YoursFunny/TelegramTwitterMediaBot
1
0
Fork 0
mirror of https://github.com/TheFunny/TelegramTwitterMediaBot.git synced 2026-10-27 04:52:06 +00:00
Code Releases Activity

fix(deps): clear the RustSec advisories blocking the audit gate

Browse Source 
zip 8.6.0 -> 9.1.2 with default-features = false, features = ["deflate"]: ugoira frame zips are stored/deflate only, so the default codec set was dead weight — and its zstd 0.13 stack (RUSTSEC-2026-0391, -0395..-0406, -0410) has no fixed release inside zip <=9.0.0's ^0.13.3 pin. ctutils 0.4.2 (RUSTSEC-2026-0385) leaves with zip's aes-crypto feature.

tokio 1.53.3 (RUSTSEC-2026-0386), rustls-webpki 0.103.16 (RUSTSEC-2026-0382), webpki-roots 1.0.10 (RUSTSEC-2026-0381).

cargo audit on the new lock reports only the unmaintained dotenv (RUSTSEC-2021-0141) and proc-macro-error2 (RUSTSEC-2026-0173) warnings, which denyWarnings: false does not fail on. A new pixiv test pins that both stored and deflate ugoira frames decode with the reduced zip feature set.
This commit is contained in:
YoursFunny
2026-10-26 22:35:51 +08:00
parent 97b85a10ad
commit 5a76d4992a
3 changed files with 78 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/x-media/Cargo.toml
+5 -1
View File
@@ -11,7 +11,11 @@ regex = "1.12"
html-escape = "0.2"
url = "2.5.2"
bytes = "1"
zip = "8"
# ugoira frame zips are stored/deflate only; everything in zip's default
# codec set (bzip2, lzma/xz, ppmd, aes, time, zstd) is dead weight here —
# and zip <=9.0.0 pinned the zstd 0.13 stack that has no fixed release
# (RUSTSEC-2026-039x/-041x), which is what kept the audit gate red.
zip = { version = "9", default-features = false, features = ["deflate"] }
tempfile = "3"
thiserror = "2"
rand = "0.10"