From c58e280739212afa887cfc331a4f23c57004d039 Mon Sep 17 00:00:00 2001
From: Ke Wang <nmg_wk@yeah.net>
Date: Tue, 27 Oct 2026 12:53:00 +0800
Subject: [PATCH] fix(deps): update zstd safety wrappers (#534)

Preserve Zstd 1.5.7 and compression level 3 while updating the Rust wrappers to resolve security advisories.
---
 backend/Cargo.lock                         | 12 ++++++------
 backend/crates/gateway-api/Cargo.toml      |  2 +-
 backend/crates/providers/openai/Cargo.toml |  4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index e913e41ad..63c3551a0 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -5667,27 +5667,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zstd"
-version = "0.13.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.2.4"
+version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/backend/crates/gateway-api/Cargo.toml b/backend/crates/gateway-api/Cargo.toml
index 5afe61d1e..616da1dfa 100644
--- a/backend/crates/gateway-api/Cargo.toml
+++ b/backend/crates/gateway-api/Cargo.toml
@@ -37,7 +37,7 @@ tower-http = { version = "0.7.0", features = ["compression-gzip", "cors", "fs",
 tracing = "0.1.44"
 url = "2.5.8"
 uuid = { version = "1.23.3", features = ["v7"] }
-zstd = "=0.13.3"
+zstd = "=0.14.3"
 zip = { version = "9.0.4", default-features = false, features = ["deflate-flate2"] }
 
 [dev-dependencies]
diff --git a/backend/crates/providers/openai/Cargo.toml b/backend/crates/providers/openai/Cargo.toml
index 47a9acbf3..bf9a53cd9 100644
--- a/backend/crates/providers/openai/Cargo.toml
+++ b/backend/crates/providers/openai/Cargo.toml
@@ -65,8 +65,8 @@ uuid = { version = "1.23.3", features = ["v4", "v7"] }
 # 静态链接 XZ 解码器，不要求部署环境安装 liblzma。
 xz2 = { version = "0.1.7", features = ["static"] }
 # 官方 Codex app-server 对 /v1/responses 请求体默认做 zstd 压缩（level 3），
-# 并携带 Content-Encoding: zstd；保持同版本同级别以对齐上游指纹。
-zstd = "=0.13.3"
+# 并携带 Content-Encoding: zstd；保留底层 Zstd 1.5.7 与压缩级别，仅更新 Rust 安全封装
+zstd = "=0.14.3"
 zip = { version = "9.0.4", default-features = false, features = ["deflate-flate2"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]