Update Rust crate zip to v9 [SECURITY] #6
Open
renovate-bot
wants to merge 1 commit from
renovate/crate-zip-vulnerability into main
pull from: renovate/crate-zip-vulnerability
merge into: Evobug:main
Evobug:main
Evobug:renovate/npm-pnpm-vulnerability
Evobug:renovate/crate-rtrb-vulnerability
Evobug:renovate/crate-cxx-vulnerability
Evobug:renovate/crate-anyhow-vulnerability
Evobug:mickle/deps-dedupe-2026-10
Evobug:mickle/m150
Evobug:fix/voice-rtc-error-decoding-20260907
Evobug:nvenc-windows
Evobug:dc/exp/jetson_nvmm
Evobug:dc/feature/user_timestamp
Evobug:theo/device-info
Evobug:dc/sensor_capture_timestamp
Evobug:sxian/CLT-2692/improve-peer-connection-tests
Evobug:dc/nvenc_debug
Evobug:ladvoc/prost-upgrade
Evobug:knope/temp-a8be7264-d069-4e3c-b539-d3c54e8dfb90
Evobug:sxian/CLT-2618/changing_3_packets_to_1_packet_in_data_stream
Evobug:revert-733-duan/fix-linux-so-link-issue
Evobug:binhpham/uniffi-wakeword
Evobug:mike/rust_latency_measurement_example
Evobug:sxian/rust_latency_measurement_example
Evobug:lukas/test-knope
Evobug:dc/rockchip_encoder
Evobug:sxian/CLT-2585/avoid_offer_answer_races
Evobug:dc/jetson_encoder
Evobug:theo/dynamic-webrtc
Evobug:sxian/CLT-2534/add_compression_to_rpc_with_backward_compatibility
Evobug:theo/fix-complaints
Evobug:theo/no-verify
Evobug:dc/feature/low_latency
Evobug:dc/pi_encoder
Evobug:dc/user_timestamp_2
Evobug:copilot/add-event-listener-example
Evobug:dc/passthru_simulcast
Evobug:dc/passthru
Evobug:sxian/CLT-2533/update_livekit_models
Evobug:theo/h264-ingest
Evobug:ladvoc/copyright-year-2026
Evobug:ladvoc/uniffi-tier3-panic
Evobug:jacobgelman/clt-2513-allow-rpc-registration-before-room-connection
Evobug:jacobgelman/clt-2512-mark-vendored-dependencies
Evobug:ladvoc/data-tracks
Evobug:blaze/fix-uniffi-headers
Evobug:ladvoc/doc-examples
Evobug:ladvoc/build-test
Evobug:ladvoc/ffi-perf
Evobug:dc/jetson_nvenc
Evobug:dc/nvenc_h265_test
Evobug:dc/user_timestamp
Evobug:ladvoc/nextest
Evobug:dc/jetson_pipeline
Evobug:dc/jetson_pipeline2
Evobug:dc/jetson_exp2
Evobug:dc/jetson_exp
Evobug:ladvoc/participant-state
Evobug:dc/nvenc_simulcast_exp
Evobug:ladvoc/uniffi-resampler
Evobug:dc/fps_debug
Evobug:ladvoc/yuv-optimize
Evobug:ladvoc/ffi-metrics
Evobug:dc/local_camera
Evobug:dc/local_camera_exp1
Evobug:ladvoc/stream-dump
Evobug:duan/uniffi-bindgen-for-csharp
Evobug:rg/uniffi-typescript
Evobug:ladvoc/core-token
Evobug:ladvoc/build-754
Evobug:token-source
Evobug:ladvoc/cdylib-load-test
Evobug:ladvoc/test-room-options
Evobug:ladvoc/gen-protocol-fix
Evobug:ladvoc/participant-active
Evobug:typester/libwebrtc-update
Evobug:typester/release-plz-webrtc-sys
Evobug:theo/fix-win
Evobug:typester/fast-publish
Evobug:shubhra/sample-logs
Evobug:feat/metrics
Evobug:ladvoc/aec-dump
Evobug:feat/forward-participant
Evobug:typester/cleanup-changeset
Evobug:typester/ws-http-proxy-release
Evobug:typester/leak-test
Evobug:theo/bump-manylinux
Evobug:typester/fix-changeset
Evobug:theo/fix-yuv-path
Evobug:nbsp/add/wgpu-screenshare
Evobug:duan/aec3-experimental
Evobug:typester/fix-cpu-leak
Evobug:bcherry/nanpa-folders
Evobug:nbsp/fix/screenshare
Evobug:nbsp/add/fast-publish
Evobug:bcherry/android
Evobug:bcherry/clippy
Evobug:bcherry/rpc
Evobug:bcherry/disable-failing
Evobug:theo/expose-buffer-size
Evobug:theo/fix-timestamps
Evobug:nbsp/worktree/bssl-windows
Evobug:nbsp/fix/race
Evobug:update-protocol
Evobug:theo/audio-resampler
Evobug:theo/fix-events-race
Evobug:duan/fix-build-for-msvc
Evobug:theo/dylib
Evobug:theo/openssl
Evobug:theo/test-symbols
Evobug:theo/unused-code
Evobug:theo/fix-videobuffer
Evobug:theo/audio-ts
Evobug:theo/uwp
Evobug:theo/mediadevices
No reviewers
Labels
Clear labels
bug
Something isn't working
documentation
Improvements or additions to documentation
duplicate
This issue or pull request already exists
enhancement
New feature or request
good first issue
Good for newcomers
help wanted
Extra attention is needed
invalid
This doesn't seem right
question
Further information is requested
wontfix
This will not be worked on
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
Evobug/rust-sdks!6
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/crate-zip-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
0.6→9.0Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
GHSA-vv5m-jxxh-4627 / RUSTSEC-2026-0367
More information
Details
The
zipcrate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIPexternal_attributesduring extraction, instead of masking them to safe permission bits. If a privileged process (for example,rootin an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive usingZipArchive::extract()or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
zip:
ZipArchive::extractcreates symbolic links whose attacker-controlled targets are outside the destination directoryGHSA-4v9h-p7m9-rh26 / RUSTSEC-2026-0368
More information
Details
In
zip9.0.0-pre2,ZipArchive::extractcreates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an attacker-chosen path outside it. This behavior was verified on macOS and Linux. On either platform, a subsequent application read or write through that extracted entry accesses the external target with the extracting process's permissions.For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26
Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
GHSA-4684-h2q9-2vcp / RUSTSEC-2026-0369
More information
Details
ZipStreamReader::extract()applies Unix permissions through extracted symlinks without validating the symlink target stays within the destinationFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HReferences
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Configuration
📅 Schedule: (in timezone Europe/Prague)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.