[brujack]

Summary

• main fails cargo deny check advisories. The blocking cargo-audit job runs it, so no PR can auto-merge (8 advisories plus 1 unmaintained crate; the lockfile was untouched since fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 #130).
• rustls 0.23.45 → 0.23.46 (RUSTSEC-2026-0346..0349). zip 2 → 9 (RUSTSEC-2026-0367..0369). Turned off tealr's default features, which removes a second zip 2 and ureq 2.
• unsafe-libyaml (RUSTSEC-2024-0449) is triaged as an ignore because no fix exists. The bzip2-1.0.6 licence is now allowed.

Changes

• lib/Cargo.toml: zip = "9". tealr now has default-features = false and keeps derive. This turns off compile as well as embed_compiler_from_download. etch uses neither compile_inline_teal! nor embed_compiler!, and both features only gate those macros.
• Cargo.lock: rustls 0.23.46, zip 9.0.5, quinn-proto 0.11.19. quinn-proto is a lockfile-only crate, and this bump clears 5 raw-cargo audit advisories. ureq 2, webpki-roots 0.26 and bzip2-sys are gone.
• deny.toml: added an ignore for RUSTSEC-2024-0449, because serde_yaml_ng 0.10.0 is the latest release and still depends on unsafe-libyaml. Allowed the bzip2-1.0.6 licence, which comes in through libbz2-rs-sys; zip 2 already linked the same bzip2 code through bzip2-sys.
• cargo-audit-scheduled.yml: added RUSTSEC-2026-0249 to the ignore list. It was already ignored in deny.toml but missing here, so the two lists had drifted. Also added RUSTSEC-2024-0449.
• Backlog rows:
  • The scheduled cargo audit still reports RUSTSEC-2026-0306 and -0205, which cargo deny does not.
  • The zip extract can leave a truncated file behind on failure. This is pre-existing.
  • Optionally, narrow zip to the deflate feature only.

Test Plan

• make test on Linux: 1129/1129 nextest and 64 pytest passed.
• cargo deny check: advisories, bans, licenses and sources all ok.
• Mac Studio (macOS 27.0.1): cargo build --release ok, and the binary tests passed 59/59.
• bug-scan extracted 6 real-world zips (Info-ZIP, Info-ZIP with bzip2, Python deflate/lzma/streamed, data-descriptor). Every one was byte-identical to its source.
• Coverage: no source change.

Risk

Low. No .rs change. extract.rs reads one named entry through ZipArchive::new, by_name and io::copy, and never calls extract. zip 9's default compression methods include everything zip 2's did. perf-regression passed: the worst ratio was 1.01x after re-runs.

Definition of Done

Phase 3 gates: perf PASS, security PASS, dependency-review PASS, test-quality SKIP (no testable code), diff-scope PASS, bug-scan PASS (forced, because its trigger misses lib/Cargo.toml; the gap is backlogged in ai-config), migration-classifier code-only, maintainability SKIP, pr-review PASS.

Spec alignment

SKIP: no plan or spec (dependency-CVE fix via bug-fix-cycle).

Related

Blocks the file.flags chflags fix PR, which follows.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Aux8gVLuPWbaZnmeza37Mu