fix(deps): patch wasmtime, register the yanked zip

.cargo/yanked-register.txt

@@ -0,0 +1,42 @@
+# Yanked crates the security audit tolerates, and for how long.
+#
+# `cargo audit --deny yanked` fails on any yanked crate and has no way to name
+# one it should leave alone: its `--ignore` takes advisory IDs, and a yanked
+# crate has none. `scripts/check-yanked.sh` is the audit gate instead. It keeps
+# `--deny yanked` and `--deny unmaintained`, fails on every vulnerability, and
+# lets a yanked crate through only when this file names that exact version.
+#
+# An entry is a loan, not a decision:
+#   - it names one crate at one version, so a second yanked crate, or the same
+#     one at another version, fails the audit;
+#   - `expires` has to be within 60 days of `recorded`, and an expired entry
+#     fails the audit, which forces somebody to look again;
+#   - an entry that matches nothing fails the audit, so the line is removed the
+#     day the crate leaves the tree rather than left to rot.
+#
+# Entries are blocks of `key: value`, a block starting at `crate:`. A value may
+# wrap onto lines that start with whitespace. Every key below is required.
+
+crate:      zip
+version:    8.6.0
+path:       dpp-integrator -> calamine -> zip
+rationale:  Yanked upstream, and it cannot be replaced from here. Every zip from
+            8.0.0 through 9.0.2 is yanked and only 9.0.3 and later are live, but
+            calamine 0.36.1, its latest release, requires zip ^8.6, so calamine
+            pulls 8.6.0 into the
+            tree whatever this workspace asks for. A direct bump to 9.0.x would
+            leave 8.6.0 in place for calamine and put two zip versions in the
+            build, which dpp-integrator avoids on purpose: its direct zip,
+            used to pre-scan XLSX for zip and dimension bombs, is
+            version-matched to calamine's. Git sources are denied (deny.toml),
+            so patching in a calamine fork is not an option either. Yanking is
+            the maintainer's "do not use", and this is a bounded exception to
+            it, not agreement with it.
+owner:      LKSNDRTMLKV
+recorded:   2026-10-16
+expires:    2026-12-15
+release-on: calamine releases a version that requires zip 9 (tafia/calamine#741).
+            Then bump calamine and the direct zip together in one change (zip
+            9.0.3 or later), adjust the `entry.name()` calls in xlsx_parser.rs
+            to whatever zip 9 returns, re-run the XLSX bomb tests, and delete
+            this entry.

.github/workflows/advisories.yml

@@ -48,19 +48,24 @@ jobs:
           toolchain: stable
 
       # The same invocation and the same flags as the pull-request path, so a
-      # nightly failure and a CI failure mean the same thing. `--deny yanked`
+      # nightly failure and a CI failure mean the same thing. The yanked check
       # catches the other thing that changes without a commit: a crate
-      # withdrawn from the registry after we pinned it.
+      # withdrawn from the registry after we pinned it. A yanked crate the
+      # register tolerates carries an expiry date, which is another thing that
+      # passes on a calendar and not on a commit, so this run is where it is
+      # noticed.
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
-      - name: cargo audit
-        run: cargo audit --deny yanked --deny unmaintained
+      - name: cargo audit (a yanked crate needs a register entry)
+        run: bash scripts/check-yanked.sh
 
       # Reason 2 above. This is the check that cannot be reached by pushing.
       - name: Suppression register is current
         run: bash scripts/check-audit-register.sh
       - name: Suppression register checker self-test
         run: bash scripts/check-audit-register.test.sh
+      - name: Yanked-crate checker self-test
+        run: bash scripts/check-yanked.test.sh
 
       # Bans, licences and sources are properties of the tree and cannot change
       # without a commit, so they stay on the pull-request run. Advisories stay

.github/workflows/ci.yml

@@ -528,15 +528,18 @@ jobs:
           workspaces: dpp-engine
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
-      - name: cargo audit
+      - name: cargo audit (a yanked crate needs a register entry)
         working-directory: dpp-engine
-        run: cargo audit --deny yanked --deny unmaintained
+        run: bash scripts/check-yanked.sh
       - name: Suppression register is current
         working-directory: dpp-engine
         run: bash scripts/check-audit-register.sh
       - name: Suppression register checker self-test
         working-directory: dpp-engine
         run: bash scripts/check-audit-register.test.sh
+      - name: Yanked-crate checker self-test
+        working-directory: dpp-engine
+        run: bash scripts/check-yanked.test.sh
       - name: Install cargo-deny
         uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
         with:

CHANGELOG.md

@@ -643,6 +643,38 @@ under the pre-1.0 conventions in [VERSIONING.md](docs/governance/VERSIONING.md):
   registry-contract change could not pass it otherwise. It is its own commit,
   and the only lockfile change in that branch.
 
+- **`wasmtime` and `wasmtime-wasi` 49.0.2 → 49.0.3**, clearing RUSTSEC-2026-0352
+  to RUSTSEC-2026-0364, which had turned the security audit red on `main`. The
+  one that matters most is in `wasmtime-wasi` (-0352): renaming a symlink whose
+  name ends in a slash lets a guest step out of a directory it was given. It is
+  listed for macOS and FreeBSD hosts only, and this host preopens no directory
+  (see `runtime::build_store`), so a plugin here has no directory to step out
+  of. The other twelve are in `wasmtime` itself and are mostly host panics in the
+  component-model and async paths (-0353 to -0358, -0360, -0361), plus a stack
+  overflow dropping a long chain of recursive types (-0359), an async-entrypoint
+  requirement that is not enforced (-0362), component-model handle tables
+  capped per instance and charged to no limit (-0363), and exception tags that
+  can leave host data structures unaligned (-0364). The host runs plugins
+  synchronously as `wasm32-wasip1` modules, which keeps it away from most of
+  those paths, but which of them a plugin can reach has not been established
+  for each, and the sandbox is what they are about, so the bump is not left
+  waiting on that. The existing `wasmtime = "49"` requirement already permitted
+  the patch, so no manifest changed. Nothing else in the lockfile moved except
+  the `cranelift`, `pulley` and `wiggle` crates that release pins to.
+
+  `zip` 8.6.0 is yanked upstream, and `cargo audit --deny yanked` has no way to
+  leave one crate alone (`--ignore` takes advisory IDs, which a yanked crate does
+  not have), so it kept the audit red, and with it every pull request, this one
+  included. It cannot be replaced from here: calamine, whose latest release
+  requires `zip ^8.6`, pulls it in, and every zip from 8.0.0 through 9.0.2 is
+  yanked. The audit is now `scripts/check-yanked.sh`. It still denies yanked and
+  unmaintained crates and fails on every vulnerability, but lets a yanked crate
+  through when `.cargo/yanked-register.txt` names that exact version with an
+  owner, a reason and an expiry that is at most 60 days out. An entry that has
+  expired, or that no longer matches a yanked crate, fails the audit, so the
+  exception ends on a date or when calamine moves to zip 9, whichever comes
+  first. The register holds `zip 8.6.0` and expires on 15 December.
+
 ## [0.14.0] - 2026-09-24
 
 ### Breaking