[Sadykhzadeh]

Refs #18.

Why

On 2026-10-09/10, RustSec published three advisories against zip < 9: RUSTSEC-2026-0367 (SUID/SGID preserved on extract, 7.3), RUSTSEC-2026-0368 (symlinks pointing outside the destination) and RUSTSEC-2026-0369 (permissions applied through symlinks, 9.1). zip 4.6.1 reaches the tree only through tauri-plugin-updater. Since then cargo audit fails security-audit on every PR, this one's base included.

Why a suppression rather than an upgrade

• No upgrade path. tauri-plugin-updater 2.13.0 and the newest 2.14.0 both declare zip = "4". There's nothing to bump to.
• The feature can't be dropped. The plugin's zip feature also gates the tar/flate2 code that unpacks the macOS .app.tar.gz and AppImage updates. Disabling it would break updates on those platforms.
• The vulnerable code is behind the signature. ZipArchive::extract is called only on Windows, from install(). Clavyn calls download_and_install, where download() verifies the minisign signature against plugins.updater.pubkey before install() runs. Clavyn's Windows updates are also NSIS executables, not zips. Reaching the vulnerable path takes an archive signed with the release key.

Each entry carries a review-by: 2026-12-31 date. check-audit-expiry.mjs passes, and will fail CI on that date if the updater still pins zip 4.

Verified

• node scripts/verify/check-audit-expiry.mjs: ok, 4 entries dated.
• cargo audit against Consolidate the four open dependency bumps and clear the npm production audit #128's Cargo.lock, which fixes the open quinn-proto and rustls advisories, with this audit.toml: exit 0. Only the informational proc-macro-error and glib notices remain, and CI runs those with continue-on-error.

Merge order

Together with #128 this turns security-audit green. Either can land first.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[greptile-apps]

TREX could not finish testing

• Plan what to test
• Set up the environment and test the changed flows
• Post test results

[qodo-code-review]

PR Summary by Qodo

Add dated audit suppressions for updater zip advisories

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Suppress three zip extraction advisories while tauri-plugin-updater requires the affected zip
 version.
• Document the limited exposure and require review of each suppression by 2026-12-31.

Diagram

graph TD
  CI["Security audit CI"] --> Expiry["Expiry check"] --> Config["Dated ignores"]
  CI --> Audit["Cargo audit"] --> Config

Loading

High-Level Assessment

Dated, narrowly scoped suppressions fit the current dependency constraint. Upgrading cannot remove zip 4 while the updater requires it, and disabling the feature would disrupt macOS and AppImage updates; revisit the ignores when the updater supports a fixed zip version.

Files changed (1) +16 / -0

Other (1) +16 / -0

audit.tomlSuppress three updater zip advisories until review +16/-0

Suppress three updater zip advisories until review

• Adds ignores for RUSTSEC-2026-0367, RUSTSEC-2026-0368, and RUSTSEC-2026-0369. Documents why an upgrade is unavailable, the limited extraction exposure, and a 2026-12-31 review date for each entry.

.cargo/audit.toml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review