From 6bddbfa3c85de25ebf1e44215a9e34c64e12e5c7 Mon Sep 17 00:00:00 2001 From: GF Date: Thu, 29 Oct 2026 15:04:56 -0400 Subject: [PATCH] fix(deps): take libz-sys 1.1.31 for RUSTSEC-2026-0418 RUSTSEC-2026-0418, issued today, fails cargo-deny on libz-sys 1.1.29 and blocks the 0.13.1 release candidate. The libz-sys build script printed the whole build environment to its stdout, which Cargo keeps under target/, when built with cc 1.6 or later on Unix. Every J2K lockfile pins cc 1.2.64, so these builds did not write the environment and no secret needs rotating. The root lock and the j2k-t803 and j2k-tilecodec fuzz locks move to 1.1.31; nothing else changes. The 0.13.1 changelog records it, since `cargo install --locked j2k-cli` builds from the packaged lock. --- CHANGELOG.md | 6 ++++++ Cargo.lock | 4 ++-- crates/j2k-t803/fuzz/Cargo.lock | 4 ++-- crates/j2k-tilecodec/fuzz/Cargo.lock | 4 ++-- 4 files changed, 12 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53eff671..eb5f6535 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -122,6 +122,12 @@ and stale roadmap entries have been removed from the public documentation set. `Image::decode_region_rows_for_integer_output_with_context` and `ComponentRowSink` expose this for other callers. +- Security: the lockfiles move to libz-sys 1.1.31, which fixes + RUSTSEC-2026-0418. Its build script printed the build environment into + `target/` when built with cc 1.6 or later on Unix. J2K's locked builds use + cc 1.2 and were not affected. `cargo install --locked j2k-cli` now builds + the fixed version. + ## [0.13.0] - 2026-10-26 - Migration from 0.12.0: exhaustive native `EncodeOptions` literals must add diff --git a/Cargo.lock b/Cargo.lock index 7b299514..347c680e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3066,9 +3066,9 @@ dependencies = [ [[package]] name = "libz-sys" -version = "1.1.29" +version = "1.1.31" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9" +checksum = "ff20308ecabd635a2dc1dd5834a86c462cca20efba1d5d3ddab1f8aea3455cb2" dependencies = [ "cc", "pkg-config", diff --git a/crates/j2k-t803/fuzz/Cargo.lock b/crates/j2k-t803/fuzz/Cargo.lock index 200a6c23..92a3db00 100644 --- a/crates/j2k-t803/fuzz/Cargo.lock +++ b/crates/j2k-t803/fuzz/Cargo.lock @@ -390,9 +390,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981" [[package]] name = "libz-sys" -version = "1.1.29" +version = "1.1.31" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9" +checksum = "ff20308ecabd635a2dc1dd5834a86c462cca20efba1d5d3ddab1f8aea3455cb2" dependencies = [ "cc", "pkg-config", diff --git a/crates/j2k-tilecodec/fuzz/Cargo.lock b/crates/j2k-tilecodec/fuzz/Cargo.lock index 407a3e73..fe39e786 100644 --- a/crates/j2k-tilecodec/fuzz/Cargo.lock +++ b/crates/j2k-tilecodec/fuzz/Cargo.lock @@ -126,9 +126,9 @@ dependencies = [ [[package]] name = "libz-sys" -version = "1.1.29" +version = "1.1.31" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9" +checksum = "ff20308ecabd635a2dc1dd5834a86c462cca20efba1d5d3ddab1f8aea3455cb2" dependencies = [ "cc", "pkg-config",