From 3977a0b63094b00ed708fd4145d3e67f8d0cb4a5 Mon Sep 17 00:00:00 2001
From: jyviko <2501648+jyviko@users.noreply.github.com>
Date: Fri, 16 Oct 2026 21:44:41 -0400
Subject: [PATCH] deps: zip 9.0.4; ignore the zip 3 extract advisories that
 come through solidcraft-io

RUSTSEC-2026-0367/0368/0369 are in ZipArchive::extract and
ZipStreamReader::extract. Our zip 9 is updated to the fixed 9.0.4. zip 3
comes only through the pinned solidcraft-io, which never calls extract
(3MF parts are read by name), so the three are ignored with that reason
until SolidCraft moves to a fixed zip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo
---
 Cargo.lock | 12 ++++++------
 deny.toml  |  9 +++++++++
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 606c60b..e28a2e2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1327,7 +1327,7 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror 2.0.21",
- "zip 9.0.3",
+ "zip 9.0.4",
 ]
 
 [[package]]
@@ -1363,7 +1363,7 @@ dependencies = [
  "solidcraft-io",
  "solidcraft-kernel",
  "thiserror 2.0.21",
- "zip 9.0.3",
+ "zip 9.0.4",
 ]
 
 [[package]]
@@ -1388,7 +1388,7 @@ dependencies = [
  "serde_json",
  "sha2 0.11.1",
  "thiserror 2.0.21",
- "zip 9.0.3",
+ "zip 9.0.4",
 ]
 
 [[package]]
@@ -1512,7 +1512,7 @@ dependencies = [
  "tar",
  "thiserror 2.0.21",
  "ureq",
- "zip 9.0.3",
+ "zip 9.0.4",
 ]
 
 [[package]]
@@ -5563,9 +5563,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "9.0.3"
+version = "9.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2d98561b612a84ae525331a7a094429ef8a5772514ed507ff6db5f54badc971"
+checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
 dependencies = [
  "crc32fast",
  "flate2",
diff --git a/deny.toml b/deny.toml
index 148f6f2..f7d468f 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,6 +1,15 @@
 [advisories]
 unmaintained = "all"
 yanked = "warn"
+# zip 3 comes only through solidcraft-io (pinned rev, still on zip 3; our own zip is 9.0.4,
+# which is fixed). All three are in `ZipArchive::extract` / `ZipStreamReader::extract`, which
+# neither FieldCraft nor solidcraft-io calls: 3MF parts are read by name into memory. Drop these
+# once SolidCraft moves to a fixed zip.
+ignore = [
+    { id = "RUSTSEC-2026-0367", reason = "zip 3 via solidcraft-io; extract() is never called" },
+    { id = "RUSTSEC-2026-0368", reason = "zip 3 via solidcraft-io; extract() is never called" },
+    { id = "RUSTSEC-2026-0369", reason = "zip 3 via solidcraft-io; extract() is never called" },
+]
 
 [bans]
 multiple-versions = "warn"