From 26748244cd5ef1cc595d29de015d14fafb31a987 Mon Sep 17 00:00:00 2001 From: "Claude Opus 5.5" Date: Sat, 17 Oct 2026 10:58:37 +0000 Subject: [PATCH] fix(deps): clear the RustSec advisories that fail cargo-deny - zip 8 -> 9 (RUSTSEC-2026-0367, -0368, -0369). zip 9 returns entry names as a Result, so a name that isn't valid text is now refused. - aikit f9c8d27 and cli-framework 86c22b2, which move to zip 9 too, so zip 2.4.2 leaves the lockfile. - rustls 0.23.46 (RUSTSEC-2026-0346 to -0349) and ammonia 4.2.4 (RUSTSEC-2021-0157, -0158). - Ignore RUSTSEC-2024-0449: unsafe-libyaml is unmaintained and comes from serde_yaml, which has no safe drop-in replacement yet. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 345 +++++------------- Cargo.toml | 10 +- .../tests/project_repin_cli_test.rs | 9 +- crates/fastskill-core/src/storage/zip.rs | 19 +- deny.toml | 1 + 5 files changed, 107 insertions(+), 277 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 09b7bab4..e3f97762 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8,17 +8,6 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" -[[package]] -name = "aes" -version = "0.8.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" -dependencies = [ - "cfg-if", - "cipher", - "cpufeatures 0.2.17", -] - [[package]] name = "ahash" version = "0.8.12" @@ -45,7 +34,7 @@ dependencies = [ [[package]] name = "aikit-agent" version = "0.1.0" -source = "git+https://github.com/goaikit/aikit.git?rev=b894e4f0d0da42465c316efd1b3eb4e9582219c8#b894e4f0d0da42465c316efd1b3eb4e9582219c8" +source = "git+https://github.com/goaikit/aikit.git?rev=f9c8d2786bc8da2e2d34daf362e6a2a59500502d#f9c8d2786bc8da2e2d34daf362e6a2a59500502d" dependencies = [ "reqwest 0.12.28", "serde", @@ -58,7 +47,7 @@ dependencies = [ [[package]] name = "aikit-evals" version = "0.1.0" -source = "git+https://github.com/goaikit/aikit.git?rev=b894e4f0d0da42465c316efd1b3eb4e9582219c8#b894e4f0d0da42465c316efd1b3eb4e9582219c8" +source = "git+https://github.com/goaikit/aikit.git?rev=f9c8d2786bc8da2e2d34daf362e6a2a59500502d#f9c8d2786bc8da2e2d34daf362e6a2a59500502d" dependencies = [ "aikit-sdk", "async-trait", @@ -79,7 +68,7 @@ dependencies = [ [[package]] name = "aikit-sdk" version = "0.3.0" -source = "git+https://github.com/goaikit/aikit.git?rev=b894e4f0d0da42465c316efd1b3eb4e9582219c8#b894e4f0d0da42465c316efd1b3eb4e9582219c8" +source = "git+https://github.com/goaikit/aikit.git?rev=f9c8d2786bc8da2e2d34daf362e6a2a59500502d#f9c8d2786bc8da2e2d34daf362e6a2a59500502d" dependencies = [ "aikit-agent", "claude-agent-sdk", @@ -97,13 +86,13 @@ dependencies = [ "tracing", "uuid", "walkdir", - "zip 2.4.2", + "zip", ] [[package]] name = "aikit-skillopt" version = "0.1.0" -source = "git+https://github.com/goaikit/aikit.git?rev=b894e4f0d0da42465c316efd1b3eb4e9582219c8#b894e4f0d0da42465c316efd1b3eb4e9582219c8" +source = "git+https://github.com/goaikit/aikit.git?rev=f9c8d2786bc8da2e2d34daf362e6a2a59500502d#f9c8d2786bc8da2e2d34daf362e6a2a59500502d" dependencies = [ "aikit-evals", "aikit-sdk", @@ -116,7 +105,7 @@ dependencies = [ [[package]] name = "aikit-textgrad" version = "0.1.0" -source = "git+https://github.com/goaikit/aikit.git?rev=b894e4f0d0da42465c316efd1b3eb4e9582219c8#b894e4f0d0da42465c316efd1b3eb4e9582219c8" +source = "git+https://github.com/goaikit/aikit.git?rev=f9c8d2786bc8da2e2d34daf362e6a2a59500502d#f9c8d2786bc8da2e2d34daf362e6a2a59500502d" dependencies = [ "aikit-evals", "aikit-sdk", @@ -163,9 +152,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923" [[package]] name = "ammonia" -version = "4.1.4" +version = "4.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d" +checksum = "1f45dfa685e1ec33b1bf1a3b93b8047cbdbef41b6040deebbe6bea7720a45574" dependencies = [ "cssparser", "html5ever", @@ -238,15 +227,6 @@ version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" -[[package]] -name = "arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "assert-json-diff" version = "2.0.2" @@ -547,25 +527,6 @@ version = "1.