Fix critical Dependabot alerts (zip 9, website build deps) and raise MSRV to 1.88

.cargo/config.toml

@@ -0,0 +1,4 @@
+# Keep `cargo update` within the `rust-version` declared in Cargo.toml: when a
+# newer release of a dependency needs a newer compiler, resolve an older one.
+[resolver]
+incompatible-rust-versions = "fallback"

.github/workflows/ci.yml

@@ -10,6 +10,7 @@ on:
       - 'build.rs'
       - 'Cargo.toml'
       - 'Cargo.lock'
+      - '.cargo/**'
       - '.github/workflows/ci.yml'
   pull_request:
     branches: [main]
@@ -20,6 +21,7 @@ on:
       - 'build.rs'
       - 'Cargo.toml'
       - 'Cargo.lock'
+      - '.cargo/**'
       - '.github/workflows/ci.yml'
 
 env:
@@ -68,6 +70,21 @@ jobs:
       - name: Check compilation
         run: cargo check --release
 
+  # Runs on: PR to main. Enforces the rust-version declared in Cargo.toml;
+  # keep the toolchain below in step with it.
+  msrv:
+    name: MSRV Check
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@1.88
+      - uses: Swatinem/rust-cache@v2
+      - name: Create placeholder contributors file
+        run: touch contributors.csv
+      - name: Check compilation on MSRV
+        run: cargo check --locked --all-targets
+
   # Runs on: push to main — fetch contributors for build-time injection
   prepare:
     name: Prepare

AGENTS.md

@@ -81,8 +81,10 @@ Do not run the live tests unless you have been given credentials for them.
 
 ## Coding conventions
 
-- Rust 2021 edition, `rust-version = "1.75"` in `Cargo.toml`. Do not use
-  features newer than the MSRV without bumping it deliberately.
+- Rust 2021 edition, `rust-version = "1.88"` in `Cargo.toml`, enforced by the
+  `MSRV Check` job in CI. Do not use features newer than the MSRV without
+  bumping it deliberately; `.cargo/config.toml` makes `cargo update` prefer
+  dependency versions that build on it.
 - Keep `main.rs` thin; put logic in the library modules so it is testable
   in process.
 - Application errors are variants of `AppError` in `src/error.rs`; add a

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+### Fixes
+
+- Upgraded the `zip` crate used to extract the downloaded StackQL binary from 0.6.6 to 9.1.3, resolving RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 and the critical "zip cloaking" dual-header parser differential advisory fixed in 9.0.5 ([#63](https://github.com/stackql/stackql-deploy-rs/issues/63)). Only the pure-Rust deflate backend is now compiled in, which also drops the `time` 0.3.41 (RUSTSEC-2026-0009), `pbkdf2` and `base64ct` dependencies. Archive extraction now fails on any entry that is a symlink or whose path would leave the destination directory; previously such path entries were silently skipped. Regular files are still written without applying permission bits from the archive.
+- Updated `bytes` to 1.12.1 (RUSTSEC-2026-0007) and `crossbeam-epoch` to 0.9.21 (RUSTSEC-2026-0204), so `cargo audit` reports no vulnerabilities.
+- Raised the declared minimum supported Rust version from 1.75, which the crate had not built on for several releases, to 1.88, as required by `zip` 9. A new `MSRV Check` CI job runs `cargo check --locked` on that toolchain, and `.cargo/config.toml` makes `cargo update` prefer dependency versions compatible with it.
+- Website: resolved critical advisories in transitive Docusaurus build dependencies by updating `proxy-addr` to 2.0.8, `websocket-driver` to 0.7.5, `shell-quote` to 1.12.0 and, through a Yarn resolution, `tinypool` to 2.2.0.
+
 ## 2.4.0 (2026-10-21)
 
 ### Fixes