Repository navigation
[CVE] Bump Zip and release #1727
Description
It would be great if you can bump zip and release so that we can move to CVE free versions. The zip 9.0 series has a critical CVE, unfortunately. I know it's just a test dependency but it's still being flagged by e.g. dependabot.
Activity
chris-olszewski commentedon Oct 29, 2026
Just confirming, you only need a release? We already bumped to
zip9.0:sdk-rust/crates/sdk-core/Cargo.toml
Line 123 in 70b594f
wolfv commentedon Oct 29, 2026
I think there is 9.1 now but 9.0 is probably OK
chris-olszewski commentedon Oct 29, 2026
The 9.0 version should match 9.1 (source). Thanks for the confirmation.
chris-olszewski commentedon Oct 30, 2026
Just cut temporalio-sdk-core v0.10.1 that has the zip 9 bump. temporalio-sdk v1.1.1 was also cut that uses v0.10.1 of core.
wolfv commentedon Oct 30, 2026
Awesome, thank you!