From 5bd409c3b38c66ae6d5d20c838e8c2750183d84f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 20:05:32 +0000 Subject: [PATCH 1/3] build(deps): bump the rust-dependencies group across 1 directory with 3 updates Bumps the rust-dependencies group with 3 updates in the / directory: [base64](https://github.com/marshallpierce/rust-base64), [ureq](https://github.com/algesten/ureq) and [zip](https://github.com/zip-rs/zip2). Updates `base64` from 0.22.1 to 0.23.1 - [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md) - [Commits](https://github.com/marshallpierce/rust-base64/compare/v0.22.1...v0.23.1) Updates `ureq` from 3.3.0 to 3.4.0 - [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md) - [Commits](https://github.com/algesten/ureq/compare/3.3.0...3.4.0) Updates `zip` from 6.0.0 to 8.6.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v6.0.0...v8.6.0) --- updated-dependencies: - dependency-name: base64 dependency-version: 0.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: ureq dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] --- Cargo.lock | 51 +++++++++------------------------------------------ Cargo.toml | 6 +++--- 2 files changed, 12 insertions(+), 45 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3273437..53ee699 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -120,15 +120,6 @@ dependencies = [ "security-framework", ] -[[package]] -name = "arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "assert_cmd" version = "2.2.2" @@ -431,7 +422,7 @@ name = "cargo-ferry" version = "0.1.0" dependencies = [ "assert_cmd", - "base64 0.22.1", + "base64 0.23.1", "camino", "cap-std", "clap", @@ -654,17 +645,6 @@ version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" -[[package]] -name = "derive_arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.119", -] - [[package]] name = "difflib" version = "0.4.0" @@ -1956,7 +1936,7 @@ dependencies = [ "tempfile", "thiserror 2.0.20", "uuid", - "zip 8.6.0", + "zip", ] [[package]] @@ -2034,7 +2014,7 @@ dependencies = [ "unicode-normalization", "ureq", "windows-sys 0.61.2", - "zip 6.0.0", + "zip", ] [[package]] @@ -2059,14 +2039,14 @@ dependencies = [ "unicode-normalization", "url", "uuid", - "zip 6.0.0", + "zip", ] [[package]] name = "rustferry-ssh" version = "0.1.0" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "camino", "libc", "rustferry-core", @@ -2104,7 +2084,7 @@ dependencies = [ "toml", "unicode-normalization", "uuid", - "zip 6.0.0", + "zip", ] [[package]] @@ -2734,11 +2714,11 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" [[package]] name = "ureq" -version = "3.3.0" +version = "3.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0" +checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "log", "percent-encoding", "rustls", @@ -3289,19 +3269,6 @@ dependencies = [ "syn 2.0.119", ] -[[package]] -name = "zip" -version = "6.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eb2a05c7c36fde6c09b08576c9f7fb4cda705990f73b58fe011abf7dfb24168b" -dependencies = [ - "arbitrary", - "crc32fast", - "flate2", - "indexmap", - "memchr", -] - [[package]] name = "zip" version = "8.6.0" diff --git a/Cargo.toml b/Cargo.toml index 90899ec..2e2b9a1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -26,7 +26,7 @@ keywords = ["rust", "mobile", "android", "ios", "slint"] categories = ["command-line-utilities", "development-tools::build-utils", "gui"] [workspace.dependencies] -base64 = "0.22.1" +base64 = "0.23.1" camino = { version = "1.1.10", features = ["serde1"] } cap-std = "4.0.2" clap = { version = "4.5.40", features = ["derive", "env", "wrap_help"] } @@ -55,7 +55,7 @@ thiserror = "2.0.12" toml = "1.1.4" url = { version = "2.5.4", features = ["serde"] } unicode-normalization = "0.1.25" -ureq = { version = "=3.3.0", default-features = false, features = ["rustls"] } +ureq = { version = "=3.4.0", default-features = false, features = ["rustls"] } uuid = { version = "1.17.0", features = ["serde", "v4"] } windows-sys = { version = "0.61.2", features = [ "Wdk_Storage_FileSystem", @@ -70,7 +70,7 @@ windows-sys = { version = "0.61.2", features = [ "Win32_System_SystemServices", "Win32_System_Threading", ] } -zip = { version = "6.0.0", default-features = false, features = ["deflate-flate2-zlib-rs"] } +zip = { version = "8.6.0", default-features = false, features = ["deflate-flate2-zlib-rs"] } [workspace.lints.rust] unsafe_code = "deny" From baf856c0a6f1f82a49b56726b9058dca99ffb9fa Mon Sep 17 00:00:00 2001 From: ShiroKSH Date: Thu, 13 Aug 2026 00:01:53 +0300 Subject: [PATCH 2/3] fix(github): handle optional zip data offsets --- crates/rustferry-github/src/artifact.rs | 12 ++++++++---- crates/rustferry-github/src/artifact_offline.rs | 10 +++++----- crates/rustferry-github/src/artifact_store.rs | 6 ++++-- 3 files changed, 17 insertions(+), 11 deletions(-) diff --git a/crates/rustferry-github/src/artifact.rs b/crates/rustferry-github/src/artifact.rs index 04df36a..2025802 100644 --- a/crates/rustferry-github/src/artifact.rs +++ b/crates/rustferry-github/src/artifact.rs @@ -939,14 +939,16 @@ fn scan_archive( if !header_starts.insert(entry.header_start()) { return Err(GithubArtifactError::LinkedOrSpecialEntry); } - let data_end = entry + let data_start = entry .data_start() + .ok_or(GithubArtifactError::InvalidArchive)?; + let data_end = data_start .checked_add(entry.compressed_size()) .ok_or(GithubArtifactError::InvalidArchive)?; if data_end > archive_size { return Err(GithubArtifactError::InvalidArchive); } - compressed_ranges.push((entry.data_start(), data_end)); + compressed_ranges.push((data_start, data_end)); expanded_size = expanded_size .checked_add(entry.size()) .ok_or(GithubArtifactError::ExpandedArchiveTooLarge)?; @@ -1784,14 +1786,16 @@ fn inspect_signed_tree_zip( if !header_starts.insert(entry.header_start()) { return Err(GithubArtifactError::InvalidProductArchive(artifact)); } - let data_end = entry + let data_start = entry .data_start() + .ok_or(GithubArtifactError::InvalidProductArchive(artifact))?; + let data_end = data_start .checked_add(entry.compressed_size()) .ok_or(GithubArtifactError::InvalidProductArchive(artifact))?; if data_end > archive_size { return Err(GithubArtifactError::InvalidProductArchive(artifact)); } - compressed_ranges.push((entry.data_start(), data_end)); + compressed_ranges.push((data_start, data_end)); if let (Some(wrapper_root), Some(wrapper_prefix)) = (wrapper_root, wrapper_prefix.as_deref()) { diff --git a/crates/rustferry-github/src/artifact_offline.rs b/crates/rustferry-github/src/artifact_offline.rs index 8f84519..a568b32 100644 --- a/crates/rustferry-github/src/artifact_offline.rs +++ b/crates/rustferry-github/src/artifact_offline.rs @@ -603,19 +603,19 @@ fn scan_zip( } register_zip_path(&portable_name, entry.is_dir(), &mut files, &mut directories)?; validate_zip_metadata(&entry)?; - if entry.header_start() >= entry.data_start() || entry.data_start() > archive_size { + let data_start = entry.data_start().ok_or(OfflineArtifactError::InvalidZip)?; + if entry.header_start() >= data_start || data_start > archive_size { return Err(OfflineArtifactError::InvalidZip); } - let end = entry - .data_start() + let end = data_start .checked_add(entry.compressed_size()) .ok_or(OfflineArtifactError::InvalidZip)?; if end > archive_size { return