Hauser
84e24e7673
* chore(deps): refresh crates and adopt released aws-sigv4 Run two update/upgrade rounds for the main and standalone fuzz workspaces. Replace the temporary SigV4a Git override with aws-sigv4 1.6.4 from the registry and remove its obsolete source permission. Pin OpenID Connect to e20ddbb01ca68356f2979bc125f5613ab45b4e7e. Upgrade async-nats to 0.51.0, hotpath to 0.30.0, libunftp to 0.24.0, and the TOML test dependency to 1.1.8. Retain Arrow/Parquet 59.3.2 for DataFusion 55.2.0 and keep the fuzz PKCS#1 version compatible with pinned RSA rc.18. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * fix(deps): retain safe openidconnect pin against HMAC panic The e20ddbb pin verifies HMAC signatures with mac.verify(signature.into()), which panics in generic-array on malformed length instead of returning InvalidIdentityToken. Retain the previous reviewed pin that uses verify_slice and add a malformed-signature regression covering HS256, HS384, and HS512. * chore(deps): upgrade sysinfo to 0.40.0 Update the main and standalone fuzz lockfiles. Adapt fallible system queries, CPU usage accessors, and OS-native network interface names. Preserve process sampling fallbacks and report unavailable diagnostic sources without panicking. Cover missing host and process collectors. Validation: 167 focused tests passed; production and all five fuzz targets passed cargo check. Formatting, logging guardrails, and the existing dependency policy passed. Linux and Windows runtime checks were not run. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * fix(ci): use the admin error facade for sysinfo failures Keep the sysinfo initialization error behind the existing admin S3 facade. The facade builds the same error code and message without expanding the direct S3 error-macro surface guarded by the migration ratchet. Validation: S3 footprint guard, formatting, whitespace, and production cargo check with sftp, hotpath, and connect_top_net passed. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * chore(deps): refresh hotpath and ctutils (#9055) Run two cargo update/upgrade rounds in both the main and fuzz workspaces on top of PR #9047. Upgrade the hotpath family to 0.30.1 and ctutils to 0.4.7. Retain fuzz pkcs1 0.8.0-rc.4 for the pinned RSA 0.10.0-rc.18; rc.5 fails to compile against that RSA version. Validation: 1096 library tests passed with 19 skipped; upstream ctutils and hotpath-drain property/concurrency suites passed. Production and all five fuzz targets passed cargo check. Formatting, S3 footprint, and the existing dependency policy passed. Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: zhi22915 <qiuzgang@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: zhi22915 <qiuzgang@gmail.com>
Fixed zstd dependency adapter
Use this when: maintaining the dependency bridge for consumers that still require zstd 0.13.
This private package satisfies the version constraints of Avro, Arrow IPC, Parquet, and Kafka. Its version is a resolver compatibility identifier. Its entire library is a re-export of the exact registry zstd 0.14.3 implementation, including that implementation's zstd-safe types. The original zstd 0.13 implementation and zstd-safe 7.x are removed from the resolved graph. Every old feature and the default feature set is forwarded.
The fixed implementation closes RUSTSEC-2026-0391, RUSTSEC-2026-0398, and RUSTSEC-2026-0403. A successful advisory scan alone is insufficient evidence: cargo-deny skips local path packages. The dependency-graph test therefore requires this adapter's sole runtime dependency to be the exact fixed registry implementation and rejects vulnerable registry codec versions. Security tests exercise abandoned stream contexts, malformed legacy frames, and seekable offsets past EOF. Consumer tests retain zstandard support in all four upstream formats.
Run cargo nextest run --locked -p zstd@0.13.3 for the focused tests. The seekable feature is enabled by a test-only dependency to cover the optional vulnerable API without enabling it in production.
Remove this package and the root Cargo patch when all consumers accept the fixed zstd release line directly. The cleanup marker is registered in the architecture compatibility register.