From d5a022452ed8302f0d5d39d7a155d696867462f2 Mon Sep 17 00:00:00 2001 From: Michael Gasperini Date: Fri, 6 Nov 2026 21:50:38 +0100 Subject: [PATCH 1/3] fix(deps): move zip to a patched release The workspace and two crates pinned zip 3, and office_oxide pulled zip 8.6.0 through pdf_oxide. Every open advisory, including the critical parser differential in 9.0.4 and earlier, is fixed in 9.0.5. Bump the workspace and crate pins to zip 9, update office_oxide to 0.1.16 so the transitive copy resolves to the same major, and adapt the two API changes: file_names and entry name now return a Result. The extraction guard keeps validating the raw entry name, because enclosed_name normalizes . components away. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- Cargo.lock | 345 ++++++++---------- Cargo.toml | 2 +- crates/codegen/chutes-tools/Cargo.toml | 2 +- .../src/implementations/read_file/pptx.rs | 1 + crates/codegen/chutes-update/Cargo.toml | 2 +- .../chutes-update/src/windows_payload.rs | 20 +- 6 files changed, 170 insertions(+), 202 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index e83cad39..703c30a2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -17,24 +17,13 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" -[[package]] -name = "aes" -version = "0.8.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" -dependencies = [ - "cfg-if", - "cipher 0.4.4", - "cpufeatures 0.2.17", -] - [[package]] name = "aes" version = "0.9.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32" dependencies = [ - "cipher 0.5.1", + "cipher", "cpubits", "cpufeatures 0.3.0", ] @@ -299,15 +288,6 @@ version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" -[[package]] -name = "arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "arboard" version = "3.6.1" @@ -324,7 +304,7 @@ dependencies = [ "objc2-foundation 0.3.2", "parking_lot", "percent-encoding", - "windows-sys 0.52.0", + "windows-sys 0.60.2", "wl-clipboard-rs", "x11rb", ] @@ -829,7 +809,7 @@ dependencies = [ "bytes", "fastrand", "hex", - "hmac", + "hmac 0.12.1", "http 0.2.12", "http 1.4.0", "http-body 1.0.1", @@ -928,7 +908,7 @@ dependencies = [ "bytes", "form_urlencoded", "hex", - "hmac", + "hmac 0.12.1", "http 0.2.12", "http 1.4.0", "percent-encoding", @@ -964,7 +944,7 @@ dependencies = [ "http-body-util", "md-5 0.10.6", "pin-project-lite", - "sha1", + "sha1 0.10.6", "sha2 0.10.9", "tracing", ] @@ -1197,7 +1177,7 @@ dependencies = [ "serde_json", "serde_path_to_error", "serde_urlencoded", - "sha1", + "sha1 0.10.6", "sync_wrapper", "tokio", "tokio-tungstenite", @@ -1415,7 +1395,7 @@ dependencies = [ "arrayvec", "cc", "cfg-if", - "constant_time_eq", + "constant_time_eq 0.3.1", ] [[package]] @@ -1434,6 +1414,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be" dependencies = [ "hybrid-array", + "zeroize", ] [[package]] @@ -1614,21 +1595,11 @@ dependencies = [ [[package]] name = "bzip2" -version = "0.5.2" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47" +checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c" dependencies = [ - "bzip2-sys", -] - -[[package]] -name = "bzip2-sys" -version = "0.1.13+1.0.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14" -dependencies = [ - "cc", - "pkg-config", + "libbz2-rs-sys", ] [[package]] @@ -1697,7 +1668,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "98db6aeaef0eeef2c1e3ce9a27b739218825dae116076352ac3777076aa22225" dependencies = [ - "cipher 0.5.1", + "cipher", ] [[package]] @@ -1922,7 +1893,7 @@ dependencies = [ "toml", "tracing", "tracing-subscriber", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -2003,7 +1974,7 @@ dependencies = [ "fs2", "futures", "globset", - "hmac", + "hmac 0.12.1", "indexmap", "prod-mc-cli-chat-proxy-types", "reqwest 0.12.24", @@ -2410,7 +2381,7 @@ dependencies = [ "tracing", "tracing-subscriber", "url", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -2430,7 +2401,7 @@ dependencies = [ "serde_json", "tempfile", "uuid", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -3218,7 +3189,7 @@ dependencies = [ "tracing", "tracing-subscriber", "uuid", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -3485,7 +3456,7 @@ dependencies = [ "walkdir", "webbrowser", "windows 