mirror of
https://github.com/nushell/nushell.git
synced 2026-10-28 08:54:52 +08:00
Bump webpage and zstd-sys, ignore the other zstd advisories to clear the RustSec audit (#19359)
## Description The `Security audit` job fails on main and on every PR that touches `Cargo.toml` or `Cargo.lock` (#19358 is one). The advisory database now lists five vulnerabilities: | Crate | Locked | Fixed in | Advisory | This PR | | --- | --- | --- | --- | --- | | `webpage` | 2.0.1 | 2.1.0 | RUSTSEC-2026-0407 | bump | | `zstd-sys` | 2.0.16 | 2.1.2 | RUSTSEC-2026-0410 | bump (lockfile only) | | `zstd` | 0.13.3 | 0.14.3 | RUSTSEC-2026-0391 | ignore | | `zstd-safe` | 7.2.4 | 8.2.0 | RUSTSEC-2026-0398, -0403 | ignore | `webpage` is a direct dependency of `nu_plugin_query`. The advisory covers URL fetching (`HTTP::fetch`, `Webpage::from_url`), and the plugin never fetches. It only calls `HTML::from_string` on its input. Version 2.1.0 also moves `webpage` to html5ever 0.39, which `scraper` already uses, so the lockfile drops html5ever 0.27 and the seven crates that came with it. The zstd crates come only from polars 0.55.2 in `nu_plugin_polars`. zstd-safe 7.2.4 accepts `zstd-sys ^2.0.15`, so the lockfile can take zstd-sys 2.1.2. That fixes the wasm32 allocator bug in RUSTSEC-2026-0410. zstd and zstd-safe can't move, because polars 0.55.2 is the latest release and requires `zstd ^0.13`. polars main is already on zstd 0.14. Until polars releases, `.cargo/audit.toml` ignores the remaining 13 zstd-safe and zstd advisories, with a reason for each. Three of them are vulnerabilities and ten are `unsound` warnings: - 0391 is reachable. polars-parquet reuses one zstd context per column chunk through `Decoder::with_context`, so a crafted file can make a page start with leftover output from an earlier page. The context lives only as long as that column chunk's reader, so the leftover data always comes from the same file. - 0403 affects only `stream::write::Decoder`, and polars uses the read `Decoder`. - The other eleven need zstd features that are off (`experimental`, `seekable`, `zstdmt`), or APIs that neither polars nor the `zstd` crate's stream and bulk code call. ## User-facing changes (Release notes) ## Additional notes <!-- Optional. Examples: - fixes #123 - closes #456 - related #789 Anything else reviewers should know. Remove this section if not needed. -->
This commit is contained in:
