[ShulhaOleh]

Summary

The security audit now fails on every branch because of three new advisories for the zip crate (RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369). All three are about ZipArchive::extract and ZipStreamReader::extract, which can apply file permissions and create links outside the target folder. Neither affects Modrex:

• Modrex never calls extract. Every archive is read entry by entry and written through safe_dest, the same reason the sevenz-rust advisory is already ignored. clippy.toml now forbids ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir, so CI fails if anyone starts using them. ZipStreamReader is not public in the zip version Modrex uses.
• The updater's own copy (zip 4 inside tauri-plugin-updater) only unpacks a zip after the minisign check, and createUpdaterArtifacts ships the signed NSIS installer itself, so no update Modrex installs is a zip.

The advisories are added to .cargo/audit.toml with that reasoning and a note to remove them once Modrex and the updater both use zip 9 or later.

Upgrading Modrex to zip 9 was tried first. It needs libbz2-rs-sys for bzip2 support, whose bzip2-1.0.6 license is not on the accepted list, so that upgrade is left for a separate decision. The latest stable tauri-plugin-updater still depends on zip 4.

Type of change

• Application/code
• Translation
• Documentation
• Other

Translation (if applicable)

• Language:
• Locale code:

See the translation guide.

Validation

• Full local repository checks (bun checks)
• Relevant local checks
• CI only
• Not applicable

Details:

cargo audit reports no vulnerabilities. cargo clippy --all-targets -- -D warnings passes, and a temporary call to ZipArchive::extract was rejected by it as a disallowed method. No dependency changes.

[github-actions]

Deploying Modrex previews with    Cloudflare Pages

App preview:	https://app-preview.modrex.net/pr/147
Site preview:	https://site-preview.modrex.net/pr/147

View logs: app | site