fix(deps): clear the RustSec advisories blocking the audit gate

zip 8.6.0 -> 9.1.2 with default-features = false, features = ["deflate"]: ugoira frame zips are stored/deflate only, so the default codec set was dead weight — and its zstd 0.13 stack (RUSTSEC-2026-0391, -0395..-0406, -0410) has no fixed release inside zip <=9.0.0's ^0.13.3 pin. ctutils 0.4.2 (RUSTSEC-2026-0385) leaves with zip's aes-crypto feature. tokio 1.53.3 (RUSTSEC-2026-0386), rustls-webpki 0.103.16 (RUSTSEC-2026-0382), webpki-roots 1.0.10 (RUSTSEC-2026-0381). cargo audit on the new lock reports only the unmaintained dotenv (RUSTSEC-2021-0141) and proc-macro-error2 (RUSTSEC-2026-0173) warnings, which denyWarnings: false does not fail on. A new pixiv test pins that both stored and deflate ugoira frames decode with the reduced zip feature set.
2026-10-27 04:52:06 +00:00 · 2026-10-26 22:35:51 +08:00
parent 97b85a10ad
commit 5a76d4992a
3 changed files with 78 additions and 251 deletions
@@ -11,7 +11,11 @@ regex = "1.12"
 html-escape = "0.2"
 url = "2.5.2"
 bytes = "1"
-zip = "8"
+# ugoira frame zips are stored/deflate only; everything in zip's default
+# codec set (bzip2, lzma/xz, ppmd, aes, time, zstd) is dead weight here —
+# and zip <=9.0.0 pinned the zstd 0.13 stack that has no fixed release
+# (RUSTSEC-2026-039x/-041x), which is what kept the audit gate red.
+zip = { version = "9", default-features = false, features = ["deflate"] }
 tempfile = "3"
 thiserror = "2"
 rand = "0.10"
@@ -512,4 +512,53 @@ mod tests {
        assert!(check_ugoira_archive_size(1, MAX_UGOIRA_UNPACKED_BYTES).is_ok());
        assert!(check_ugoira_archive_size(1, MAX_UGOIRA_UNPACKED_BYTES + 1).is_err());
    }
+
+    /// The ugoira path reads frame zips with `zip`'s `deflate` feature only
+    /// (see the manifest comment); ugoira archives are stored/deflate, so both
+    /// must decode with the codecs the manifest leaves off.
+    #[test]
+    fn ugoira_frame_zip_decodes_with_the_selected_zip_features() {
+        let path = tempfile::Builder::new()
+            .prefix(crate::TEMP_FILE_PREFIX)
+            .tempfile()
+            .expect("temp zip");
+        let mut writer = zip::ZipWriter::new(std::fs::File::create(path.path()).expect("zip file"));
+        for (name, method, body) in [
+            (
+                "000001.jpg",
+                zip::CompressionMethod::Deflated,
+                &b"\xFF\xD8deflated frame"[..],
+            ),
+            (
+                "000002.jpg",
+                zip::CompressionMethod::Stored,
+                &b"\xFF\xD8stored frame"[..],
+            ),
+        ] {
+            writer
+                .start_file(
+                    name,
+                    zip::write::SimpleFileOptions::default().compression_method(method),
+                )
+                .expect("start entry");
+            std::io::Write::write_all(&mut writer, body).expect("write frame");
+        }
+        writer.finish().expect("finish zip");
+
+        let mut archive = zip::ZipArchive::new(std::fs::File::open(path.path()).expect("open zip"))
+            .expect("read zip");
+        assert_eq!(archive.len(), 2);
+        for (index, expected) in [
+            (0, &b"\xFF\xD8deflated frame"[..]),
+            (1, &b"\xFF\xD8stored frame"[..]),
+        ] {
+            let mut frame = Vec::new();
+            archive
+                .by_index(index)
+                .expect("frame entry")
+                .read_to_end(&mut frame)
+                .expect("decode frame");
+            assert_eq!(frame, expected, "frame {index}");
+        }
+    }
 }