From 8a1dbb82631f5312e3277b1d5b91b74d665afa00 Mon Sep 17 00:00:00 2001 From: GoldenNugget CI Date: Fri, 30 Oct 2026 21:28:03 +0300 Subject: [PATCH] Bump zip to 9.1 for the Dependabot security alerts zip 8.6.0 (isideload 0.5.2's ^8.3 resolution) is inside the alert ranges of GHSA-m665-v7pm-7grj (critical, CVE-2026-115905, fixed 9.0.5) and the four 9.0.0 advisories. The security fixes only live in zip 9.x, so this branch raises the requirement; the engine pipeline compiles isideload's zip 9 API usage unchanged. upstream PR candidate; GoldenNugget drives gn-sideload on this branch --- isideload/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/isideload/Cargo.toml b/isideload/Cargo.toml index 29d385e..40fd0b4 100644 --- a/isideload/Cargo.toml +++ b/isideload/Cargo.toml @@ -51,7 +51,7 @@ tokio = { version = "1.49" } keyring = { version = "3.6.3", features = ["apple-native", "linux-native-sync-persistent", "windows-native"], optional = true } rcgen = { version = "0.14.7", default-features = false, features = ["ring", "pem"] } p12-keystore = { version = "0.3.0-rc4", package = "isideload-p12-keystore" } -zip = { version = "8.3", default-features = false, features = ["deflate"] } +zip = { version = "9.1", default-features = false, features = ["deflate"] } isideload-vfs = { version = "0.0.1" } #, path = "../../isideload-apple-platform-rs/isideload-vfs" } sha1 = "0.11.0" rustls = { version = "0.23", default-features = false, features = ["ring", "tls12", "std"] }