Darren Schroeder authored and GitHub committed
1 parent
131b82a921
commit
c7c8ebaa9e
3 files changed
+48
-111
No files matched your search
@@ -13,4 +13,31 @@ ignore = [
|
||||
"RUSTSEC-2026-0367",
|
||||
"RUSTSEC-2026-0368",
|
||||
"RUSTSEC-2026-0369",
|
||||
# zstd@0.13 and zstd-safe@7 come only from polars 0.55.2 (nu_plugin_polars),
|
||||
# which requires `zstd ^0.13`; the fixes are in zstd 0.14.3 and zstd-safe
|
||||
# 8.2.0. Remove once polars releases with zstd 0.14 (already on polars main).
|
||||
# - 0391: polars-parquet reuses one `DCtx` per column chunk through
|
||||
# `Decoder::with_context`, so a crafted file can make a page start with
|
||||
# leftover output of an earlier page; that data comes from the same file.
|
||||
# - 0403: covers `stream::write::Decoder`; polars only uses the read `Decoder`.
|
||||
# - 0395, 0399, 0402, 0404: need the `experimental` feature, which is off.
|
||||
# - 0396, 0398, 0405: need the `seekable` feature, which is off.
|
||||
# - 0406: needs the `zstdmt` feature, which is off.
|
||||
# - 0397, 0401: `OutBuffer::around_pos` and `train_from_buffer`, which
|
||||
# neither polars nor zstd's stream and bulk APIs call.
|
||||
# - 0400: needs a one-shot call on a `DCtx` that also streams; polars' reused
|
||||
# `DCtx` only streams.
|
||||
"RUSTSEC-2026-0391",
|
||||
"RUSTSEC-2026-0395",
|
||||
"RUSTSEC-2026-0396",
|
||||
"RUSTSEC-2026-0397",
|
||||
"RUSTSEC-2026-0398",
|
||||
"RUSTSEC-2026-0399",
|
||||
"RUSTSEC-2026-0400",
|
||||
"RUSTSEC-2026-0401",
|
||||
"RUSTSEC-2026-0402",
|
||||
"RUSTSEC-2026-0403",
|
||||
"RUSTSEC-2026-0404",
|
||||
"RUSTSEC-2026-0405",
|
||||
"RUSTSEC-2026-0406",
|
||||
]
|
||||
Generated
+20
-110
@@ -2725,16 +2725,6 @@ dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "futf"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
|
||||
dependencies = [
|
||||
"mac",
|
||||
"new_debug_unreachable",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "futures"
|
||||
version = "0.3.32"
|
||||
@@ -3165,20 +3155,6 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "html5ever"
|
||||
version = "0.27.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c13771afe0e6e846f1e67d038d4cb29998a6779f93c809212e4e9c32efd244d4"
|
||||
dependencies = [
|
||||
"log",
|
||||
"mac",
|
||||
"markup5ever 0.12.1",
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn 2.0.117",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "html5ever"
|
||||
version = "0.39.0"
|
||||
@@ -3186,7 +3162,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
|
||||
dependencies = [
|
||||
"log",
|
||||
"markup5ever 0.39.0",
|
||||
"markup5ever",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -4227,12 +4203,6 @@ dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "mac"
|
||||
version = "0.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
|
||||
|
||||
[[package]]
|
||||
name = "mach2"
|
||||
version = "0.7.0"
|
||||
@@ -4248,20 +4218,6 @@ dependencies = [
|
||||
"unicode-id",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "markup5ever"
|
||||
version = "0.12.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "16ce3abbeba692c8b8441d036ef91aea6df8da2c6b6e21c7e14d3c18e526be45"
|
||||
dependencies = [
|
||||
"log",
|
||||
"phf 0.11.3",
|
||||
"phf_codegen 0.11.3",
|
||||
"string_cache 0.8.9",
|
||||
"string_cache_codegen 0.5.4",
|
||||
"tendril 0.4.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "markup5ever"
|
||||
version = "0.39.0"
|
||||
@@ -4269,19 +4225,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
|
||||
dependencies = [
|
||||
"log",
|
||||
"tendril 0.5.0",
|
||||
"tendril",
|
||||
"web_atoms",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "markup5ever_rcdom"
|
||||
version = "0.3.0"
|
||||
version = "0.39.0+unofficial"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "edaa21ab3701bfee5099ade5f7e1f84553fd19228cf332f13cd6e964bf59be18"
|
||||
checksum = "3ac010f19d6c4af81eeb4018a39d7a115de9d285af45c126a4ac02e6fc5716b7"
|
||||
dependencies = [
|
||||
"html5ever 0.27.0",
