[davlgd]

Problem

cargo deny check advisories fails on main with 17 advisories published since the last CI run (rustls, rustls-webpki, webpki-roots, quinn-proto, zip, crypto-bigint). Every PR and release pipeline will fail on it.

The Clippy job is also red on main: current stable Clippy reports clippy::double_must_use on code generated by async-trait 0.1.89.

Root cause

Cargo.lock pins versions released before these advisories. zip is constrained to 8.6, and the fixes for RUSTSEC-2026-0367/0368/0369 only exist in 9.x. crypto-bigint 0.5 (RUSTSEC-2026-0387) comes from the sigv4a feature of aws-sigv4, which has no release on the fixed 0.7.x line yet.

Solution

Lockfile refresh

cargo update within the existing semver ranges, no manifest change:

• rustls 0.23.45 -> 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)
• rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0382)
• webpki-roots 1.0.8 -> 1.0.11 (RUSTSEC-2026-0381)
• quinn-proto 0.11.16 -> 0.11.19 (RUSTSEC-2026-0338/0339/0340/0341/0342)
• tokio 1.52.3 -> 1.54.1, ctutils 0.4.2 -> 0.4.5, chacha20 0.10.1 -> 0.10.2 (unsound/yanked warnings)
• async-trait 0.1.89 -> 0.1.92, which fixes the Clippy failure

zip 8.6 -> 9.1

Fixes RUSTSEC-2026-0367/0368/0369. rc does not call extract(), which these advisories target, but the check fails on them regardless.

ZipFile::name() now returns a Result since names are decoded on demand. The IAM and bucket-metadata importers map a decoding failure to their existing "unreadable entry" error. zip 9.1 requires Rust 1.88, within the 1.92 MSRV.

Ignore RUSTSEC-2026-0387 (crypto-bigint)

Documented ignore in deny.toml, next to the existing RSA entry. rc aliases only sign with SigV4, and SigV4a is only used for Multi-Region Access Point ARNs. To be removed once aws-sigv4 depends on crypto-bigint >= 0.7.6.

Alternative: dropping the sigv4a feature from aws-sdk-s3 would remove the dependency entirely, at the cost of MRAP support.

Validation

• cargo fmt --all --check - pass
• cargo clippy --workspace --all-targets --locked -- -D warnings - pass, zero warnings
• cargo test --workspace - pass, 2686 passed, 0 failed
• cargo test -p rustfs-cli --features golden --test golden - pass
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps - pass
• cargo build --workspace with Rust 1.92 (MSRV, Linux) - pass
• cargo deny check advisories - pass