[fengmk2]

Motivation

cargo deny in Vite+'s Security Analysis fails on every PR that changes Cargo.lock, because vt locks zstd 0.13.3 and zstd-safe 7.2.4. The check reports three vulnerabilities in these crates:

• RUSTSEC-2026-0391: data from an abandoned stream leaks into the next stream on a reused context. Fixed in zstd 0.14.3.
• RUSTSEC-2026-0398: Seekable::decompress sets a Vec length beyond its capacity. Fixed in zstd-safe 8.2.0.
• RUSTSEC-2026-0403: a failed streaming decompression of a legacy frame exposes uninitialized memory. Fixed in zstd-safe 8.2.0.

RustSec published ten more zstd-safe soundness advisories on the same day, and 8.2.0 fixes them too. No zstd-safe 7.x release gets these fixes, so this raises the workspace requirement to zstd 0.14. The lockfile changes only zstd, zstd-safe, and zstd-sys, and the cache archive code compiles unchanged.

This repository's Security Analysis runs cargo deny only when a PR changes Cargo.lock, so earlier PRs here did not report these advisories. On this PR it reports advisories ok.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​zstd@​0.13.3 ⏵ 0.14.3

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.09%  [ -2.87% ..  +4.38%]  overhead   +55.27%
dynamic/access             change  +0.00%  [ -5.27% ..  +4.54%]  overhead   +20.78%
dynamic/access-relative    change  +0.00%  [-15.69% ..  +9.11%]  overhead   +65.67%
dynamic/access-contended   change  -4.60%  [-13.78% ..  +5.90%]  overhead   +11.47%
static/launch              change  +0.54%  [ -5.05% ..  +6.53%]  overhead  +186.66%
static/access              change  +0.29%  [ -1.85% ..  +2.05%]  overhead +1462.72%
static/access-relative     change  +0.74%  [ -1.02% ..  +2.37%]  overhead +1965.39%
static/access-contended    change  +0.22%  [ -2.78% ..  +2.72%]  overhead +1926.96%

macos

dynamic/launch             change  +0.37%  [ -3.17% ..  +4.12%]  overhead  +227.21%
dynamic/access             change  +0.00%  [ -2.65% ..  +2.82%]  overhead    +4.80%
dynamic/access-relative    change  -0.44%  [ -2.29% ..  +2.42%]  overhead  +272.94%
dynamic/access-contended   change  +0.29%  [ -3.92% ..  +4.19%]  overhead    +4.84%

windows

dynamic/launch             change  -0.82%  [ -6.39% ..  +5.66%]  overhead   +23.94%
dynamic/access             change  +0.00%  [ -1.84% ..  +0.92%]  overhead    +1.31%
dynamic/access-relative    change  +0.18%  [ -1.09% ..  +1.44%]  overhead    +1.28%
dynamic/access-contended   change  +0.00%  [ -4.40% ..  +1.43%]  overhead    +1.45%