|
||||
"markup5ever 0.12.1",
|
||||
"tendril 0.4.3",
|
||||
"html5ever",
|
||||
"markup5ever",
|
||||
"tendril",
|
||||
"xml5ever",
|
||||
]
|
||||
|
||||
@@ -6368,16 +6324,6 @@ dependencies = [
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "phf_codegen"
|
||||
version = "0.11.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
|
||||
dependencies = [
|
||||
"phf_generator 0.11.3",
|
||||
"phf_shared 0.11.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "phf_codegen"
|
||||
version = "0.12.1"
|
||||
@@ -8370,10 +8316,10 @@ checksum = "bdd0be4d296f048bfb06dd01bbc80ef789ddd2e55583e8d2e6b804942abfabc2"
|
||||
dependencies = [
|
||||
"cssparser",
|
||||
"ego-tree",
|
||||
"html5ever 0.39.0",
|
||||
"html5ever",
|
||||
"precomputed-hash",
|
||||
"selectors",
|
||||
"tendril 0.5.0",
|
||||
"tendril",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -8941,19 +8887,6 @@ version = "0.2.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fe895eb47f22e2ddd4dabc02bce419d2e643c8e3b585c78158b349195bc24d82"
|
||||
|
||||
[[package]]
|
||||
name = "string_cache"
|
||||
version = "0.8.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
|
||||
dependencies = [
|
||||
"new_debug_unreachable",
|
||||
"parking_lot",
|
||||
"phf_shared 0.11.3",
|
||||
"precomputed-hash",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "string_cache"
|
||||
version = "0.9.0"
|
||||
@@ -8964,18 +8897,7 @@ dependencies = [
|
||||
"parking_lot",
|
||||
"phf_shared 0.13.1",
|
||||
"precomputed-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "string_cache_codegen"
|
||||
version = "0.5.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0"
|
||||
dependencies = [
|
||||
"phf_generator 0.11.3",
|
||||
"phf_shared 0.11.3",
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -9213,17 +9135,6 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tendril"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
|
||||
dependencies = [
|
||||
"futf",
|
||||
"mac",
|
||||
"utf-8",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tendril"
|
||||
version = "0.5.0"
|
||||
@@ -10500,18 +10411,18 @@ checksum = "57a9779e9f04d2ac1ce317aee707aa2f6b773afba7b931222bff6983843b1576"
|
||||
dependencies = [
|
||||
"phf 0.13.1",
|
||||
"phf_codegen 0.13.1",
|
||||
"string_cache 0.9.0",
|
||||
"string_cache_codegen 0.6.1",
|
||||
"string_cache",
|
||||
"string_cache_codegen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "webpage"
|
||||
version = "2.0.1"
|
||||
version = "2.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "70862efc041d46e6bbaa82bb9c34ae0596d090e86cbd14bd9e93b36ee6802eac"
|
||||
checksum = "5547a459b8cab203b5bf7d1f97855b3d6ae706da7c93773328614309432c9e4c"
|
||||
dependencies = [
|
||||
"curl",
|
||||
"html5ever 0.27.0",
|
||||
"html5ever",
|
||||
"markup5ever_rcdom",
|
||||
"serde",
|
||||
"serde_json",
|
||||
@@ -11190,13 +11101,12 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "xml5ever"
|
||||
version = "0.18.1"
|
||||
version = "0.39.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9bbb26405d8e919bc1547a5aa9abc95cbfa438f04844f5fdd9dc7596b748bf69"
|
||||
checksum = "5ab627f34ff61b80d756180d556f9c68801d836d271b3b8c094504ceca69d221"
|
||||
dependencies = [
|
||||
"log",
|
||||
"mac",
|
||||
"markup5ever 0.12.1",
|
||||
"markup5ever",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -11409,9 +11319,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "zstd-sys"
|
||||
version = "2.0.16+zstd.1.5.7"
|
||||
version = "2.1.2+zstd.1.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
|
||||
checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"pkg-config",
|
||||
|
||||
@@ -24,6 +24,6 @@ gjson = "0.8.1"
|
||||
scraper = { default-features = false, version = "0.27" }
|
||||
sxd-document = "0.3"
|
||||
sxd-xpath = "0.4"
|
||||
webpage = { version = "2.0.1", features = ["serde"] }
|
||||
webpage = { version = "2.1.0", features = ["serde"] }
|
||||
serde_json.workspace = true
|
||||
serde.workspace = true
|
||||
Reference in new issue
Block a user