Skip to content

fix(deps): update zstd to 0.14.3 to clear the zstd and zstd-safe advisories - #628

Closed
vdavid wants to merge 1 commit into
rustic-rs:mainfrom
vdavid:zstd-0.14
Closed

vdavid wants to merge 1 commit into
rustic-rs:mainfrom
vdavid:zstd-0.14

Conversation

@vdavid

@vdavid vdavid commented Oct 28, 2026

Copy link
Copy Markdown

zstd 0.13 (with zstd-safe 7) carries the 13 advisories the audit job opened issues for. 0.14.3 clears all of them: the zstd one is patched in 0.14.3, the zstd-safe ones in 8.2.0, which 0.14.3 pulls in.

Why I want this: My file manager Cmdr's restic browser runs on this bump, and its tests read real zstd-compressed v2 repos.

This PR closes #614, closes #615, closes #616, closes #617, closes #618, closes #619, closes #620, closes #621, closes #622, closes #623, closes #624, closes #625, closes #626

Renovate's dashboard (#1) has 0.14 waiting inside the big grouped Rust update, my PR pulls it out on its own.

No code changes needed: rustic_core builds as is, and this is the only zstd in the tree (cargo tree -i zstd). What I tested:

  • cargo test --all-targets --all-features --workspace --examples: same results as main. The same seven integration snapshot tests fail on main (for example chunker-fixedsize is missing error_count), the rest pass.
  • cargo clippy --all-targets --all-features -- -D warnings: eight redundant_field_names errors with clippy 1.99, also on main, none from this change.

@aawsome

aawsome commented Oct 30, 2026

Copy link
Copy Markdown
Member

This is superseded by #629

@aawsome aawsome closed this Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment