From 7d52c7deb75c9533aff86c94dc46d9379eba3e8b Mon Sep 17 00:00:00 2001 From: LuQQiu Date: Mon, 19 Oct 2026 11:28:23 -0700 Subject: [PATCH] chore(deny): ignore zip advisories reachable only through candle-core (#4593) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `cargo deny` fails on `main` (e.g. [run 39153525802](https://github.com/lancedb/lancedb/actions/runs/39153525802)) and on #4590 with three new `zip 7.4.0` advisories: - RUSTSEC-2026-0367, RUSTSEC-2026-0368, RUSTSEC-2026-0369 (SUID/SGID bits, symlink targets and permissions applied through symlinks during archive extraction), all patched only in `zip >= 9.0.0`. `zip` is in the lock only through `candle-core` (optional local-embedding feature). Every published candle release pins `zip < 9` (0.9.x/0.10.x `^7.2`, 0.11.0 `^8.6`, git main 8.6), so neither `cargo update -p zip` nor a candle bump clears it. LanceDB never extracts archives; the crate is only linked. Same approach as #4551 (rustls): ignore with the reason recorded in `deny.toml`. `cargo deny check advisories` passes locally with this change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5.1 --- deny.toml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/deny.toml b/deny.toml index 1a6977d1c..7d60ae63f 100644 --- a/deny.toml +++ b/deny.toml @@ -80,6 +80,18 @@ ignore = [ { id = "RUSTSEC-2026-0176", reason = "pyo3 in Python bindings; awaiting patched pyo3 release" }, { id = "RUSTSEC-2026-0177", reason = "pyo3 in Python bindings; awaiting patched pyo3 release" }, + # zip < 9.0.0: SUID/SGID bits, symlink targets and permissions applied through + # symlinks during archive extraction. Transitive via candle-core (optional + # local-embedding feature); every published candle release pins zip < 9 + # (0.9.x/0.10.x ^7.2, 0.11.0 ^8.6), so no dependency bump clears it. + # LanceDB never extracts archives; the zip crate is only linked. + # https://rustsec.org/advisories/RUSTSEC-2026-0367 + # https://rustsec.org/advisories/RUSTSEC-2026-0368 + # https://rustsec.org/advisories/RUSTSEC-2026-0369 + { id = "RUSTSEC-2026-0367", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" }, + { id = "RUSTSEC-2026-0368", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" }, + { id = "RUSTSEC-2026-0369", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" }, + # quick-xml < 0.41.0: quadratic runtime on duplicate attribute names (DoS). # quick-xml < 0.41.0: unbounded namespace-declaration allocation in NsReader (DoS). # Pulled in transitively by inferno (dev-only flame-graph dep), lance-namespace-impls