1b-agent/OneCAD-Simulation
1
0 Fork 0
forked from 1b-agent/fieldcraft-upstream
Code Pull Requests Activity

deps: zip 9.0.4; ignore the zip 3 extract advisories that come through solidcraft-io

Browse Source 
RUSTSEC-2026-0367/0368/0369 are in ZipArchive::extract and
ZipStreamReader::extract. Our zip 9 is updated to the fixed 9.0.4. zip 3
comes only through the pinned solidcraft-io, which never calls extract
(3MF parts are read by name), so the three are ignored with that reason
until SolidCraft moves to a fixed zip.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo
This commit is contained in:
jyvikoandClaude Opus 5.5 authored and Irakli Kourtis committed 2026-10-17 00:50:21 -04:00
1 parent ec8e165fbb
commit 3977a0b630
2 files changed
+15 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deny.toml
+9
View File
@@ -1,6 +1,15 @@
[advisories]
unmaintained = "all"
yanked = "warn"
# zip 3 comes only through solidcraft-io (pinned rev, still on zip 3; our own zip is 9.0.4,
# which is fixed). All three are in `ZipArchive::extract` / `ZipStreamReader::extract`, which
# neither FieldCraft nor solidcraft-io calls: 3MF parts are read by name into memory. Drop these
# once SolidCraft moves to a fixed zip.
ignore = [
{ id = "RUSTSEC-2026-0367", reason = "zip 3 via solidcraft-io; extract() is never called" },
{ id = "RUSTSEC-2026-0368", reason = "zip 3 via solidcraft-io; extract() is never called" },
{ id = "RUSTSEC-2026-0369", reason = "zip 3 via solidcraft-io; extract() is never called" },
]
[bans]
multiple-versions = "warn"