Dependências: zip 9 e ruzstd 0.9 (RUSTSEC-2026-0368, RUSTSEC-2026-0344 e afins)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.lock

@@ -69,15 +69,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "argon2"
 version = "0.5.3"
@@ -278,12 +269,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -305,17 +290,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -853,9 +827,9 @@ dependencies = [
 
 [[package]]
 name = "ruzstd"
-version = "0.7.3"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fad02996bfc73da3e301efe90b1837be9ed8f4a462b6ed410aa35d00381de89f"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
 dependencies = [
  "twox-hash",
 ]
@@ -937,12 +911,6 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886"
 
-[[package]]
-name = "static_assertions"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -1044,13 +1012,15 @@ dependencies = [
 
 [[package]]
 name = "twox-hash"
-version = "1.6.3"
+version = "2.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
-dependencies = [
- "cfg-if",
- "static_assertions",
-]
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
 
 [[package]]
 name = "typenum"
@@ -1178,16 +1148,16 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "zip"
-version = "2.6.1"
+version = "9.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dcb24d0152526ae49b9b96c1dcf71850ca1e0b882e4e28ed898a93c41334744"
+checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e"
 dependencies = [
- "arbitrary",
  "crc32fast",
- "crossbeam-utils",
  "flate2",
  "indexmap",
  "memchr",
+ "nix",
+ "typed-path",
  "zopfli",
 ]
 

crates/guara-core/Cargo.toml

@@ -20,9 +20,9 @@ flate2 = { version = "1", default-features = false, features = ["rust_backend"]
 thiserror = "2"
 tiny_http = "0.12"
 bzip2 = "0.6"
-zip = { version = "2", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 snap = "1"
-ruzstd = "0.7"
+ruzstd = "0.9"
 lz4_flex = { version = "0.11", default-features = false, features = ["safe-decode", "safe-encode"] }
 aes = "0.8"
 hmac = "0.12"

crates/guara-core/src/aff4.rs

@@ -298,10 +298,14 @@ impl Aff4Source {
         let mut entries = HashMap::new();
         for i in 0..zip.len() {
             let f = zip.by_index_raw(i).map_err(|e| Error::msg(e.to_string()))?;
+            let name = f.name().map_err(zerr)?.into_owned();
+            let data_start = f
+                .data_start()
+                .ok_or_else(|| Error::msg(format!("AFF4: entrada sem início de dados: {name}")))?;
             entries.insert(
-                f.name().to_string(),
+                name,
                 Loc {
-                    data_start: f.data_start(),
+                    data_start,
                     size: f.compressed_size(),
                 },
             );

crates/guara-core/src/fs/btrfs.rs

@@ -723,7 +723,7 @@ fn decode(codec: u8, raw: &[u8], ram: usize) -> Option<Vec<u8>> {
         }
         2 => {
             use std::io::Read;
-            let mut dec = ruzstd::StreamingDecoder::new(raw).ok()?;
+            let mut dec = ruzstd::decoding::StreamingDecoder::new(raw).ok()?;
             let mut v = Vec::with_capacity(ram);
             dec.read_to_end(&mut v).ok()?;
             Some(v)

crates/guara-core/src/types.rs

@@ -170,7 +170,7 @@ impl Packed {
             }
             PackedCodec::Zstd => {
                 let mut v = Vec::with_capacity(self.ram_len as usize);
-                ruzstd::StreamingDecoder::new(&raw[..])
+                ruzstd::decoding::StreamingDecoder::new(&raw[..])
                     .map_err(|_| bad("zstd"))?
                     .read_to_end(&mut v)
                     .map_err(|_| bad("zstd"))?;