0.61.3", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -3849,8 +3820,8 @@ dependencies = [ "wildmatch", "windows 0.61.3", "wiremock", - "zip 3.0.0", - "zstd 0.14.3", + "zip", + "zstd", ] [[package]] @@ -3942,8 +3913,8 @@ dependencies = [ "tracing", "url", "wiremock", - "zip 3.0.0", - "zstd 0.14.3", + "zip", + "zstd", ] [[package]] @@ -4071,7 +4042,7 @@ dependencies = [ "rustc-hash 2.1.1", "serde", "serde_json", - "sha1", + "sha1 0.10.6", "sha2 0.10.9", "smallvec", "strum 0.27.2", @@ -4091,8 +4062,8 @@ dependencies = [ "urlencoding", "uuid", "wait-timeout", - "zip 3.0.0", - "zstd 0.14.3", + "zip", + "zstd", ] [[package]] @@ -4164,16 +4135,6 @@ dependencies = [ "half", ] -[[package]] -name = "cipher" -version = "0.4.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" -dependencies = [ - "crypto-common 0.1.6", - "inout 0.1.4", -] - [[package]] name = "cipher" version = "0.5.1" @@ -4181,7 +4142,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e34d8227fe1ba289043aeb13792056ff80fd6de1a9f49137a5f499de8e8c78ea" dependencies = [ "crypto-common 0.2.1", - "inout 0.2.2", + "inout", ] [[package]] @@ -4268,6 +4229,12 @@ dependencies = [ "cc", ] +[[package]] +name = "cmov" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" + [[package]] name = "cmpv2" version = "0.2.0" @@ -4310,7 +4277,7 @@ version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fde0e0ec90c9dfb3b4b1a0891a7dcd0e2bffde2f7efed5fe7c9bb00e5bfb915e" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.59.0", ] [[package]] @@ -4383,8 +4350,8 @@ dependencies = [ "compression-core", "flate2", "memchr", - "zstd 0.14.3", - "zstd-safe 8.2.0", + "zstd", + "zstd-safe", ] [[package]] @@ -4477,6 +4444,15 @@ version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6" +[[package]] +name = "constant_time_eq" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9" +dependencies = [ + "rustversion", +] + [[package]] name = "convert_case" version = "0.8.0" @@ -4854,6 +4830,15 @@ version = "0.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e2931af7e13dc045d8e9d26afccc6fa115d64e115c9c84b1166288b46f6782c2" +[[package]] +name = "ctutils" +version = "0.4.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "261af4dc7a06ea8a527a8717d8cbba3417530d6ea14e1edb3de6b67806be474f" +dependencies = [ + "cmov", +] + [[package]] name = "cursor-icon" version = "1.2.0" @@ -5090,17 +5075,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "derive_arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] - [[package]] name = "derive_builder" version = "0.20.2" @@ -5215,6 +5189,8 @@ dependencies = [ "block-buffer 0.12.0", "const-oid 0.10.2", "crypto-common 0.2.1", + "ctutils", + "zeroize", ] [[package]] @@ -5256,7 +5232,7 @@ dependencies = [ "libc", "option-ext", "redox_users 0.5.2", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -5579,7 +5555,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6167,7 +6143,7 @@ dependencies = [ "base64 0.22.1", "gcloud-metadata", "hex", - "hmac", + "hmac 0.12.1", "home", "jsonwebtoken", "path-clean", @@ -6238,7 +6214,7 @@ dependencies = [ "libc", "log", "rustversion", - "windows-link 0.1.3", + "windows-link 0.2.1", "windows-result 0.4.1", ] @@ -6731,7 +6707,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b305d85504de270ad3525d726a6b69cc59ee7b2269b014387651107ab9f0755b" dependencies = [ "bstr", - "hashbrown 0.16.1", + "hashbrown 0.17.1", ] [[package]] @@ -7339,6 +7315,9 @@ name = "hashbrown" version = "0.17.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" +dependencies = [ + "foldhash 0.2.0", +] [[package]] name = "hashlink" @@ -7414,7 +7393,7 @@ version = "0.12.