mirror of
https://github.com/TheFunny/TelegramTwitterMediaBot.git
synced 2026-10-27 04:52:06 +00:00
YoursFunny
5a76d4992a
zip 8.6.0 -> 9.1.2 with default-features = false, features = ["deflate"]: ugoira frame zips are stored/deflate only, so the default codec set was dead weight — and its zstd 0.13 stack (RUSTSEC-2026-0391, -0395..-0406, -0410) has no fixed release inside zip <=9.0.0's ^0.13.3 pin. ctutils 0.4.2 (RUSTSEC-2026-0385) leaves with zip's aes-crypto feature. tokio 1.53.3 (RUSTSEC-2026-0386), rustls-webpki 0.103.16 (RUSTSEC-2026-0382), webpki-roots 1.0.10 (RUSTSEC-2026-0381). cargo audit on the new lock reports only the unmaintained dotenv (RUSTSEC-2021-0141) and proc-macro-error2 (RUSTSEC-2026-0173) warnings, which denyWarnings: false does not fail on. A new pixiv test pins that both stored and deflate ugoira frames decode with the reduced zip feature set.
28 lines
902 B
TOML
28 lines
902 B
TOML
[package]
|
|
name = "x-media"
|
|
version = "1.9.2"
|
|
edition = "2024"
|
|
|
|
[dependencies]
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "gzip", "http2"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
regex = "1.12"
|
|
html-escape = "0.2"
|
|
url = "2.5.2"
|
|
bytes = "1"
|
|
# ugoira frame zips are stored/deflate only; everything in zip's default
|
|
# codec set (bzip2, lzma/xz, ppmd, aes, time, zstd) is dead weight here —
|
|
# and zip <=9.0.0 pinned the zstd 0.13 stack that has no fixed release
|
|
# (RUSTSEC-2026-039x/-041x), which is what kept the audit gate red.
|
|
zip = { version = "9", default-features = false, features = ["deflate"] }
|
|
tempfile = "3"
|
|
thiserror = "2"
|
|
rand = "0.10"
|
|
log = "0.4"
|
|
tokio = { version = "1.40", features = ["time", "rt", "fs"] }
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1.40", features = ["macros", "rt-multi-thread"] }
|
|
dotenv = "0.15"
|