From 9944f783f770499df370434bb8f839cb85743d1b Mon Sep 17 00:00:00 2001
From: "Andrei G." <k05h31@gmail.com>
Date: Tue, 18 Aug 2026 20:22:37 +0200
Subject: [PATCH] build: bump sevenz-rust2 to 0.21.5

Pulls in a batched AES-CBC block decryption improvement in
sevenz-rust2, and transitively bumps lzma-rust2 to 0.19.0, which
carries the 0.18.1 out-of-bounds LZ encoder fix. Both crates'
affected code paths are currently unreachable in exarch-core, so
this is a forward-looking hardening bump rather than an observable
behavior change.

Closes #548
---
 CHANGELOG.md | 13 +++++++++++++
 Cargo.lock   |  8 ++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fc4176a..a831a02 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `describe_final_swap_failure` (7 params, down to 4) to reach each of the six
   `disclose_if_orphaned` call sites individually. No behavior change.
 
+- **Bumped `sevenz-rust2` from 0.21.4 to 0.21.5, pulling in a transitive `lzma-rust2` bump from
+  0.18.0 to 0.19.0 (#548)**: `sevenz-rust2` 0.21.5 batches AES-CBC block decryption, a 7z-extraction
+  performance improvement on AES-encrypted archives — currently unreachable in `exarch-core`, since
+  every call site uses `Password::empty()` and encrypted 7z archives are rejected before decryption
+  is attempted, so this is a forward-looking perf improvement rather than an observable behavior
+  change. The transitive `lzma-rust2` bump picks up the out-of-bounds LZ encoder fix that actually
+  landed in 0.18.1 (upstream #107, an encoder-only panic on single-stream encodes above roughly
+  2 GiB); 0.19.0 itself minor-bumped separately to add sans-I/O LZMA1/LZIP decoders (upstream #109).
+  `lzma-rust2`'s encoder surface is unreachable in `exarch-core` today, since 7z archive creation is
+  unsupported, so the encoder fix is defense-in-depth for a currently-dormant code path. Only
+  `Cargo.lock` changes; `sevenz-rust2 = "0.21.4"` in `Cargo.toml` is left as-is since the caret
+  requirement already admits 0.21.5.
+
 ## [0.6.0] - 2026-08-04
 
 ### Security
diff --git a/Cargo.lock b/Cargo.lock
index 01ea1cc..5ca0b5e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -933,9 +933,9 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lzma-rust2"
-version = "0.18.0"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12931b17820a3a0c48e46359d2be49ef57b5d50509fd5baba43e6c654977aa66"
+checksum = "5c1bf3331fb5cf60f2ef15b63361f6cc39492a5d94c096053c395515e17d147f"
 
 [[package]]
 name = "lzma-sys"
@@ -1546,9 +1546,9 @@ dependencies = [
 
 [[package]]
 name = "sevenz-rust2"
-version = "0.21.4"
+version = "0.21.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20acd38118edb830eb5a0bfacaf83c687b9995f48d6983cdac3cb18ce1d571cc"
+checksum = "cabfe266b357df6e7aa8d0c9bb11eac1fd0ed049f6318455bf55345d9de6c3b5"
 dependencies = [
  "aes",
  "bzip2",