Err(OfflineArtifactError::InvalidZip); } - ranges.push((entry.header_start(), entry.data_start())); + ranges.push((entry.header_start(), data_start)); if entry.compressed_size() != 0 { - ranges.push((entry.data_start(), end)); + ranges.push((data_start, end)); } expanded_size = expanded_size .checked_add(entry.size()) diff --git a/crates/rustferry-github/src/artifact_store.rs b/crates/rustferry-github/src/artifact_store.rs index f509b31..c6a961d 100644 --- a/crates/rustferry-github/src/artifact_store.rs +++ b/crates/rustferry-github/src/artifact_store.rs @@ -779,14 +779,16 @@ fn scan_unsigned_envelope( if !header_starts.insert(entry.header_start()) { return Err(GithubArtifactStoreError::InvalidUnsignedEnvelope); } - let data_end = entry + let data_start = entry .data_start() + .ok_or(GithubArtifactStoreError::InvalidUnsignedEnvelope)?; + let data_end = data_start .checked_add(entry.compressed_size()) .ok_or(GithubArtifactStoreError::InvalidUnsignedEnvelope)?; if data_end > archive_size { return Err(GithubArtifactStoreError::InvalidUnsignedEnvelope); } - compressed_ranges.push((entry.data_start(), data_end)); + compressed_ranges.push((data_start, data_end)); expanded_size = expanded_size .checked_add(entry.size()) .ok_or(GithubArtifactStoreError::InvalidUnsignedEnvelope)?; From c7845cd264d4d38772d26339fe67e61ef6363b6f Mon Sep 17 00:00:00 2001 From: ShiroKSH Date: Thu, 13 Aug 2026 00:07:34 +0300 Subject: [PATCH 3/3] chore(licenses): refresh cargo dependency inventory --- LICENSES/cargo-dependencies.json | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/LICENSES/cargo-dependencies.json b/LICENSES/cargo-dependencies.json index f0a1c42..195cb9b 100644 --- a/LICENSES/cargo-dependencies.json +++ b/LICENSES/cargo-dependencies.json @@ -96,14 +96,6 @@ "source": "registry+https://github.com/rust-lang/crates.io-index", "version": "1.0.2" }, - { - "checksum": "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1", - "license": "MIT OR Apache-2.0", - "name": "arbitrary", - "repository": "https://github.com/rust-fuzz/arbitrary/", - "source": "registry+https://github.com/rust-lang/crates.io-index", - "version": "1.4.2" - }, { "checksum": "2aa3a22042e45de04255c7bf3626e239f450200fd0493c1e382263544b20aea6", "license": "MIT OR Apache-2.0", @@ -512,14 +504,6 @@ "source": "registry+https://github.com/rust-lang/crates.io-index", "version": "0.5.8" }, - { - "checksum": "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a", - "license": "MIT OR Apache-2.0", - "name": "derive_arbitrary", - "repository": "https://github.com/rust-fuzz/arbitrary", - "source": "registry+https://github.com/rust-lang/crates.io-index", - "version": "1.4.2" - }, { "checksum": "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8", "license": "MIT", @@ -2129,12 +2113,12 @@ "version": "0.9.0" }, { - "checksum": "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0", + "checksum": "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d", "license": "MIT OR Apache-2.0", "name": "ureq", "repository": "https://github.com/algesten/ureq", "source": "registry+https://github.com/rust-lang/crates.io-index", - "version": "3.3.0" + "version": "3.4.0" }, { "checksum": "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613", @@ -2608,14 +2592,6 @@ "source": "registry+https://github.com/rust-lang/crates.io-index", "version": "0.11.3" }, - { - "checksum": "eb2a05c7c36fde6c09b08576c9f7fb4cda705990f73b58fe011abf7dfb24168b", - "license": "MIT", - "name": "zip", - "repository": "https://github.com/zip-rs/zip2.git", - "source": "registry+https://github.com/rust-lang/crates.io-index", - "version": "6.0.0" - }, { "checksum": "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b", "license": "MIT",