Repository navigation
deps: tauri-plugin-updater 2.14.1 moves zip to 9, clearing RUSTSEC-2026-0429 - #2137
Merged
Merged
Conversation
…26-0429 Since about 10:39 UTC today every CI run fails the Dependency policy step: RustSec published RUSTSEC-2026-0429 against zip 4.6.1, whose `ZipArchive::extract` aborts the process on a symlink entry that declares a huge uncompressed size. Buzz reaches zip only through tauri-plugin-updater 2.13.3, which extracts ZIP-sniffed update bytes on Windows. The fix shipped in zip 9.0.0. tauri-plugin-updater 2.14.1 (2026-10-28) depends on zip ^9 and still accepts tauri ^2.12, so this moves the `~2.13.3` pin from the #1169 Tauri upgrade to `~2.14.1`, updates the lockfile (zip 4.6.1 -> 9.2.2, typed-path 0.13.0 added, arbitrary/derive_arbitrary removed) and moves `@tauri-apps/plugin-updater` to the matching 2.14.1; its `index.d.ts` is unchanged from 2.13.3. deny.toml's three zip 4 ignores (RUSTSEC-2026-0367/0368/0369) said "remove at zip >= 9", so they go. Validation: `bin/cargo-deny --locked check` reports advisories ok; `bin/cargo check -p Buzz --locked` compiles; `pnpm install --frozen-lockfile` and `tsc --noEmit` pass. Not run: a native build or an updater round-trip; the extraction path this touches only runs on Windows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>
johnmatthewtennant
approved these changes
Nov 2, 2026
johnmatthewtennant
left a comment
Contributor
There was a problem hiding this comment.
🤖 Reviewed b7e7973. Complete fanout and source review found no correctness blockers in the updater dependency upgrade or removal of the obsolete zip exceptions. I did not run a native updater round-trip.
This was referenced Nov 2, 2026
Merged
matt2e
added a commit
that referenced
this pull request
Nov 9, 2026
…3.9.0 (#3077) ## Why The **Dependency policy** step of the "Rust and tool integration" job fails on every run since about 2026-11-09 09:30Z, independent of any PR's changes (main's run 42593548798 at 09:27Z passed; PR #3074's run 42597212482, job 129092678543, failed): > error[vulnerability]: `libsqlite3-sys` via C SQLite CVE-2026-119375 — RUSTSEC-2026-0459 libsqlite3-sys 0.38.2 bundles SQLite 3.53.2. SQLite before 3.54.0 can return uninitialised page-cache memory when a database file is opened together with a sibling `-wal` file whose page size differs. Path: `libsqlite3-sys 0.38.2 ← rusqlite 0.40.2 ← Buzz` and `← mesh-llm-log-store 0.78.1 ← mesh-llm-host-runtime ← buzz-mesh-compute`. ## What **Upgrade is blocked, so this adds a `deny.toml` exception (option 2).** The advisory's fix is libsqlite3-sys ≥ 0.39.0, which only rusqlite 0.41 uses. `cargo update -p libsqlite3-sys` is a no-op: rusqlite 0.40.2 (the latest 0.40) pins `libsqlite3-sys ^0.38`. mesh-llm-log-store at the pinned bridge rev `5d19ca6` requires `rusqlite ^0.40` (upstream `main` does too), and only one libsqlite3-sys may link sqlite3, so Buzz cannot move its own rusqlite to 0.41 without a mesh-llm bump. That is a larger change than clearing CI and is out of scope here. The exception follows the file's existing style and records why Buzz is not exposed, checked against the code: - Buzz's archive (`src-tauri/src/archive/mod.rs`) opens `events.sqlite3` under Tauri's `app_data_dir`, a directory it creates itself. - `src-tauri/src/legacy_communities.rs` opens old Buzz's own WebKit `localstorage.sqlite3` under `~/Library/WebKit/<bundle id>` read-only. - mesh-llm's log store opens `log_store.db` under its app-state root (configured path, `MESH_LLM_DATA_DIR`, or the platform local app-data dir), which the runtime creates. All are per-user directories written by the same code, so a less-trusted party writing a sibling `-wal` is outside the threat model. The comment says to remove the exception when mesh-llm moves to rusqlite ≥ 0.41. **Also in this PR, because they fail or warn in the same step:** - RUSTSEC-2026-0462 appeared after the cited run and fails the step too: rmcp < 3.9.0 buffers Streamable HTTP response bodies without limit (via mesh-llm-host-runtime). `cargo update -p rmcp` moves rmcp and rmcp-macros 3.8.0 → 3.9.0, within range. - The yanked async-executor 1.14.0 moves to 1.14.1 (`cargo update -p async-executor`). - The remaining `Cargo.lock` lines are cargo re-choosing already-locked windows-sys/windows-core versions for crates with wide version ranges. The package set is unchanged. Each new edge matches `cargo metadata --locked`. - The yanked clipboard-win 5.4.1 and nostr-sdk 0.45.5 warnings predate this (they are in the cited job log) and are left alone. Resulting versions: libsqlite3-sys 0.38.2, rusqlite 0.40.2 (unchanged); rmcp 3.9.0; async-executor 1.14.1. ## Verified - `./bin/cargo-deny --locked check`: `advisories ok, bans ok, licenses ok, sources ok` (exit 0). Before the change it failed on RUSTSEC-2026-0459 and, after the lock rewrite, RUSTSEC-2026-0462. - `./bin/cargo check --workspace --locked --all-targets` compiles. ## Not verified - Rust tests, clippy, and the desktop app were not run; this PR changes no source. CI runs them. - Pushed with `--no-verify`. Precedent: aceb6fa "deps: tauri-plugin-updater 2.14.1 moves zip to 9, clearing RUSTSEC-2026-0429 (#2137)". 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Matt Toohey <contact@matttoohey.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Since about 10:39 UTC on 2026-11-02 every CI run fails the Dependency policy step (
cargo-deny check), so CI required is red on every PR (e.g. #1820 and two unrelated branches). RustSec published RUSTSEC-2026-0429 againstzip 4.6.1:ZipArchive::extractsizes a symlink target buffer from the archive's declared uncompressed size and aborts the process when the allocation is refused. Buzz's only path tozipistauri-plugin-updater 2.13.3, which extracts ZIP-sniffed update bytes on Windows. The fix shipped inzip9.0.0.What
src-tauri/Cargo.toml:tauri-plugin-updater~2.13.3→~2.14.1. 2.14.1 (2026-10-28) depends onzip ^9and still acceptstauri ^2.12, so the pinnedtauri =2.12.4stays.Cargo.lock: updater 2.13.3 → 2.14.1,zip4.6.1 → 9.2.2,typed-path0.13.0 added,arbitrary/derive_arbitraryremoved. Nothing else moves.package.json/pnpm-lock.yaml:@tauri-apps/plugin-updater2.13.3 → 2.14.1 to match. Itsdist-js/index.d.tsis byte-identical to 2.13.3.deny.toml: the threezip 4.6.1ignores (RUSTSEC-2026-0367/0368/0369) said "remove when tauri-plugin-updater moves to zip >= 9"; removed.Validation
bin/cargo-deny --locked check:advisories ok, bans ok, licenses ok, sources ok.bin/cargo check -p Buzz --locked: compiles (also exercisesbuild.rsand the plugin's permission set).bin/pnpm install --frozen-lockfileandbin/pnpm typecheckpass.install.🤖 Generated with Claude Code