From 3892928dc3b6c755e0b16780ca6a271d6907fc2e Mon Sep 17 00:00:00 2001 From: Dietmar Rietsch Date: Sat, 17 Oct 2026 09:04:47 +0200 Subject: [PATCH] deny: ignore the zip extract() advisories for calamine's zip 8 only RUSTSEC-2026-0367/0368/0369 concern ZipArchive::extract and ZipStreamReader::extract writing an archive to disk. zip 8.6.0 reaches this workspace only through calamine 0.36.1, which has no release on zip >= 9; neither this workspace nor calamine calls extract(). Each entry says so and comes out when calamine moves to zip 9. Co-Authored-By: Claude Opus 5.5 --- deny.toml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/deny.toml b/deny.toml index 9d1c512..2d63ba8 100644 --- a/deny.toml +++ b/deny.toml @@ -18,6 +18,17 @@ ignore = [ # vulnerable — RUSTSEC-2024-0436 is informational. Pre-existing; revisit # when boa moves off it. No license/security boundary impact. "RUSTSEC-2024-0436", + # zip 8.6.0 reaches this workspace only through `calamine` 0.36.1, which no + # release has moved to zip >= 9 yet. All three advisories (2026-10-09/10) + # are about `ZipArchive::extract` / `ZipStreamReader::extract` writing an + # archive to the file system (SUID/SGID bits kept, symlinks escaping the + # destination, permissions applied through symlinks). Neither this + # workspace nor calamine 0.36.1 calls either function: calamine reads the + # XLSX in memory, entry by entry. Remove these three when calamine + # depends on zip >= 9. Recorded 2026-10-17. + { id = "RUSTSEC-2026-0367", reason = "zip 8 via calamine only; extract() is never called" }, + { id = "RUSTSEC-2026-0368", reason = "zip 8 via calamine only; extract() is never called" }, + { id = "RUSTSEC-2026-0369", reason = "zip 8 via calamine only; extract() is never called" }, ] [licenses]