Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

build(deps): drop the zstd advisory ignores once the pingora fork bumps zstd

Open
  • Is something wrong?
#448 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
devops

Research direction

Start by checking the zstd dependency versions in the pingora fork's core and header-serde crates, including the thread-local contexts in thread_zstd.rs; the issue says the fork has disabled issues, so this repository tracks the required release. Once the gateway takes a release with zstd 0.14.3+ and zstd-safe 8.2.0+, remove the four advisory ignores from .cargo/audit.toml and crates/gateway/deny.toml. Run the two listed cargo audit and cargo deny commands and confirm no zstd entries remain ignored.

Written by the indexing model from the issue text.

Description

triage/needs-triage

#442 ignores four zstd advisories in .cargo/audit.toml and crates/gateway/deny.toml to unblock the gateway audit and deny checks. This issue tracks removing those ignores.

Why the ignores exist

The gateway reaches zstd only through the praxis-proxy/pingora fork. quixotic-plecostomus-header-serde 0.11.1 requires zstd ^0.13.1 and zstd-safe ^7.1.0, and quixotic-plecostomus-core requires zstd ^0. The fixes ship in zstd 0.14.3 and zstd-safe 8.2.0, so the gateway lockfile cannot move until the fork does. The fork has issues turned off, so this issue is the tracker.

Reachability at 0633868f

Advisory Crate Reachable Why
RUSTSEC-2026-0391 zstd with_context no core builds owned encoder contexts through Encoder::new and with_dictionary
RUSTSEC-2026-0398 zstd-safe seekable no the seekable feature is off, so the module is not compiled
RUSTSEC-2026-0403 zstd-safe legacy stream decode no core has no zstd decompressor, and header-serde makes only one-shot calls, which the advisory excludes
RUSTSEC-2026-0410 zstd-sys wasm allocator no wasm32 only, and the gateway ships for linux x86_64 and aarch64

Ten unsound advisories against the same crates (RUSTSEC-2026-0395 through 0406, less those above) stay as warnings. Each needs a feature that is off (experimental, zstdmt, seekable) or an API the fork does not call.

legacy stays compiled: core takes zstd with default features, which include it, and features add up across the graph, so the gateway cannot turn it off.

Done when

  • The fork releases with zstd 0.14.3 or later and zstd-safe 8.2.0 or later in core and header-serde. header-serde's thread-local contexts in thread_zstd.rs need checking against the 8.x API.
  • The gateway takes that release and drops the four ignores from both files.
  • cargo audit --file crates/gateway/Cargo.lock and cargo deny --manifest-path crates/gateway/Cargo.toml --config crates/gateway/deny.toml check pass with no zstd entries ignored.

Worth asking the fork to take zstd with default-features = false and legacy off, since nothing in it decodes zstd streams.

Dominant language
Rust
Stars
10
Forks
24
Avg merge
1d 14h
Merged PRs (30d)
156

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from praxis-proxy/grid

All issues in praxis-proxy/grid

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.