to watch.Testing
cargo test -F all_features test_to:: test_excel::: 39 + 62 passedcargo check --bin qsv -F all_features: cleanviz_staticignored suite: 1 passed / 10 failed locally, identical on unmodified master (local Chrome/chromedriver mismatch, "Failed to extract static image from browser session").rust-viz-static.ymlCI provisions Chrome.🤖 Generated with Claude Code