Drop zip default features in wslc_common to remove aes/sha1 - #698
Merged
Conversation
This PR trims wslc_common's `zip` build-dependency to the `deflate` feature
only, removing the transitive `aes` and `sha1` crates (and other unused
codecs) from the dependency graph.
Details
* wslc_common uses `zip` only in build.rs to extract NuGet `.nupkg`
archives (standard deflate zips) via `ZipArchive` + `by_index` — it never
reads AES-encrypted archives, so the default `aes-crypto` feature is
unnecessary.
* Set `zip = { version = "2", default-features = false, features = ["deflate"] }`.
This drops aes, sha1, hmac, pbkdf2, cipher, constant_time_eq, plus the
unused bzip2/lzma/zstd/deflate64/crc/time codec chains from Cargo.lock.
* Silences the Dependabot noise around the (build-time-only, non-exploitable)
aes/sha1 entries.
Tests
* cargo check -p wslc_common: passed (build.rs nupkg deflate extraction path
unchanged).
* cargo clippy -p wslc_common --all-targets -- -D warnings: clean.
* Verified `cargo tree -i aes` and `cargo tree -i sha1` no longer resolve.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4cc05a95-546f-4acb-913a-b946127fa01f
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Restricts WSLC’s build-time ZIP support to Deflate, reducing unused transitive dependencies.
Changes:
- Disables
zipdefault features and enables onlydeflate. - Regenerates the lockfile without unused crypto and codec crates.
Show a summary per file
| File | Description |
|---|---|
src/backends/wslc/common/Cargo.toml |
Narrows enabled zip features. |
src/Cargo.lock |
Removes unused transitive dependencies. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0
- Review effort level: Medium
SohamDas2021
approved these changes
Jul 28, 2026
dhoehna
added a commit
to dhoehna/mxc
that referenced
this pull request
Jul 29, 2026
Reconciles the GA network wire schema (egress/ingress) with two commits that landed on main after this branch was cut: - microsoft#641 "Phase 3d: add actionable configuration parse errors" - microsoft#698 "Drop zip default features in wslc_common" wire.rs and config_parser.rs auto-merged cleanly (my network-schema edits and microsoft#641's parser changes touched disjoint regions). microsoft#641's new config_deserialize layer parses via serde generically, so it compiles and passes against the GA schema unchanged. The only new breakage is one legacy-schema test microsoft#641 added: config_parser::tests::out_of_range_value_reports_path builds a config with `network.proxy.localhost`, which the GA egress/ingress schema rejects as an unknown field before reaching the out-of-range value it asserts on. Disable it with #[ignore], consistent with the other legacy-schema tests deferred to the parser/SDK test migration. This is why CI (which tests refs/pull/676/merge) failed while the branch tip looked clean: the failing test lives only in main. Verified locally (default features): - wxc_common: 503 passed, 0 failed, 35 ignored (unit + integration + doctests) - wxc: 28 passed, 0 failed - mxc_engine: 9 passed, 0 failed, 6 ignored AB#62830582 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e9fe1242-7778-4399-b9a8-044ba9301215
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trims
wslc_common'szipbuild-dependency to thedeflatefeature only,removing the transitive
aesandsha1crates (and other unused codecchains) from the dependency graph.
wslc_commonuseszipsolely inbuild.rsto extract NuGet.nupkgarchives (standard deflate zips) via
ZipArchive+by_index. It never readsAES-encrypted archives, so
zip's defaultaes-cryptofeature is unnecessary.Details
zip = { version = "2", default-features = false, features = ["deflate"] }.aes,sha1,hmac,pbkdf2,cipher,constant_time_eq, plusunused
bzip2/lzma/zstd/deflate64/crc/timechains fromCargo.lock(239 lockfile lines removed).
aes/sha1entries. Noteaes 0.8.4has no advisory andsha1 0.10.6'sonly related advisory (RUSTSEC-2025-0021) targets gitoxide, not this crate.
Tests
cargo check -p wslc_common: passed (nupkg deflate extraction path unchanged).cargo clippy -p wslc_common --all-targets -- -D warnings: clean.cargo tree -i aesandcargo tree -i sha1no longer resolve.Microsoft Reviewers: Open in CodeFlow