From 17d77acccdc61f8587c44db1da3f2bc2fb4a33bb Mon Sep 17 00:00:00 2001 From: Azer Sadykhzadeh Date: Sat, 17 Oct 2026 09:05:35 +0000 Subject: [PATCH] Suppress the zip extraction advisories the updater pins us to, with a review date tauri-plugin-updater 2.13 and 2.14 require zip 4, so the 9.x fix cannot be taken, and the advisories fail security-audit on every PR. The vulnerable extract only runs on Windows, for a zip whose signature the updater has already verified, and Clavyn ships NSIS executables there. --- .cargo/audit.toml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 14c208f9..8d5991cb 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -18,4 +18,20 @@ ignore = [ # signing with a stored RSA key. Ed25519 and ECDSA keys are not affected. # review-by: 2026-12-31 "RUSTSEC-2023-0071", + + # zip 4.6.1: symlinks and Unix permissions (including SUID/SGID) applied + # outside the destination by `ZipArchive::extract`. Fixed in zip 9, but + # tauri-plugin-updater 2.13 and 2.14 still require zip 4, and its `zip` + # feature cannot be turned off: the same feature carries the tar.gz path the + # macOS and AppImage updates use. The plugin only extracts a zip on Windows, + # inside `install` after `download` has verified the minisign signature + # against the key in tauri.conf.json, and Clavyn's Windows updates are NSIS + # executables, not zips. Exploiting it takes an archive signed with the + # release key. Drop these once the updater moves to zip >= 9. + # review-by: 2026-12-31 + "RUSTSEC-2026-0367", + # review-by: 2026-12-31 + "RUSTSEC-2026-0368", + # review-by: 2026-12-31 + "RUSTSEC-2026-0369", ]