1b-agent/OneCAD-Simulation
1
0 Fork 0
forked from 1b-agent/fieldcraft-upstream
Code Pull Requests Activity

deps: zip 9.0.4; ignore the zip 3 extract advisories that come through solidcraft-io

Browse Source 
RUSTSEC-2026-0367/0368/0369 are in ZipArchive::extract and
ZipStreamReader::extract. Our zip 9 is updated to the fixed 9.0.4. zip 3
comes only through the pinned solidcraft-io, which never calls extract
(3MF parts are read by name), so the three are ignored with that reason
until SolidCraft moves to a fixed zip.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo
This commit is contained in:
jyvikoandClaude Opus 5.5 authored and Irakli Kourtis committed 2026-10-17 00:50:21 -04:00
1 parent ec8e165fbb
commit 3977a0b630
2 files changed
+15 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Cargo.lock
Generated
+6 -6
View File
@@ -1327,7 +1327,7 @@ dependencies = [
"serde", "serde",
"serde_json", "serde_json",
"thiserror 2.0.21", "thiserror 2.0.21",
"zip 9.0.3", "zip 9.0.4",
] ]
[[package]] [[package]]
@@ -1363,7 +1363,7 @@ dependencies = [
"solidcraft-io", "solidcraft-io",
"solidcraft-kernel", "solidcraft-kernel",
"thiserror 2.0.21", "thiserror 2.0.21",
"zip 9.0.3", "zip 9.0.4",
] ]
[[package]] [[package]]
@@ -1388,7 +1388,7 @@ dependencies = [
"serde_json", "serde_json",
"sha2 0.11.1", "sha2 0.11.1",
"thiserror 2.0.21", "thiserror 2.0.21",
"zip 9.0.3", "zip 9.0.4",
] ]
[[package]] [[package]]
@@ -1512,7 +1512,7 @@ dependencies = [
"tar", "tar",
"thiserror 2.0.21", "thiserror 2.0.21",
"ureq", "ureq",
"zip 9.0.3", "zip 9.0.4",
] ]
[[package]] [[package]]
@@ -5563,9 +5563,9 @@ dependencies = [
[[package]] [[package]]
name = "zip" name = "zip"
version = "9.0.3" version = "9.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2d98561b612a84ae525331a7a094429ef8a5772514ed507ff6db5f54badc971" checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
dependencies = [ dependencies = [
"crc32fast", "crc32fast",
"flate2", "flate2",
deny.toml
+9
View File
@@ -1,6 +1,15 @@
[advisories] [advisories]
unmaintained = "all" unmaintained = "all"
yanked = "warn" yanked = "warn"
# zip 3 comes only through solidcraft-io (pinned rev, still on zip 3; our own zip is 9.0.4,
# which is fixed). All three are in `ZipArchive::extract` / `ZipStreamReader::extract`, which
# neither FieldCraft nor solidcraft-io calls: 3MF parts are read by name into memory. Drop these
# once SolidCraft moves to a fixed zip.
ignore = [
{ id = "RUSTSEC-2026-0367", reason = "zip 3 via solidcraft-io; extract() is never called" },
{ id = "RUSTSEC-2026-0368", reason = "zip 3 via solidcraft-io; extract() is never called" },
{ id = "RUSTSEC-2026-0369", reason = "zip 3 via solidcraft-io; extract() is never called" },
]
[bans] [bans]
multiple-versions = "warn" multiple-versions = "warn"