deps: upgrade updater to remove vulnerable zip (#8476)

* fix(deps): update updater to patched zip release Upgrade tauri-plugin-updater to 2.14.1 and resolve the lockfile without vulnerable zip 4.6.1. Assisted-by: Copilot SDK Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> * chore(deps): align updater package versions Upgrade the PNPM updater plugin to match the Rust updater crate at 2.14.1. Assisted-by: Copilot SDK Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> --------- Signed-off-by: ❤是纱雾酱哟～ <49941141+Dragon1573@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-10-31 03:02:08 +08:00 · 2026-10-30 15:04:34 +00:00
parent bdea31a7ca
commit c236f5094e
4 changed files with 30 additions and 62 deletions
@@ -136,15 +136,6 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "arboard"
 version = "3.6.1"
@@ -1176,7 +1167,7 @@ dependencies = [
 "windows-service",
 "windows-sys 0.61.2",
 "winreg 0.56.0",
- "zip 9.1.3",
+ "zip",
 ]

 [[package]]
@@ -1871,17 +1862,6 @@ dependencies = [
 "serde_core",
 ]

-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "derive_more"
 version = "2.1.1"
@@ -2035,7 +2015,7 @@ dependencies = [
 "libc",
 "option-ext",
 "redox_users 0.5.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2294,7 +2274,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2810,7 +2790,7 @@ dependencies = [
 "gobject-sys 0.21.5",
 "libc",
 "system-deps 7.0.8",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4235,7 +4215,7 @@ dependencies = [
 "png 0.18.1",
 "serde",
 "thiserror 2.0.20",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4402,7 +4382,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4879,7 +4859,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.45.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5544,7 +5524,7 @@ dependencies = [
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6061,7 +6041,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6120,7 +6100,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6740,7 +6720,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -7576,11 +7556,11 @@ dependencies = [

 [[package]]
 name = "tauri-plugin-updater"
-version = "2.14.0"
+version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7259989d4fe11b2bf51f7d671642249b1837c4ae2da1430dc713ae38f98ceeec"
+checksum = "d957abbcb3f9f6c76d22a3a0f012f30880640d0bccb5634d2b12a9937e4c872b"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
 "dirs 7.0.0",
 "flate2",
 "futures-util",
@@ -7605,7 +7585,7 @@ dependencies = [
 "tokio",
 "url",
 "windows-sys 0.61.2",
- "zip 4.6.1",
+ "zip",
 ]

 [[package]]
@@ -7806,10 +7786,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -8475,7 +8455,7 @@ dependencies = [
 "png 0.18.1",
 "serde",
 "thiserror 2.0.20",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -8584,7 +8564,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
 "memoffset",
 "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -9126,7 +9106,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -9147,7 +9127,7 @@ dependencies = [
 "objc2-foundation",
 "objc2-quartz-core",
 "raw-window-handle",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 "windows-version",
 ]

@@ -9722,7 +9702,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
 dependencies = [
 "cfg-if",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -10053,18 +10033,6 @@ dependencies = [
 "syn 3.0.5",
 ]

-[[package]]
-name = "zip"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "indexmap 2.14.0",
- "memchr",
-]
-
 [[package]]
 name = "zip"
 version = "9.1.3"
@@ -60,7 +60,7 @@
    "@tauri-apps/plugin-fs": "2.7.1",
    "@tauri-apps/plugin-http": "2.8.3",
    "@tauri-apps/plugin-opener": "2.7.2",
-    "@tauri-apps/plugin-updater": "2.14.0",
+    "@tauri-apps/plugin-updater": "2.14.1",
    "ahooks": "^3.10.0",
    "cidr-block": "^2.3.0",
    "compare-versions": "^6.1.1",
@@ -218,8 +218,8 @@ importers:
        specifier: 2.7.2
        version: 2.7.2
      '@tauri-apps/plugin-updater':
-        specifier: 2.14.0
-        version: 2.14.0
+        specifier: 2.14.1
+        version: 2.14.1
      ahooks:
        specifier: ^3.10.0
        version: 3.10.0(react-dom@19.3.1(react@19.3.1))(react@19.3.1)
@@ -2221,8 +2221,8 @@ packages:
  '@tauri-apps/plugin-opener@2.7.2':
    resolution: {integrity: sha512-LyybP1VSzTMQiaFYcsbAse47KpivlyXdLZMQzGLEnkgQacGESnpjAfFoQ6h5sqWgAdZDH9szYjPzHMpv0Sz+TQ==}

-  '@tauri-apps/plugin-updater@2.14.0':
-    resolution: {integrity: sha512-gdylJ9tger4hkyOn24QZd6MNOKVo2Eh53iw5th2Qj1vKTR/+u4PIwJWuiis5hohYvobn6iOvlnALfrqIPSzh7Q==}
+  '@tauri-apps/plugin-updater@2.14.1':
+    resolution: {integrity: sha512-Hr7nlBm1wT6xbwzjZ/S36YULazu8MNlj5vvOwMl47fXI7HTa5Bjl1PbDEwVHaZTAKzE1VZsUy35UqnbrQxmYQw==}

  '@tsrs/darwin-arm64@0.20.0-ts7.1.0-beta':
    resolution: {integrity: sha512-mhHj8QGUmdJDBvJEnMXx5P/jvAKXYU3hy/z3qxrWBo8XHlbLES32PgC0ZpTRbJA960ReTpVqqvCOYaC6EL32/Q==}
@@ -6949,7 +6949,7 @@ snapshots:
    dependencies:
      '@tauri-apps/api': 2.12.4

-  '@tauri-apps/plugin-updater@2.14.0':
+  '@tauri-apps/plugin-updater@2.14.1':
    dependencies:
      '@tauri-apps/api': 2.12.4

@@ -79,7 +79,7 @@ tauri-plugin-fs = "2.7.1"
 tauri-plugin-process = "2.4.0"
 tauri-plugin-deep-link = "2.6.2"
 tauri-plugin-window-state = "2.5.0"
-zip = "9.0.4"
+zip = "9.1.3"
 flate2 = "1.1.10"
 reqwest_dav = "0.3.3"
 aes-gcm = { version = "0.11.1" }
@@ -154,7 +154,7 @@ windows-sys.workspace = true
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-autostart = "2.7.0"
 tauri-plugin-global-shortcut = "2.4.1"
-tauri-plugin-updater = "2.14.0"
+tauri-plugin-updater = "2.14.1"

 [dev-dependencies]
 criterion = { workspace = true }