From b4cf1ddb0c665b4544735e46754906744e96933e Mon Sep 17 00:00:00 2001 From: Simon Scatton <44714756+SDAChess@users.noreply.github.com> Date: Mon, 19 Oct 2026 13:02:52 +0000 Subject: [PATCH] chore(deps): accept build-only zip advisories (#4710) Signed-off-by: Simon Scatton --- deny.toml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/deny.toml b/deny.toml index 62ce9a909..38f350bf9 100644 --- a/deny.toml +++ b/deny.toml @@ -21,6 +21,13 @@ ignore = [ { id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" }, { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" }, { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" }, + # zip is used only by z3-sys's build script with prebuilt-z3 enabled to + # extract upstream Z3 GitHub release assets, never runtime/user archives. + # Accept the build-time risk of a compromised upstream release asset until + # z3-sys supports zip >=9; remove these exceptions once it can be upgraded. + { id = "RUSTSEC-2026-0367", reason = "zip privileged permission bits — build-only Z3 release extraction; awaiting z3-sys support for zip >=9" }, + { id = "RUSTSEC-2026-0368", reason = "zip symlink target escape — build-only Z3 release extraction; awaiting z3-sys support for zip >=9" }, + { id = "RUSTSEC-2026-0369", reason = "zip permissions follow symlinks — build-only Z3 release extraction; awaiting z3-sys support for zip >=9" }, ] # -- Licenses ------------------------------------------------------------------