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33" -[[package]] -name = "bzip2" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47" -dependencies = [ - "bzip2-sys", -] - -[[package]] -name = "bzip2-sys" -version = "0.1.13+1.0.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14" -dependencies = [ - "cc", - "pkg-config", -] - [[package]] name = "caseless" version = "0.2.2" @@ -624,16 +585,6 @@ dependencies = [ "windows-link", ] -[[package]] -name = "cipher" -version = "0.4.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" -dependencies = [ - "crypto-common 0.1.7", - "inout", -] - [[package]] name = "clap" version = "4.6.7" @@ -694,7 +645,7 @@ dependencies = [ [[package]] name = "cli-framework" version = "0.5.8" -source = "git+https://github.com/aroff/cli-framework?rev=ed0b3521f3f24b3b23713a810b2bbd73b84c5cc6#ed0b3521f3f24b3b23713a810b2bbd73b84c5cc6" +source = "git+https://github.com/aroff/cli-framework?rev=86c22b28cd4a36474d194b44b0bc6fc4a780c553#86c22b28cd4a36474d194b44b0bc6fc4a780c553" dependencies = [ "aikit-sdk", "ailoop-core", @@ -731,7 +682,7 @@ dependencies = [ "uuid", "windows-sys 0.61.2", "winreg", - "zip 2.4.2", + "zip", ] [[package]] @@ -790,8 +741,8 @@ dependencies = [ "finl_unicode", "fmt2io", "jetscii", - "phf", - "phf_codegen", + "phf 0.13.1", + "phf_codegen 0.13.1", "rustc-hash", "shell-words", "smallvec", @@ -826,12 +777,6 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" -[[package]] -name = "constant_time_eq" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6" - [[package]] name = "core-foundation" version = "0.10.1" @@ -866,21 +811,6 @@ dependencies = [ "libc", ] -[[package]] -name = "crc" -version = "3.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d" -dependencies = [ - "crc-catalog", -] - -[[package]] -name = "crc-catalog" -version = "2.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5" - [[package]] name = "crc32fast" version = "1.5.0" @@ -942,9 +872,9 @@ dependencies = [ [[package]] name = "cssparser" -version = "0.37.0" +version = "0.38.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98" +checksum = "11119743ad110e8c1bdccd930d7f5c30c99e5fc76a7b63ec9807e84eef0c5f59" dependencies = [ "dtoa-short", "itoa", @@ -1058,12 +988,6 @@ version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b" -[[package]] -name = "deflate64" -version = "0.1.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac6b926516df9c60bfa16e107b21086399f8285a44ca9711344b9e553c5146e2" - [[package]] name = "deranged" version = "0.5.8" @@ -1073,17 +997,6 @@ dependencies = [ "powerfmt", ] -[[package]] -name = "derive_arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] - [[package]] name = "difflib" version = "0.4.0" @@ -1098,7 +1011,6 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ "block-buffer 0.10.4", "crypto-common 0.1.7", - "subtle", ] [[package]] @@ -1213,7 +1125,7 @@ version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0a4d5d50b0b58df5173d8ff1192b4d1422ceae5d981b30d4b6f8ed1d673a2bc4" dependencies = [ - "phf", + "phf 0.13.1", ] [[package]] @@ -1349,7 +1261,7 @@ dependencies = [ "uuid", "walkdir", "wiremock", - "zip 8.6.0", + "zip", ] [[package]] @@ -1399,7 +1311,7 @@ dependencies = [ "validator", "walkdir", "wiremock", - "zip 8.6.0", + "zip", ] [[package]] @@ -1798,15 +1710,6 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" -[[package]] -name = "hmac" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" -dependencies = [ - "digest 0.10.7", -] - [[package]] name = "home" version = "0.5.12" @@ -1818,12 +1721,13 @@ dependencies = [ [[package]] name = "html5ever" -version = "0.39.0" +version = "0.40.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8" +checksum = "456a1a377e608e555d22ddab27ac0114bc7a7b4199078108e34c2aeae6c9b130" dependencies = [ "log", "markup5ever", + "memchr", ] [[package]] @@ -2009,7 +1913,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.3", + "socket2 0.5.10", "tokio", "tower-service", "tracing", @@ -2191,15 +2095,6 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac" -[[package]] -name = "inout" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01" -dependencies = [ - "generic-array", -] - [[package]] name = "insta" version = "1.49.0" @@ -2431,27 +2326,6 @@ version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" -[[package]] -name = "lzma-rs" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e" -dependencies = [ - "byteorder", - "crc", -] - -[[package]] -name = "lzma-sys" -version = "0.1.20" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27" -dependencies = [ - "cc", - "libc", - "pkg-config", -] - [[package]] name = "maplit" version = "1.0.2" @@ -2460,9 +2334,9 @@ checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d" [[package]] name = "markup5ever" -version = "0.39.0" +version = "0.40.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de" +checksum = "0ab3dc68ac4a0f5719e560136778c1ee716e296030d75dbd4484e37e39e3a842" dependencies = [ "log", "tendril", @@ -2786,16 +2660,6 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4" -[[package]] -name = "pbkdf2" -version = "0.12.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" -dependencies = [ - "digest 0.10.7", - "hmac", -] - [[package]] name = "pem" version = "3.0.6" @@ -2818,7 +2682,17 @@ version = "0.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf" dependencies = [ - "phf_shared", + "phf_shared 0.13.1", + "serde", +] + +[[package]] +name = "phf" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6" +dependencies = [ + "phf_shared 0.14.0", "serde", ] @@ -2828,8 +2702,18 @@ version = "0.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1" dependencies = [ - "phf_generator", - "phf_shared", + "phf_generator 0.13.1", + "phf_shared 0.13.1", +] + +[[package]] +name = "phf_codegen" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41b585a510fb76fdebead6897982ef2a03a21d8e6cbcca904999742a4afc6ffe" +dependencies = [ + "phf_generator 0.14.0", + "phf_shared 0.14.0", ] [[package]] @@ -2839,7 +2723,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737" dependencies = [ "fastrand 2.4.1", - "phf_shared", + "phf_shared 0.13.1", +] + +[[package]] +name = "phf_generator" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100" +dependencies = [ + "fastrand 2.4.1", + "phf_shared 0.14.0", ] [[package]] @@ -2851,6 +2745,15 @@ dependencies = [ "siphasher", ] +[[package]] +name = "phf_shared" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89" +dependencies = [ + "siphasher", +] + [[package]] name = "pin-project-lite" version = "0.2.17" @@ -3030,7 +2933,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls", - "socket2 0.6.3", + "socket2 0.5.10", "thiserror 2.0.21", "tokio", "tracing", @@ -3068,7 +2971,7 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.3", + "socket2 0.5.10", "tracing", "windows-sys 0.59.0", ] @@ -3563,9 +3466,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell", @@ -4051,24 +3954,24 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" [[package]] name = "string_cache" -version = "0.9.0" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901" +checksum = "ffa8a5dbe8b3f0bbe29d4c3225daafaeead63afdc1b65fc4c01a1384166038e6" dependencies = [ "new_debug_unreachable", "parking_lot", - "phf_shared", + "phf_shared 0.14.0", "precomputed-hash", ] [[package]] name = "string_cache_codegen" -version = "0.6.1" +version = "0.11.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69" +checksum = "928dcdf75e47626b3617a976ec205d9f057584c371c1f23b782129268d0e6edc" dependencies = [ - "phf_generator", - "phf_shared", + "phf_generator 0.14.0", + "phf_shared 0.14.0", "proc-macro2", "quote", ] @@ -4983,12 +4886,12 @@ dependencies = [ [[package]] name = "web_atoms" -version = "0.2.5" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "075474b12bcb3d2e3d4546580e9de478eeeead668a1761e2a8860c836b7ef297" +checksum = "7572660c8890448ba236b7376f27e389c6a7e1c70195622faced601f855c0ada" dependencies = [ - "phf", - "phf_codegen", + "phf 0.14.0", + "phf_codegen 0.14.0", "string_cache", "string_cache_codegen", ] @@ -5433,15 +5336,6 @@ version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2fb433233f2df9344722454bc7e96465c9d03bff9d77c248f9e7523fe79585b5" -[[package]] -name = "xz2" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2" -dependencies = [ - "lzma-sys", -] - [[package]] name = "yaml-rust" version = "0.4.5" @@ -5529,20 +5423,6 @@ name = "zeroize" version = "1.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" -dependencies = [ - "zeroize_derive", -] - -[[package]] -name = "zeroize_derive" -version = "1.4.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] [[package]] name = "zerotrie" @@ -5579,44 +5459,15 @@ dependencies = [ [[package]] name = "zip" -version = "2.4.2" +version = "9.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50" -dependencies = [ - "aes", - "arbitrary", - "bzip2", - "constant_time_eq", - "crc32fast", - "crossbeam-utils", - "deflate64", - "displaydoc", - "flate2", - "getrandom 0.3.4", - "hmac", - "indexmap", - "lzma-rs", - "memchr", - "pbkdf2", - "sha1", - "thiserror 2.0.21", - "time", - "xz2", - "zeroize", - "zopfli", - "zstd", -] - -[[package]] -name = "zip" -version = "8.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" +checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22" dependencies = [ "crc32fast", "flate2", "indexmap", "memchr", + "nix", "typed-path", "zopfli", ] @@ -5644,31 +5495,3 @@ dependencies = [ "log", "simd-adler32", ] - -[[package]] -name = "zstd" -version = "0.13.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" -dependencies = [ - "zstd-safe", -] - -[[package]] -name = "zstd-safe" -version = "7.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d" -dependencies = [ - "zstd-sys", -] - -[[package]] -name = "zstd-sys" -version = "2.0.16+zstd.1.5.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748" -dependencies = [ - "cc", - "pkg-config", -] diff --git a/Cargo.toml b/Cargo.toml index 3d7a7438..7eeee569 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -20,11 +20,11 @@ repository = "https://github.com/gofastskill/fastskill" # and compiles two mutually-incompatible copies into the binary. # # aikit-sdk for agent metadata file resolution -aikit-sdk = { git = "https://github.com/goaikit/aikit.git", rev = "b894e4f0d0da42465c316efd1b3eb4e9582219c8" } +aikit-sdk = { git = "https://github.com/goaikit/aikit.git", rev = "f9c8d2786bc8da2e2d34daf362e6a2a59500502d" } # aikit-evals provides the generic eval runner infrastructure -aikit-evals = { git = "https://github.com/goaikit/aikit.git", rev = "b894e4f0d0da42465c316efd1b3eb4e9582219c8" } +aikit-evals = { git = "https://github.com/goaikit/aikit.git", rev = "f9c8d2786bc8da2e2d34daf362e6a2a59500502d" } # aikit-skillopt provides the text-gradient skill optimization loop -aikit-skillopt = { git = "https://github.com/goaikit/aikit.git", rev = "b894e4f0d0da42465c316efd1b3eb4e9582219c8" } +aikit-skillopt = { git = "https://github.com/goaikit/aikit.git", rev = "f9c8d2786bc8da2e2d34daf362e6a2a59500502d" } # Async runtime tokio = { version = "1.52", features = ["rt-multi-thread", "net", "fs", "io-util", "macros", "process"] } @@ -55,7 +55,7 @@ walkdir = "2.5" fs2 = "0.4" # Archive handling -zip = { version = "8.6", default-features = false, features = ["deflate"] } +zip = { version = "9.0", default-features = false, features = ["deflate"] } # HTTP client for embedding API (rustls for musl compatibility) reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls"] } @@ -66,7 +66,7 @@ tower = { version = "0.5", features = ["util", "timeout", "limit"] } tower-http = { version = "0.7", features = ["cors", "trace", "compression-gzip", "fs"] } # CLI framework for versioned API server hosting -cli-framework = { git = "https://github.com/aroff/cli-framework", rev = "ed0b3521f3f24b3b23713a810b2bbd73b84c5cc6", default-features = false, features = ["api-server"] } +cli-framework = { git = "https://github.com/aroff/cli-framework", rev = "86c22b28cd4a36474d194b44b0bc6fc4a780c553", default-features = false, features = ["api-server"] } # MCP protocol types and transports. Version and feature set MUST track # cli-framework's own `rmcp` dependency: `fastskill mcp serve` wraps diff --git a/crates/fastskill-cli/tests/project_repin_cli_test.rs b/crates/fastskill-cli/tests/project_repin_cli_test.rs index 34b2ad87..9d3b24e3 100644 --- a/crates/fastskill-cli/tests/project_repin_cli_test.rs +++ b/crates/fastskill-cli/tests/project_repin_cli_test.rs @@ -514,14 +514,11 @@ fn legacy_artifact(path: &Path, replacements: &[(&str, &str)]) { let mut file = archive.by_index(index).unwrap(); let mut bytes = Vec::new(); file.read_to_end(&mut bytes).unwrap(); - if file.name() == "skills.lock" { + let name = file.name().unwrap().into_owned(); + if name == "skills.lock" { bytes = replace_all(&String::from_utf8(bytes).unwrap(), replacements).into_bytes(); } - entries.push(( - file.name().to_string(), - file.unix_mode().unwrap_or(0o644), - bytes, - )); + entries.push((name, file.unix_mode().unwrap_or(0o644), bytes)); } drop(archive); let mut writer = zip::ZipWriter::new(fs::File::create(path).unwrap()); diff --git a/crates/fastskill-core/src/storage/zip.rs b/crates/fastskill-core/src/storage/zip.rs index 08a3fee6..6fe9c1bd 100644 --- a/crates/fastskill-core/src/storage/zip.rs +++ b/crates/fastskill-core/src/storage/zip.rs @@ -55,13 +55,12 @@ pub(crate) fn preflight_zip_archive( continue; } + let name = entry_name(&file, i)?; let declared = file.size(); if declared > MAX_ENTRY_UNCOMPRESSED { return Err(ServiceError::Validation(format!( "ZIP entry '{}' declares size {} bytes exceeding per-entry limit {}", - file.name(), - declared, - MAX_ENTRY_UNCOMPRESSED + name, declared, MAX_ENTRY_UNCOMPRESSED ))); } @@ -69,7 +68,7 @@ pub(crate) fn preflight_zip_archive( if compressed > 0 && declared / compressed > MAX_RATIO { return Err(ServiceError::Validation(format!( "ZIP entry '{}' has compression ratio {} exceeding limit {} (possible ZIP bomb)", - file.name(), + name, declared / compressed, MAX_RATIO ))); @@ -79,6 +78,16 @@ pub(crate) fn preflight_zip_archive( Ok(()) } +/// The name of entry `index`; a name that isn't valid text is refused. +fn entry_name( + file: &zip::read::ZipFile<'_, R>, + index: usize, +) -> Result { + file.name().map(|name| name.into_owned()).map_err(|e| { + ServiceError::Validation(format!("Invalid ZIP entry name at index {}: {}", index, e)) + }) +} + pub struct ZipHandler; impl ZipHandler { @@ -134,7 +143,7 @@ impl ZipHandler { ServiceError::Validation(format!("Failed to read ZIP entry: {}", e)) })?; - let entry_name = file.name().to_string(); + let entry_name = entry_name(&file, i)?; let archive_mode = file.unix_mode(); // Determine directory-ness from the raw zip entry (BUG-11), not the diff --git a/deny.toml b/deny.toml index 83800f6c..b63c3e75 100644 --- a/deny.toml +++ b/deny.toml @@ -16,6 +16,7 @@ ignore = [ # Unmaintained crates with no drop-in replacement upstream. { id = "RUSTSEC-2025-0141", reason = "bincode 1.x (unmaintained) comes from comrak -> syntect; no safe upgrade available" }, { id = "RUSTSEC-2024-0320", reason = "yaml-rust (unmaintained) comes from comrak -> syntect; no safe upgrade available" }, + { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml (unmaintained) comes from serde_yaml, used here and by cli-framework; no safe drop-in replacement yet" }, { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 (unmaintained) is a build-time proc-macro dep of validator_derive" }, ]