[rubas-agent]

Before

task deps:deny fails on main and on every PR since RustSec published the zstd advisories on 2026-10-26 (run 40376822315):

error[vulnerability]: Data from an abandoned stream leaks into the next stream on a reused context
    ├ ID: RUSTSEC-2026-0391
    ├ Solution: Upgrade to >=0.14.3 (try `cargo update -p zstd`)
error[vulnerability]: `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
    ├ ID: RUSTSEC-2026-0398
    ├ Solution: Upgrade to >=8.2.0 (try `cargo update -p zstd-safe`)
error[vulnerability]: Uninitialized memory exposed when streaming decompression of a legacy frame fails
    ├ ID: RUSTSEC-2026-0403
    ├ Solution: Upgrade to >=8.2.0 (try `cargo update -p zstd-safe`)
advisories FAILED

Problem

The fix is in zstd 0.14.3 and zstd-safe 8.2.0, but we cannot update. zstd 0.13.3 comes in only through wreq-util 0.2.0, and that release, the newest on crates.io, needs zstd ^0.13.3. cargo update -p zstd locks 0 packages. Upstream has the bump in the open Dependabot PR 0x676e67/wreq-util#130, which passes its CI but has no release.

Our build does not reach the vulnerable code. wreq-util uses zstd only for TLS certificate compression, through zstd::stream::write::Encoder::new and zstd::stream::read::Decoder::new:

Advisory	Affected code	Our build
RUSTSEC-2026-0391	raw::Encoder::with_context, raw::Decoder::with_context	Not called. The two constructors create their own context.
RUSTSEC-2026-0398	zstd_safe::seekable::*	Not compiled. The seekable feature is off.
RUSTSEC-2026-0403	DCtx::decompress_stream through stream::write::Decoder	Not called. The advisory says that read::Decoder is not affected.

After

deny.toml ignores the three IDs, each with its reason, under a TODO(revert) that names the upstream PR. task ci passes:

advisories ok, bans ok, sources ok

When a wreq-util release moves us to zstd 0.14.3, cargo-deny prints warning[advisory-not-detected] for each ignore, so the list does not stay behind unseen.

Details

The chain is kagi > wreq-util 0.2.0 (default feature emulation) > zstd 0.13.3 > zstd-safe 7.3.0. cargo tree -e features -i zstd-safe@7.3.0 shows the features arrays, legacy, std, and zdict_builder, and no seekable. The calls are in wreq-util src/emulate/compress.rs, ZstdCompressor::compress and ZstdCompressor::decompress. In zstd 0.13.3, zstd::stream::Encoder and zstd::stream::Decoder are the write::Encoder and read::Decoder, and their new goes through with_dictionary, not with_context.

zstd-safe 7.3.0 also has 10 unsound advisories (RUSTSEC-2026-0395 to 0406 without 0398 and 0403). cargo-deny does not fail on them for a transitive crate, and the same wreq-util release fixes them.

A git patch of wreq-util was the other option. It needs allow-git in deny.toml, and it brings the unreleased upstream main, with new impersonation profiles and a wreq git pin, into our release build.

I checked zstd and zstd-safe in all our Rust repos. rubas/babel already has zstd 0.14.3, and rubas/cloaked_req gets the same ignore for its nightly cargo audit.

task ci passes in the worktree. I also checked that an ignore for an ID that does not match gives warning[advisory-not-detected].

[rubas-agent]

Its change now rides in #60, which moves the Claude review to babel. This PR could not pass on its own: its review runs the old workflow of main, whose setup tokens are all at their limit, while #60 needed this ignore to pass deps:deny. #60 merges both.