sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410; CI: the avx2 leg on the framework runner #492

Merged

dcharlot merged 2 commits from sec/zstd-avx2-2026-10-26 into main 2026-10-26 12:47:02 -04:00

Conversation 0 Commits 2 Files changed 10 +71 -38

dcharlot commented 2026-10-26 11:37:15 -04:00

Owner

Copy link

Supersedes #491: the same two commits, on current main, pushed once. A second push to #491 cancelled the first commit's checks, and this forge runs only the workflows a push's own changes match, so the zstd change's checks would never have run again there.

Four advisories against the zstd crates, published October 2026, fail the repository check (scripts/check-advisories.py) on every pull request:

Advisory	Crate, fixed in	What it is
RUSTSEC-2026-0391	zstd ≥ 0.14.3	data from an abandoned stream leaks into the next stream on a reused context
RUSTSEC-2026-0398	zstd-safe ≥ 8.2.0	Seekable::decompress sets a Vec length past its capacity
RUSTSEC-2026-0403	zstd-safe ≥ 8.2.0	uninitialised memory when a legacy frame's streaming decompression fails
RUSTSEC-2026-0410	zstd-sys ≥ 2.1.2	the wasm allocator shim corrupts memory on allocation failure

Every direct use moves

• wai: zstd 0.14.3, zstd-safe 8.2.
• jwp and joule-moq-interop: zstd 0.14.3.
• Five lockfiles change exactly the three zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs, joule-moq-room and examples/transport-moqt.

The one copy left: allowed, at its exact versions

It is wasmtime 49's, under wasmtime-internal-cache, which compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm builds its engine from Config::new() with fuel metering only and never configures a cache, so zstd's code does not run in the sandbox. The four entries in ALLOW name those exact versions (zstd 0.13.3, zstd-safe 7.2.4, zstd-sys 2.0.16+zstd.1.5.7), so a direct use regressing to them is not excused.

Checked on the build host

• python3 scripts/check-advisories.py passes: 48 lockfiles, 19 allowed advisories.
• Every lockfile that holds wai or jwp reads cargo metadata --locked with no change.
• jwp passes its 154 tests.
• joule-moq-interop and joule-moq-room build.
• wai-rs builds with neural (zstd_safe::decompress), and its text codec tests (zstd::stream) pass.
• wai-rs/fuzz checks.

And the avx2 leg on the linux label's second runner

The linux label now has two runners: jetson-hub, whose processor has avx2, and framework-128gb-linux (since 2026-10-26), whose processor has avx512 too.

The avx2 leg of wai-quantum-vector.yml declared avx2 alone. On the framework, the engine's probe found both, so all nine device tests failed (#487's run, task 29781). On silicon the declaration now comes from the kernel's own flags (avx512f in /proc/cpuinfo), never from the probe under test. The leg checks the avx2 member as before: its 256-bit length, its four bit-exact certificates and its three killed mutants.

Both fixes unblock every pull request, which is why they travel together.

🤖 Generated with Claude Code

Supersedes #491: the same two commits, on current main, pushed once. A second push to #491 cancelled the first commit's checks, and this forge runs only the workflows a push's own changes match, so the zstd change's checks would never have run again there. Four advisories against the zstd crates, published October 2026, fail the repository check (`scripts/check-advisories.py`) on every pull request: | Advisory | Crate, fixed in | What it is | |---|---|---| | RUSTSEC-2026-0391 | zstd ≥ 0.14.3 | data from an abandoned stream leaks into the next stream on a reused context | | RUSTSEC-2026-0398 | zstd-safe ≥ 8.2.0 | `Seekable::decompress` sets a `Vec` length past its capacity | | RUSTSEC-2026-0403 | zstd-safe ≥ 8.2.0 | uninitialised memory when a legacy frame's streaming decompression fails | | RUSTSEC-2026-0410 | zstd-sys ≥ 2.1.2 | the wasm allocator shim corrupts memory on allocation failure | ## Every direct use moves - **`wai`:** zstd 0.14.3, zstd-safe 8.2. - **`jwp` and `joule-moq-interop`:** zstd 0.14.3. - **Five lockfiles** change exactly the three zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs, joule-moq-room and examples/transport-moqt. ## The one copy left: allowed, at its exact versions It is wasmtime 49's, under `wasmtime-internal-cache`, which compresses compiled modules for wasmtime's on-disk cache. `sandbox-exec-wasm` builds its engine from `Config::new()` with fuel metering only and never configures a cache, so zstd's code does not run in the sandbox. The four entries in `ALLOW` name those exact versions (zstd 0.13.3, zstd-safe 7.2.4, zstd-sys 2.0.16+zstd.1.5.7), so a direct use regressing to them is not excused. ## Checked on the build host - `python3 scripts/check-advisories.py` passes: 48 lockfiles, 19 allowed advisories. - Every lockfile that holds `wai` or `jwp` reads `cargo metadata --locked` with no change. - `jwp` passes its 154 tests. - `joule-moq-interop` and joule-moq-room build. - wai-rs builds with `neural` (`zstd_safe::decompress`), and its text codec tests (`zstd::stream`) pass. - wai-rs/fuzz checks. ## And the avx2 leg on the `linux` label's second runner The `linux` label now has two runners: jetson-hub, whose processor has avx2, and `framework-128gb-linux` (since 2026-10-26), whose processor has avx512 too. The avx2 leg of `wai-quantum-vector.yml` declared avx2 alone. On the framework, the engine's probe found both, so all nine device tests failed (#487's run, task 29781). On silicon the declaration now comes from the kernel's own flags (`avx512f` in `/proc/cpuinfo`), never from the probe under test. The leg checks the avx2 member as before: its 256-bit length, its four bit-exact certificates and its three killed mutants. Both fixes unblock every pull request, which is why they travel together. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 2 commits 2026-10-26 11:37:15 -04:00

sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410 ... 1a514b243c

Four advisories against the zstd crates, published October 2026, failed
the repository check on every pull request:
- RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks
  into the next stream on a reused context;
- RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec
  length past its capacity;
- RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a
  legacy frame's streaming decompression fails;
- RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts
  memory on allocation failure.

Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and
joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three
zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs,
joule-moq-room and examples/transport-moqt.

The one copy left is wasmtime 49's, under wasmtime-internal-cache, which
compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm
builds its engine from Config::new() with fuel metering only and never
configures a cache, so zstd's code does not run in the sandbox. It is
allowed in scripts/check-advisories.py at those exact versions, so a
direct use regressing to them is not excused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CI: the avx2 leg declares the units the runner's processor has ... cb88dd7fa1

The `linux` label now has two runners: jetson-hub, whose processor has
avx2, and framework-128gb-linux (since 2026-10-26), whose processor has
avx512 too. The avx2 leg declared avx2 alone, so on the framework the
engine's probe found avx2 and avx512, the declaration did not match, and
all nine device tests failed (#487's run, task 29781).

On silicon the declaration now comes from the kernel's own flags (avx512f
in /proc/cpuinfo), never from the probe under test, and the leg checks
the avx2 member exactly as before: its 256-bit length, its four bit-exact
certificates and its three killed mutants.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 0855f00d1a into main 2026-10-26 12:47:02 -04:00

dcharlot referenced this pull request from a commit 2026-10-26 12:47:04 -04:00

Merge pull request 'sec: zstd 0.14.3 for RUSTSEC-2026-0391, -0398, -0403 and -0410; CI: the avx2 leg on the framework runner' (#492) from sec/zstd-avx2-2026-10-26 into main

dcharlot referenced this pull request 2026-10-26 12:52:24 -04:00

wai-quantum: the person's rules for proposals, checked change by change #494

dcharlot referenced this pull request 2026-10-26 17:15:43 -04:00

wai merge train E: twenty-five PRs onto main, the relay's upstream window bounded, and three fixes the merged tree needed #499

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

Merge origin/main (0855f00d1): #492, zstd 0.14.3 and the avx2 leg on the framework runner

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

joule-moq-remote (#481): its lock on zstd 0.14.3, as #492 moved every other

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!492

No description provided.