Repository navigation
build(deps): drop the zstd advisory ignores once the pingora fork bumps zstd #448
Description
#442 ignores four zstd advisories in .cargo/audit.toml and crates/gateway/deny.toml to unblock the gateway audit and deny checks. This issue tracks removing those ignores.
Why the ignores exist
The gateway reaches zstd only through the praxis-proxy/pingora fork. quixotic-plecostomus-header-serde 0.11.1 requires zstd ^0.13.1 and zstd-safe ^7.1.0, and quixotic-plecostomus-core requires zstd ^0. The fixes ship in zstd 0.14.3 and zstd-safe 8.2.0, so the gateway lockfile cannot move until the fork does. The fork has issues turned off, so this issue is the tracker.
Reachability at 0633868
| Advisory | Crate | Reachable | Why |
|---|---|---|---|
| RUSTSEC-2026-0391 | zstd with_context |
no | core builds owned encoder contexts through Encoder::new and with_dictionary |
| RUSTSEC-2026-0398 | zstd-safe seekable | no | the seekable feature is off, so the module is not compiled |
| RUSTSEC-2026-0403 | zstd-safe legacy stream decode | no | core has no zstd decompressor, and header-serde makes only one-shot calls, which the advisory excludes |
| RUSTSEC-2026-0410 | zstd-sys wasm allocator | no | wasm32 only, and the gateway ships for linux x86_64 and aarch64 |
Ten unsound advisories against the same crates (RUSTSEC-2026-0395 through 0406, less those above) stay as warnings. Each needs a feature that is off (experimental, zstdmt, seekable) or an API the fork does not call.
legacy stays compiled: core takes zstd with default features, which include it, and features add up across the graph, so the gateway cannot turn it off.
Done when
- The fork releases with zstd 0.14.3 or later and zstd-safe 8.2.0 or later in core and header-serde. header-serde's thread-local contexts in
thread_zstd.rsneed checking against the 8.x API. - The gateway takes that release and drops the four ignores from both files.
cargo audit --file crates/gateway/Cargo.lockandcargo deny --manifest-path crates/gateway/Cargo.toml --config crates/gateway/deny.toml checkpass with no zstd entries ignored.
Worth asking the fork to take zstd with default-features = false and legacy off, since nothing in it decodes zstd streams.
Activity