Repository navigation
zip 6.0.0 has four open advisories (one critical); self_update 0.44 pins it to ^6 #825
Description
Dependabot reports four open advisories on zip 6.0.0 (alerts #105–#108), and can't open a fix itself:
| Advisory | Severity | Fixed in |
|---|---|---|
| GHSA-m665-v7pm-7grj: parser differential via dual-header inconsistencies ("zip cloaking") | critical | 9.0.5 |
| GHSA-9hj8-73fh-9963: legacy Shrink/Reduce/Implode decoder DoS from a ZIP64 size | high | 9.0.0 |
| GHSA-q7v9-x93c-xqv3: unbounded symlink-target handling during extraction | high | 9.0.0 |
| GHSA-8hxf-qr8p-62x4: AES entry HMAC authentication bypass on premature EOF | medium | 9.0.0 |
zip comes only from self_update (the self-update feature, cook update), and self_update 0.44 requires zip ^6, so cargo update can't move it. self_update 1.3 requires zip ^9.
What CookCLI unpacks with it is the release archive it just downloaded from this repository's own releases, after checking its SHA-256. So the practical exposure is low, but the alerts stay open and the crate is several majors behind.
Activity