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" dependencies = [ - "hmac", + "hmac 0.12.1", ] [[package]] @@ -7426,6 +7405,15 @@ dependencies = [ "digest 0.10.7", ] +[[package]] +name = "hmac" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" +dependencies = [ + "digest 0.11.2", +] + [[package]] name = "hmac-sha256" version = "1.1.12" @@ -7929,15 +7917,6 @@ dependencies = [ "libc", ] -[[package]] -name = "inout" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01" -dependencies = [ - "generic-array", -] - [[package]] name = "inout" version = "0.2.2" @@ -8239,7 +8218,7 @@ dependencies = [ "base64 0.22.1", "ed25519-dalek", "getrandom 0.2.16", - "hmac", + "hmac 0.12.1", "js-sys", "p256", "p384", @@ -8377,6 +8356,12 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" +[[package]] +name = "libbz2-rs-sys" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32f454fd6831a29c0e827ed075bca2a15be201bd57f4168f0fd1041124eab17e" + [[package]] name = "libc" version = "0.2.186" @@ -8598,24 +8583,12 @@ dependencies = [ ] [[package]] -name = "lzma-rs" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e" -dependencies = [ - "byteorder", - "crc", -] - -[[package]] -name = "lzma-sys" -version = "0.1.20" +name = "lzma-rust2" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27" +checksum = "f1c46f3fcd2e888afdb01a07efc071cb21300e07c68d32c3e8b01b5c8cb1fcaa" dependencies = [ - "cc", - "libc", - "pkg-config", + "sha2 0.11.0", ] [[package]] @@ -8877,7 +8850,7 @@ version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "536bfad37a309d62069485248eeaba1e8d9853aaf951caaeaed0585a95346f08" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -9174,7 +9147,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -9600,20 +9573,20 @@ dependencies = [ [[package]] name = "office_oxide" -version = "0.1.9" +version = "0.1.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e07e156a6bc62caaa66fc698daad7405dd62e86f5292fd22898c1a55f154748d" +checksum = "96174357b389a992d7864db7a7a10a1254b82716cdfc40bee54f1da1234291bf" dependencies = [ "atoi_simd", "encoding_rs", "fast-float2", - "libc", + "flate2", "log", - "quick-xml 0.41.0", + "quick-xml 0.42.0", "serde", "serde_json", "thiserror 2.0.18", - "zip 8.6.0", + "zip", ] [[package]] @@ -9820,7 +9793,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967" dependencies = [ "libc", - "windows-sys 0.45.0", + "windows-sys 0.61.2", ] [[package]] @@ -9914,12 +9887,12 @@ dependencies = [ [[package]] name = "pbkdf2" -version = "0.12.2" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" +checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629" dependencies = [ - "digest 0.10.7", - "hmac", + "digest 0.11.2", + "hmac 0.13.0", ] [[package]] @@ -9928,7 +9901,7 @@ version = "0.3.74" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1b97a8330bf3a3a4011ad84704b3bdcb9b0ef3fd5b03a1bdc371dde40bee1689" dependencies = [ - "aes 0.9.3", + "aes", "base64 0.22.1", "bitflags 2.13.0", "brotli 8.0.2", @@ -10476,6 +10449,12 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" +[[package]] +name = "ppmd-rust" +version = "1.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cd4acc8d264ea385db64ccfdcdfd5909ee9eda0975666723d59f3bfec80b3611" + [[package]] name = "pprof" version = "0.15.0" @@ -10904,6 +10883,15 @@ name = "quick-xml" version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" +dependencies = [ + "memchr", +] + +[[package]] +name = "quick-xml" +version = "0.42.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b" dependencies = [ "memchr", "serde", @@ -10962,7 +10950,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] @@ -11443,7 +11431,7 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" dependencies = [ - "hmac", + "hmac 0.12.1", "subtle", ] @@ -11681,7 +11669,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.4.15", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -11694,7 +11682,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.12.1", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -11764,7 +11752,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -12335,6 +12323,17 @@ dependencies = [ "digest 0.10.7", ] +[[package]] +name = "sha1" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "digest 0.11.2", +] + [[package]] name = "sha1-checked" version = "0.10.0" @@ -12342,7 +12341,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "89f599ac0c323ebb1c6082821a54962b839832b03984598375bff3975b804423" dependencies = [ "digest 0.10.7", - "sha1", + "sha1 0.10.6", ] [[package]] @@ -12744,7 +12743,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -13146,10 +13145,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.1", "once_cell", "rustix 1.1.4", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -13382,6 +13381,7 @@ checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ "deranged", "itoa", + "js-sys", "num-conv", "powerfmt", "serde_core", @@ -14078,7 +14078,7 @@ dependencies = [ "rand 0.9.5", "rustls", "rustls-pki-types", - "sha1", + "sha1 0.10.6", "thiserror 2.0.18", "utf-8", ] @@ -14096,9 +14096,9 @@ dependencies = [ [[package]] name = "typed-path" -version = "0.12.3" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e" +checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e" [[package]] name = "typenum" @@ -14189,7 +14189,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e" dependencies = [ "memoffset", "tempfile", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -14998,7 +14998,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] @@ -15745,7 +15745,7 @@ checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94" dependencies = [ "const-oid 0.9.6", "der", - "sha1", + "sha1 0.10.6", "signature", "spki", "tls_codec", @@ -15794,15 +15794,6 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9" -[[package]] -name = "xz2" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2" -dependencies = [ - "lzma-sys", -] - [[package]] name = "yaml-rust" version = "0.4.5" @@ -16008,43 +15999,31 @@ dependencies = [ [[package]] name = "zip" -version = "3.0.0" +version = "9.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12598812502ed0105f607f941c386f43d441e00148fce9dec3ca5ffb0bde9308" +checksum = "ec2e3161de27091f18a831d9494e9c53378a34833af5c1dda35ad85849da18d6" dependencies = [ - "aes 0.8.4", - "arbitrary", + "aes", "bzip2", - "constant_time_eq", + "constant_time_eq 0.6.1", "crc32fast", "deflate64", "flate2", - "getrandom 0.3.4", - "hmac", + "getrandom 0.4.1", + "hmac 0.13.0", "indexmap", - "lzma-rs", + "lzma-rust2", "memchr", + "nix 0.31.3", "pbkdf2", - "sha1", + "ppmd-rust", + "sha1 0.11.0", "time", - "xz2", - "zeroize", - "zopfli", - "zstd 0.13.3", -] - -[[package]] -name = "zip" -version = "8.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" -dependencies = [ - "crc32fast", - "flate2", - "indexmap", - "memchr", "typed-path", + "windows-sys 0.61.2", + "zeroize", "zopfli", + "zstd", ] [[package]] @@ -16077,31 +16056,13 @@ dependencies = [ "simd-adler32", ] -[[package]] -name = "zstd" -version = "0.13.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" -dependencies = [ - "zstd-safe 7.2.4", -] - [[package]] name = "zstd" version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70" dependencies = [ - "zstd-safe 8.2.0", -] - -[[package]] -name = "zstd-safe" -version = "7.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d" -dependencies = [ - "zstd-sys", + "zstd-safe", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 6ebe06d5..84b3e403 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -397,7 +397,7 @@ chutes-tool-types = { path = "crates/common/chutes-tool-types" } chutes-tracing = { path = "crates/common/chutes-tracing" } chutes-tty-utils = { path = "crates/codegen/chutes-tty-utils" } zbus = { version = "5" } -zip = "3" +zip = "9" zstd = "0.14" [profile.release] diff --git a/crates/codegen/chutes-tools/Cargo.toml b/crates/codegen/chutes-tools/Cargo.toml index 200e3269..5c245b56 100644 --- a/crates/codegen/chutes-tools/Cargo.toml +++ b/crates/codegen/chutes-tools/Cargo.toml @@ -48,7 +48,7 @@ pdf_oxide = { workspace = true } # `workspace = true`: the workspace `zip` pin has default features on, which # drag aes/bzip2/lzma/zstd into the shipped pager binary. PPTX entries are # only ever stored or deflated. -zip = { version = "3", default-features = false, features = ["deflate-flate2"] } +zip = { version = "9", default-features = false, features = ["deflate-flate2"] } quick-xml = { workspace = true } indexmap = { workspace = true, features = ["serde"] } minijinja = { version = "2", features = ["custom_syntax"] } diff --git a/crates/codegen/chutes-tools/src/implementations/read_file/pptx.rs b/crates/codegen/chutes-tools/src/implementations/read_file/pptx.rs index c10b2c9a..e83a143e 100644 --- a/crates/codegen/chutes-tools/src/implementations/read_file/pptx.rs +++ b/crates/codegen/chutes-tools/src/implementations/read_file/pptx.rs @@ -35,6 +35,7 @@ pub(crate) fn extract_pptx_text_from_bytes(bytes: &[u8]) -> Result = archive .file_names() .filter_map(|name| { + let name = name.ok()?; name.strip_prefix("ppt/slides/slide")? .strip_suffix(".xml")? .parse() diff --git a/crates/codegen/chutes-update/Cargo.toml b/crates/codegen/chutes-update/Cargo.toml index cd4d021e..c1f526eb 100644 --- a/crates/codegen/chutes-update/Cargo.toml +++ b/crates/codegen/chutes-update/Cargo.toml @@ -32,7 +32,7 @@ sha2 = { workspace = true } chutes-tty-utils = { workspace = true } # MinGit archive extraction. Not `workspace = true`: the workspace pin has # default features on (aes/bzip2/lzma/zstd); MinGit entries are only deflated. -zip = { version = "3", default-features = false, features = ["deflate-flate2"] } +zip = { version = "9", default-features = false, features = ["deflate-flate2"] } [target.'cfg(target_os = "macos")'.dependencies] libc = { workspace = true } diff --git a/crates/codegen/chutes-update/src/windows_payload.rs b/crates/codegen/chutes-update/src/windows_payload.rs index 71812265..24862168 100644 --- a/crates/codegen/chutes-update/src/windows_payload.rs +++ b/crates/codegen/chutes-update/src/windows_payload.rs @@ -150,17 +150,23 @@ pub(super) fn extract_zip(zip_path: &Path, dest: &Path) -> anyhow::Result<()> { let mut total: u64 = 0; for index in 0..archive.len() { let mut entry = archive.by_index(index).context("read zip entry")?; - let Some(relative) = entry.enclosed_name() else { - anyhow::bail!("archive entry escapes the destination: {}", entry.name()); - }; - if relative + let entry_name = entry + .name() + .map_err(|e| anyhow::anyhow!("read zip entry name: {e}"))? + .into_owned(); + // Check the raw entry name: `enclosed_name` normalizes `.` components away, so it cannot + // enforce the plain-name contract this function promises. + if std::path::Path::new(&entry_name) .components() .any(|c| !matches!(c, Component::Normal(_))) { - anyhow::bail!("archive entry escapes the destination: {}", entry.name()); + anyhow::bail!("archive entry escapes the destination: {entry_name}"); } + let Some(relative) = entry.enclosed_name() else { + anyhow::bail!("archive entry escapes the destination: {entry_name}"); + }; if entry.is_symlink() { - anyhow::bail!("archive entry is a symlink: {}", entry.name()); + anyhow::bail!("archive entry is a symlink: {entry_name}"); } let out = dest.join(relative); if entry.is_dir() { @@ -174,7 +180,7 @@ pub(super) fn extract_zip(zip_path: &Path, dest: &Path) -> anyhow::Result<()> { std::fs::File::create(&out).with_context(|| format!("create {}", out.display()))?; let budget = MAX_MINGIT_EXTRACTED_BYTES - total + 1; let written = std::io::copy(&mut entry.by_ref().take(budget), &mut out_file) - .with_context(|| format!("extract {}", entry.name()))?; + .with_context(|| format!("extract {entry_name}"))?; total += written; if total > MAX_MINGIT_EXTRACTED_BYTES { anyhow::bail!("archive expands past the {MAX_MINGIT_EXTRACTED_BYTES}-byte cap"); From 9588cabe1e7d4d37146b3ddb60b71ff507c5c0b7 Mon Sep 17 00:00:00 2001 From: Michael Gasperini Date: Fri, 6 Nov 2026 21:53:54 +0100 Subject: [PATCH 2/3] chore(deny): drop the closed zip advisories and record pin-utils The 3 to 9 migration closes RUSTSEC-2026-0367, -0368, -0369 and -0429, so their ignores are stale. RUSTSEC-2026-0441 (pin-utils unmaintained) arrives transitively through aws-smithy-http and has no released replacement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- deny.toml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/deny.toml b/deny.toml index 61e08715..8cc19f80 100644 --- a/deny.toml +++ b/deny.toml @@ -35,10 +35,7 @@ ignore = [ { id = "RUSTSEC-2026-0249", reason = "smartstring is unmaintained (repository archived 2026-05-03), not vulnerable — there is no affected API to avoid. It reaches us only as a non-optional dependency of rhai, the workflow scripting engine, and we are already on rhai's latest stable (1.25.1), so no bump closes it and nothing but dropping rhai would. Its own recommended alternatives (compact_str, smol_str) are rhai's migration to make." }, # Arrived with the 1.7.2 release gate (live DB, 2026-10-19). Same rule as # above: each reason records the reachability check that was run. - { id = "RUSTSEC-2026-0367", reason = "zip preserves SUID/SGID bits through ZipArchive::extract(). We never call extract(): pptx reads entries in memory by name, the Windows updater copies entries manually behind enclosed_name() with symlinks refused and created files never take archive modes, and the transitive office_oxide copy (zip 8.6) has zero .extract( call sites. Only a major 3→9 migration closes it." }, - { id = "RUSTSEC-2026-0368", reason = "zip extract() follows attacker symlinks. