rust/lancedb
1
0
Fork 0
mirror of https://github.com/lancedb/lancedb.git synced 2026-10-20 10:42:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deny): ignore zip advisories reachable only through candle-core (#4593)

Browse Source 
`cargo deny` fails on `main` (e.g. [run
39153525802](https://github.com/lancedb/lancedb/actions/runs/39153525802))
and on #4590 with three new `zip 7.4.0` advisories:

- RUSTSEC-2026-0367, RUSTSEC-2026-0368, RUSTSEC-2026-0369 (SUID/SGID
bits, symlink targets and permissions applied through symlinks during
archive extraction), all patched only in `zip >= 9.0.0`.

`zip` is in the lock only through `candle-core` (optional
local-embedding feature). Every published candle release pins `zip < 9`
(0.9.x/0.10.x `^7.2`, 0.11.0 `^8.6`, git main 8.6), so neither `cargo
update -p zip` nor a candle bump clears it. LanceDB never extracts
archives; the crate is only linked.

Same approach as #4551 (rustls): ignore with the reason recorded in
`deny.toml`. `cargo deny check advisories` passes locally with this
change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
LuQQiu
2026-10-19 11:28:23 -07:00
committed by GitHub
co-authored by Claude Fable 5.1
parent ec53c82ef8
commit 7d52c7deb7
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deny.toml
+12
View File
@@ -80,6 +80,18 @@ ignore = [
{ id = "RUSTSEC-2026-0176", reason = "pyo3 in Python bindings; awaiting patched pyo3 release" },
{ id = "RUSTSEC-2026-0177", reason = "pyo3 in Python bindings; awaiting patched pyo3 release" },
# zip < 9.0.0: SUID/SGID bits, symlink targets and permissions applied through
# symlinks during archive extraction. Transitive via candle-core (optional
# local-embedding feature); every published candle release pins zip < 9
# (0.9.x/0.10.x ^7.2, 0.11.0 ^8.6), so no dependency bump clears it.
# LanceDB never extracts archives; the zip crate is only linked.
# https://rustsec.org/advisories/RUSTSEC-2026-0367
# https://rustsec.org/advisories/RUSTSEC-2026-0368
# https://rustsec.org/advisories/RUSTSEC-2026-0369
{ id = "RUSTSEC-2026-0367", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" },
{ id = "RUSTSEC-2026-0368", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" },
{ id = "RUSTSEC-2026-0369", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" },
# quick-xml < 0.41.0: quadratic runtime on duplicate attribute names (DoS).
# quick-xml < 0.41.0: unbounded namespace-declaration allocation in NsReader (DoS).
# Pulled in transitively by inferno (dev-only flame-graph dep), lance-namespace-impls