Repository navigation
fix(deps): update self_update to 1.3, so zip moves past its advisories - #827
Merged
Merged
Conversation
zip 6.0.0 is affected by GHSA-m665-v7pm-7grj (critical, fixed in 9.0.5), GHSA-9hj8-73fh-9963, GHSA-q7v9-x93c-xqv3 and GHSA-8hxf-qr8p-62x4 (fixed in 9.0.0). Dependabot could not move it: zip comes only from self_update, and self_update 0.44 requires zip ^6. self_update 1.3 requires zip ^9, which now resolves to 9.3.0. self_update 1.x renamed or regrouped features and changed its API: - the GitHub backend is the `github` feature, tar.gz support is `compression-tar-gz` (was `compression-flate2`), and the download progress bar is `progress-bar`; the same set is enabled as before; - the release list is `Releases` (`latest()`), releases and assets have accessor methods, and `Download` takes `request_header` and `show_download_progress`; - `TempDir` and `self_replace` are no longer re-exported, so their crates are now optional dependencies of the `self-update` feature. `cook update --force` was run end to end on Linux against the v0.40.0 release: listed, downloaded, checked, extracted and replaced. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MmrM91dHzvQoaerCcR9wra
The release workflow packs the Windows binary with `7z a`, which deflates `cook.exe`, but self_update was built without zip's `deflate` (`compression-zip-deflate`): `cook update` on Windows downloaded and checked the release, then refused it with "Compression method not supported". The v0.40.0 Windows zip is deflated; a zip built as before cannot read it, one with `deflate` reads all of it. A test extracts `cook.exe` from a small deflated fixture packed the same way, with the call the updater makes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MmrM91dHzvQoaerCcR9wra
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #825
Closes #826
fix(deps):self_update0.44 → 1.3, sozip6.0.0 → 9.3.0zipcomes only fromself_update, whose 0.44 requireszip ^6. That's why Dependabot couldn't fix alerts #105–#108 (fixed in 9.0.0 / 9.0.5).self_update1.3 requireszip ^9, which resolves to 9.3.0.self_update1.x regrouped its features and changed its API. The same capabilities are enabled as before:github; tar.gz iscompression-tar-gz(wascompression-flate2); the download progress bar isprogress-bar(always built in under 0.44).Releases(latest()is the first release, as.first()was); releases and assets have accessor methods;Downloadtakesrequest_header/show_download_progress.TempDirandself_replaceare no longer re-exported, sotempfileandself-replace(already in the tree) are optional dependencies of theself-updatefeature.Lock:
indicatif,self-replace,tempfileandnixcome in throughself_update1.3;arbitrary,quick-xmlandunit-prefixgo away.fix(update): unpack the Windows releaseThe Windows release zip is packed with
7z a, which deflatescook.exe, butzipwas built withoutdeflate. Socook updateon Windows has refused every release since 669899f. Enablingcompression-zip-deflatefixes it (it addszopfli).Tests
cook update --check-onlyandcook update --forcerun end to end on Linux against the v0.40.0 release, from a copy of the built binary. It lists, downloads, checks the SHA-256, extracts the tar.gz and replaces the copy, which then runs as 0.40.0.zip6 as built before refuses it ("Compression method not supported");zip9 withdeflateextracts all ofcook.exe.update::tests::extracts_cook_from_a_deflated_zip: a 145-byte fixture packed like the release (tests/fixtures/update/cook-deflated.zip), extracted with the updater's ownExtractcall. It fails withoutcompression-zip-deflate(CompressionMethodNotSupported(8)).cargo fmt,cargo clippy --all-targetsclean.cargo test --workspace: 1879 passed. The Docker feature set (--no-default-features --features server,lsp) and a build withoutself-updateboth check.cook updateon an actual Windows machine.🤖 Generated with Claude Code
https://claude.ai/code/session_01MmrM91dHzvQoaerCcR9wra