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide, and our manual copy path refuses symlinks outright. Only a major 3→9 migration closes it." }, - { id = "RUSTSEC-2026-0369", reason = "zip extract() applies Unix permissions through symlinks. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide. Only a major 3→9 migration closes it." }, - { id = "RUSTSEC-2026-0429", reason = "zip extract() sizes a symlink-target buffer from the archive's declared uncompressed size. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide; pptx reads entries by name in memory and the Windows updater copies entries manually behind enclosed_name() with symlinks refused. Only a major 3→9 migration closes it." }, + { id = "RUSTSEC-2026-0441", reason = "pin-utils is unmaintained, not vulnerable; it exposes only the pin_mut! and unsafe_pinned! macros and has no affected API to avoid. Transitive through aws-smithy-http in the AWS SDK, already at the latest release that still depends on it, so no bump closes it." }, { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is unmaintained (repository archived 2024-03-25), not vulnerable — there is no affected API to avoid. Transitive through serde_yaml 0.9 (mermaid-to-svg), already at its last release 0.2.11, so no bump closes it; the maintained replacement is serde_yaml's call to make." }, { id = "RUSTSEC-2026-0370", reason = "zvariant is unmaintained as a standalone crate (merged into zbus 6), not vulnerable. Transitive through zbus 5.14 (ashpd, dark-light theme detection); only a zbus 5→6 migration closes it." }, { id = "RUSTSEC-2026-0371", reason = "zbus_names is unmaintained as a standalone crate (merged into zbus 6), not vulnerable. Transitive through zbus 5.14 (ashpd, dark-light theme detection); only a zbus 5→6 migration closes it." }, From afb299308d35962be7005ac7aa487285e17228ca Mon Sep 17 00:00:00 2001 From: Michael Gasperini Date: Fri, 6 Nov 2026 20:21:56 +0100 Subject: [PATCH 3/3] docs(readme): remove table of contents and normalize badges Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/README.md b/README.md index 7234276f..f27f8432 100644 --- a/README.md +++ b/README.md @@ -3,27 +3,13 @@ A Chutes-native terminal coding agent [![CI](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TheStreamCode/chutes-build/actions/workflows/ci.yml) +[![License](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE) [![npm](https://img.shields.io/npm/v/chutes-build?logo=npm&color=cb3837)](https://www.npmjs.com/package/chutes-build) -[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE) ![Chutes Build TUI](assets/chutes/screenshot/chutes-build.png) Chutes Build is a terminal-based AI coding agent for the [Chutes](https://chutes.ai) ecosystem. It runs as a full-screen TUI (terminal user interface) that understands a codebase, edits files, executes shell commands, searches the web, and manages long-running tasks, interactively, headlessly for scripts and CI, or embedded in editors through the Agent Client Protocol (ACP). It is an independent, unofficial fork of [xai-org/grok-build](https://github.com/xai-org/grok-build) with Chutes-native inference, model routing, media and account endpoints, and it is not affiliated with or endorsed by xAI. -## Contents - -- [Install](#install) -- [Quick start](#quick-start) -- [Features](#features) -- [Requirements](#requirements) -- [Configuration](#configuration) -- [Privacy and security](#privacy-and-security) -- [Troubleshooting](#troubleshooting) -- [Development](#development) -- [Support](#support) -- [Contributing](#contributing) -- [License](#license) - ## Install Install the npm launcher, which resolves the native binary for the current platform: