[Cuarroc]

Das Updater-Plugin ist jetzt auf Version 2.14.1 angehoben; dadurch löst sich die Windows-Zip-Abhängigkeit von der verwundbaren Version 4.6.1 auf die gepatchte 9.1.3 auf. Die drei zip-Sicherheitsmeldungen (RUSTSEC-2026-0367/0368/0369) verschwinden im Audit ohne jede Ausnahmeregel. Das ist ein Entwurf: die Quelle ist geliefert, die eigene PLAN-Zeile folgt durch den Stabschef, und die Windows-Bahn läuft erst in der Merge-Queue.

Report

Status: source delivered, own PLAN row pending Stabschef follow-up before review-ok. DRAFT, no Ready/queue. Ticket #358, BASE c46b94a.

What changed (112 diff lines incl. tests; PLAN row reserved, not edited)

• src-tauri/Cargo.toml: tauri-plugin-updater = "2" -> "2.14.1" (default features unchanged).
• src-tauri/Cargo.lock: cargo update -p tauri-plugin-updater --precise 2.14.1 (dry run first, same result): updater 2.14.0 -> 2.14.1, zip 4.6.1 -> 9.1.3; adds cfg_aliases 0.2.2, nix 0.31.3, typed-path 0.13.0 (MIT/Apache-2.0, zip 9 dependencies); drops arbitrary/derive_arbitrary 1.4.2. No unrelated version moved.
• NEW scripts/lib/updater-zip-security.test.mjs: reads the committed lock/manifest, follows the updater's own zip reference (incl. a disambiguating version), resolves the exact locked package, requires major >= 9 (advisory minimum 9.0.0) and the manifest floor 2.14.1. No cargo, network or mocks.
• No src-tauri/src change was needed (no API repair, no seam touched).

Evidence

• RED at base-tree lock (commit 5ddebea): node --test scripts/lib/updater-zip-security.test.mjs exit 1, updater 2.14.0 depends on zip 4.6.1, advisory minimum is 9.0.0.
• GREEN at head 2a2f525: same command exit 0 (1 pass).
• bash scripts/ci/red-first.sh exit 0 (merge-base missing/red, head green).
• cargo audit --json --file src-tauri/Cargo.lock (cargo-audit 0.22.2, advisory-db 40f5be6fb12ed93fc591bf4ab23b7d793b3f2239 from 2026-10-28T09:50+01:00, freshly fetched): base lock exit 1 with 5 vulnerabilities = RUSTSEC-2026-0367/0368/0369 (zip 4.6.1, patched >=9.0.0) + RUSTSEC-2026-0382 (rustls-webpki 0.103.15) + RUSTSEC-2026-0383 (webpki-root-certs 1.0.9); head lock exit 1 with 2 vulnerabilities = 0382 and 0383 only. The three zip IDs are gone, no ignore added. Warnings unchanged on both (proc-macro-error, zbus_names, zvariant, zvariant_derive unmaintained; glib, tokio 1.53.1 unsound).
• Locked Windows tree: cargo tree --locked --manifest-path src-tauri/Cargo.toml --target x86_64-pc-windows-msvc -i zip exit 0: zip v9.1.3 -> tauri-plugin-updater v2.14.1 -> projecta. Linux tree has no zip (Windows-only edge).
• Read-only controls on Linux (CARGO_TARGET_DIR slot7, jobs 1), all exit 0, no zero-test filter: cargo test --bin projecta delivery_recovery 69 passed; update_cancel 12; signature 3; updater 5; digest 21 (journal digest/version binding).
• bash scripts/ci/gates.sh lane prepush in this worktree: exit 0 (includes secret scan and architecture-drift; nothing allowlisted). Push hook ran, remote SHA verified via git ls-remote = 2a2f525.

Architecture drift: none.

NICHT ABGEDECKT

• Windows compile of the updater branch (#[cfg(windows)], Error::Extract now wrapping zip 9's type): only the Linux Rust target is installed here, so the Windows lane in the merge queue must compile it. Lock/tree resolution for Windows is shown above, compilation is not.
• Update install, installed-client drill, release/UAT: not run (no real installer launch); dependency merge is not an effective update.
• New/unrelated findings RUSTSEC-2026-0382 / 0383 (rustls-webpki, webpki-root-certs) remain on the head lock: separate Root disposition, not ignored here.
• Updater 2.14.1 tag hash 128190689dbe... was taken from the task, not re-verified against upstream by me; the lock checksum comes from crates.io.
• Server could not expose native goal/usage_overview functions; used the dispatcher snapshot admission.json and own start check (dev:start-check exit 0: 13.4 GB free, 0 cargo builds). Model observed: claude-sonnet-5-5, CLAUDE_EFFORT=high.

Review: ausstehend (Stufe A, zwei verschiedene Nicht-Autor-Familien; Orchestrator reiht ein).

Proposed own PLAN row (<=15 lines, for Stabschef serial follow-up on this branch):
| SEC-01b | Updater 2.14.1 / gepatchte Windows-zip-Kante; Quelle PR <nr> | Root bindet Owner (Ticket #358) | – | Server | A | Quelle geliefert (Entwurf), Review ausstehend | Lock: updater 2.14.1, zip 9.1.3 (>= 9.0.0); cargo audit ohne RUSTSEC-2026-0367/0368/0369 und ohne Ignore; Windows-Kompilierung in der Merge-Queue offen; 0382/0383 separat | #358 | and in line 14 replace "die zip-Behandlung ist entschieden, noch nicht geliefert" by "die zip-Quelle ist als Entwurf geliefert (PR ), Review und Windows-Bahn offen".

🤖 Generated with Claude Code