From 0d28ee08722efd2639e09fc7138604b48ef6d8c7 Mon Sep 17 00:00:00 2001
From: "Ayberk A." <105879357+AyberkA0@users.noreply.github.com>
Date: Tue, 13 Oct 2026 21:14:00 +0300
Subject: [PATCH] Fix #1710: ruzstd 0.9.1 (RUSTSEC-2026-0344)

0.9.1 enforces the decompressed size of each block, which 0.9.0 didn't
(memory exhaustion on crafted .ai / Affinity zstd data). The manifests now ask
for at least 0.9.1.
---
 Cargo.lock                 | 4 ++--
 Cargo.toml                 | 2 +-
 crates/affinity/Cargo.toml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c56c093e..77d88fc8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3640,9 +3640,9 @@ dependencies = [
 
 [[package]]
 name = "ruzstd"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a252f5e20f038fe7b4ea53e073e65398d652c864cc162fc77c56c2f13717b888"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
 dependencies = [
  "twox-hash",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index a6942115..2c3db2ed 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ linesweeper = "0.5"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 rustix = { version = "1.1", default-features = false }
 # Zstandard decoder (pure Rust, builds for wasm32 too): the editing copy an EPS carries of its art.
-ruzstd = { version = "0.9", default-features = false, features = ["std"] }
+ruzstd = { version = "0.9.1", default-features = false, features = ["std"] }
 jpeg-encoder = { version = "0.6", default-features = false, features = ["std"] }
 gif = { version = "0.14", default-features = false, features = ["std", "raii_no_panic"] }
 # CMYK image samples (vectorcraft-doc's cmyk module): the image crate's own TIFF and JPEG
diff --git a/crates/affinity/Cargo.toml b/crates/affinity/Cargo.toml
index 2c601e9c..c335c7b1 100644
--- a/crates/affinity/Cargo.toml
+++ b/crates/affinity/Cargo.toml
@@ -17,7 +17,7 @@ synth = []
 crc32fast = { workspace = true }
 flate2 = { workspace = true }
 image = { workspace = true }
-ruzstd = "0.9"
+ruzstd = "0.9.1"
 
 [dev-dependencies]
 proptest = { workspace = true }