fix(security): take memf-windows 0.5 to reach the patched yara-x and wasmtime

[h4x0r]

fix(security): take memf-windows 0.5 to reach the patched yara-x and wasmtime

memory-forensic published the security fixes today; this picks them up. Under
--features memory the advisory count on this repo's dependency stack drops
from 20 to 2.

memf-windows ^0.3 -> ^0.5 (0.5.0 requires yara-x ~1.7, was ^0.12)
memf-core unchanged (^0.2 already admits the published 0.2.6)
memf-format unchanged (^0.3 already admits 0.3.2)

Only memf-windows needed a manifest change. It went 0.4 -> 0.5 upstream because
pub fn scan_yara takes &yara_x::Rules across the API boundary, so the yara-x
major move is breaking for callers and a caret cannot cross it. The others moved
within their existing carets, which is why cargo update alone was not enough
and a lockfile refresh alone would have silently done nothing.

Resulting graph: yara-x 1.7.1, wasmtime 36.0.13 (patched for
GHSA-hgjw-h833-99q9 and five siblings), lru 0.18.2.

The three yara-x companion crates are pinned in the lock to 1.7.1. yara-x
declares them ^1.7.1, which permits 1.19, and 1.19's yara-x-proto REMOVED a
field 1.7.1's build.rs uses (ModuleOptions.rust_module) — an upstream semver
break. Without the pins this workspace does not compile. A cargo update will
unpin them and break the build loudly rather than silently, which is the
tolerable failure mode.

The two advisories that remain are unfixable here and identical to the ones
argued in memory-forensic: RUSTSEC-2023-0071 (rsa Marvin Attack) and
RUSTSEC-2025-0141 (bincode unmaintained), both carrying patched = [], both
reached only through yara-x. They are NOT suppressed in this commit, because
this repo's cargo-deny gate does not see them at all — see below.

Verified: cargo check --workspace --all-features --all-targets clean.

NOT FIXED HERE, and worth its own change: the memory feature is opt-in
(default = []), so CI's cargo-deny run never resolves it. cargo deny check
reports 0 errors on this repo while cargo deny --features memory check
reported 42 on main and 30 here. The gate has never looked at a shipped
capability. Closing that needs deny-args: --features memory plus two licence
entries — Apache-2.0 WITH LLVM-exception (28 of the 29 rejections; permissive,
already allowed in memory-forensic) and a clarification for array-bytes 9.3.0,
whose deprecated Apache-2.0/GPL-3.0 form means OR, and we take Apache-2.0.
Doing that here would turn a green check red inside a dependency bump.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	forensic-vfs@​0.7.2
	forensic-vfs-resolver@​0.3.2
	archive-core@​0.1.3 ⏵ 0.1.6
	forensic-vfs-engine@​0.1.7 ⏵ 0.1.10
	memf-core@​0.2.3 ⏵ 0.2.6
	memf-linux@​0.3.1 ⏵ 0.3.3
	memf-session@​0.3.1 ⏵ 0.3.3
	memf-symbols@​0.2.3 ⏵ 0.2.4
	memf-windows@​0.3.1 ⏵ 0.5.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo lzma-rust2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/memf-windows@0.5.0 → cargo/lzma-rust2@0.13.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lzma-rust2@0.13.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report