Dependências: zip 9 e ruzstd 0.9 (RUSTSEC-2026-0368, RUSTSEC-2026-0344 e afins)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/guara-core/Cargo.toml

@@ -20,9 +20,9 @@ flate2 = { version = "1", default-features = false, features = ["rust_backend"]
 thiserror = "2"
 tiny_http = "0.12"
 bzip2 = "0.6"
-zip = { version = "2", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 snap = "1"
-ruzstd = "0.7"
+ruzstd = "0.9"
 lz4_flex = { version = "0.11", default-features = false, features = ["safe-decode", "safe-encode"] }
 aes = "0.8"
 hmac = "0.12"

crates/guara-core/src/aff4.rs

@@ -298,10 +298,14 @@ impl Aff4Source {
         let mut entries = HashMap::new();
         for i in 0..zip.len() {
             let f = zip.by_index_raw(i).map_err(|e| Error::msg(e.to_string()))?;
+            let name = f.name().map_err(zerr)?.into_owned();
+            let data_start = f
+                .data_start()
+                .ok_or_else(|| Error::msg(format!("AFF4: entrada sem início de dados: {name}")))?;
             entries.insert(
-                f.name().to_string(),
+                name,
                 Loc {
-                    data_start: f.data_start(),
+                    data_start,
                     size: f.compressed_size(),
                 },
             );

crates/guara-core/src/fs/btrfs.rs

@@ -723,7 +723,7 @@ fn decode(codec: u8, raw: &[u8], ram: usize) -> Option<Vec<u8>> {
         }
         2 => {
             use std::io::Read;
-            let mut dec = ruzstd::StreamingDecoder::new(raw).ok()?;
+            let mut dec = ruzstd::decoding::StreamingDecoder::new(raw).ok()?;
             let mut v = Vec::with_capacity(ram);
             dec.read_to_end(&mut v).ok()?;
             Some(v)

crates/guara-core/src/types.rs

@@ -170,7 +170,7 @@ impl Packed {
             }
             PackedCodec::Zstd => {
                 let mut v = Vec::with_capacity(self.ram_len as usize);
-                ruzstd::StreamingDecoder::new(&raw[..])
+                ruzstd::decoding::StreamingDecoder::new(&raw[..])
                     .map_err(|_| bad("zstd"))?
                     .read_to_end(&mut v)
                     .map_err(|_| bad("zstd"))?;