[rob-p]

Summary

This PR bumps zstd from 0.13.2 to 0.14.3 and liblzma from 0.3.1 to 0.4. Both are optional dependencies, enabled by the default compression feature.

Why

• Security advisories. On 2026-10-16, RustSec published advisories against the zstd crates. Any project that enables needletail's default features inherits them:

  • RUSTSEC-2026-0391 (zstd < 0.14.3);
  • RUSTSEC-2026-0398 and -0403 (zstd-safe < 8.2.0);
  • RUSTSEC-2026-0410 (zstd-sys < 2.1.2).

  cargo audit flags all of these for downstream crates. zstd 0.14.3 resolves to zstd-safe 8.2.0 and zstd-sys 2.1.2, the patched versions.

• links = "lzma" conflicts. liblzma 0.3 and 0.4 both link the native lzma library, so only one can be in a dependency graph. niffler ≥ 3.0.1 uses liblzma 0.4, so any project that uses needletail with compression is pinned to niffler 3.0.0. niffler 3.0.0 in turn depends on zstd 0.13, so these projects can't clear the advisories above.

Compatibility

• needletail uses only zstd::stream::read::Decoder and liblzma::read::XzDecoder, plus the corresponding write encoders in tests. Their APIs are unchanged in zstd 0.14 and liblzma 0.4, so no code changes are needed.
• Neither crate's types appear in needletail's public API.
• zstd 0.13 and 0.14 bundle the same C library (zstd 1.5.7), so .zst decoding behaves identically.

Testing

• cargo test (default features): all tests pass, including the compressed-input round trips for gz, bz2, xz and zst.
• cargo test --no-default-features: all tests pass.
• cargo clippy --all-targets: no new warnings.
• Downstream: with this change, a Rust RNA-seq quantifier (salmon) that uses needletail through two dependencies resolves to niffler 3.0.2, zstd 0.14.3 and liblzma 0.4.9, and cargo audit reports no vulnerabilities.

A CHANGELOG.md entry is added under Unreleased.

[audy]

Thanks!

[audy]

@rob-p released 0.7.4 to pypi+crates https://github.com/onecodex/needletail/releases/tag/v0.7.4