What's changed and what's your intention?
Bump the workspace zstd dependency from 0.13 to 0.14.3. zstd 0.13 resolves zstd-safe 7.x and zstd-sys < 2.1.2. Four advisories published on 2026-10-16 cover those versions:
| Advisory | Crate | Patched | Issue |
|---|---|---|---|
| RUSTSEC-2026-0391 | zstd | >= 0.14.3 | Data from an abandoned stream leaks into the next stream on a reused raw Encoder/Decoder context |
| RUSTSEC-2026-0398 | zstd-safe | >= 8.2.0 | Seekable::decompress sets a Vec length beyond its capacity for offsets past the end |
| RUSTSEC-2026-0403 | zstd-safe | >= 8.2.0 | Uninitialized memory exposed when streaming decompression of a legacy frame fails |
| RUSTSEC-2026-0410 | zstd-sys | >= 2.1.2 | WebAssembly allocator shim corrupts memory on allocation failure |
With 0.14.3 the build resolves zstd-safe 8.2.0 and zstd-sys 2.1.2+zstd.1.5.7. The APIs that foyer-storage calls in serde.rs (zstd::Encoder::new / finish and zstd::Decoder::new) did not change, so this PR has no source changes.
This also helps downstream crates. SlateDB, for example, currently has to keep two zstd versions because foyer-storage requires 0.13. The matching bump on that side is https://github.com/slatedb/slatedb/pull/2193.
Test evidence (macOS aarch64, Rust 1.98.1):
cargo clippy --all-targets -- -D warnings: clean.cargo test -p foyer-storage --features strict_assertions,test_utils --lib --test storage_fuzzy_test: 28 lib tests passed and 3 fuzzy store tests passed, includingtest_direct_fs_store_zstd.
Not run: the full cargo x (fmt/typos/taplo/nextest across the workspace). CI covers it.
This change was prepared with Claude Opus 5.5 (Claude Code).
🤖 Generated with Claude Code