1a514b243c
Four advisories against the zstd crates, published October 2026, failed the repository check on every pull request: - RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks into the next stream on a reused context; - RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec length past its capacity; - RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a legacy frame's streaming decompression fails; - RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts memory on allocation failure. Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs, joule-moq-room and examples/transport-moqt. The one copy left is wasmtime 49's, under wasmtime-internal-cache, which compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm builds its engine from Config::new() with fuel metering only and never configures a cache, so zstd's code does not run in the sandbox. It is allowed in scripts/check-advisories.py at those exact versions, so a direct use regressing to them is not excused. Co-Authored-By: Claude Opus 5.5 <[email protected]>
31 lines
928 B
TOML
31 lines
928 B
TOML
[package]
|
|
name = "jwp"
|
|
version = "0.1.0"
|
|
description = "Joule Wire Protocol (JWP) — energy-aware binary framing protocol"
|
|
edition = "2024"
|
|
rust-version = "1.97"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/transaction-science/open-standards"
|
|
|
|
[features]
|
|
default = ["tcp"]
|
|
tcp = []
|
|
quic = ["dep:quinn"]
|
|
|
|
[dependencies]
|
|
tokio = { version = "1", features = ["sync", "rt", "macros", "io-util", "net", "time"] }
|
|
tokio-util = { version = "0.7", features = ["codec"] }
|
|
bytes = "1"
|
|
ciborium = "0.2"
|
|
blake3 = "1"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
thiserror = "2"
|
|
tracing = "0.1"
|
|
zstd = "0.14.3"
|
|
lz4_flex = "0.13"
|
|
futures-util = { version = "0.3", features = ["sink"] }
|
|
quinn = { version = "0.11", optional = true }
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1", features = ["test-util", "rt-multi-thread"] }
|