Repository navigation
fix(deps): take libz-sys 1.1.31 for RUSTSEC-2026-0418 - #307
Merged
Merged
Conversation
RUSTSEC-2026-0418, issued today, fails cargo-deny on libz-sys 1.1.29 and blocks the 0.13.1 release candidate. The libz-sys build script printed the whole build environment to its stdout, which Cargo keeps under target/, when built with cc 1.6 or later on Unix. Every J2K lockfile pins cc 1.2.64, so these builds did not write the environment and no secret needs rotating. The root lock and the j2k-t803 and j2k-tilecodec fuzz locks move to 1.1.31; nothing else changes. The 0.13.1 changelog records it, since `cargo install --locked j2k-cli` builds from the packaged lock.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RUSTSEC-2026-0418, issued today, fails cargo-deny on libz-sys 1.1.29 and
blocks the 0.13.1 release candidate. The libz-sys build script printed the
whole build environment to its stdout, which Cargo keeps under target/, when
built with cc 1.6 or later on Unix. Every J2K lockfile pins cc 1.2.64, so
these builds did not write the environment and no secret needs rotating.
The root lock and the j2k-t803 and j2k-tilecodec fuzz locks move to 1.1.31;
nothing else changes. The 0.13.1 changelog records it, since
cargo install --locked j2k-clibuilds from the packaged lock.Testing
cargo deny --locked check: advisories, bans, licenses and sources ok.cargo xtask release-integrity,cargo xtask release-integrity --publishandcargo xtask repo-lintpass.cargo metadata --locked --offline.