From 5b6ae0ac4a35e829996c1a747798945dfae66167 Mon Sep 17 00:00:00 2001
From: Fintan Halpenny <fintan.halpenny@gmail.com>
Date: Thu, 2 Apr 2026 14:32:46 +0100
Subject: [PATCH] Update radicle-surf to 0.27.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This version resolves the vulnerability from the `tar-rs` transitive
dependency.

`cargo deny check` output:
```
error[vulnerability]: tar-rs incorrectly ignores PAX size headers if header size is nonzero
    ┌─ /home/fintohaps/Developer/heartwood/Cargo.lock:362:1
    │
362 │ tar 0.4.44 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0068
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0068
    ├ Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX
      size header in cases where the base header size is nonzero.

      As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar]
      project was changed to correctly honor PAX size headers in the case where it
      was different from the base header. This is almost the inverse of the
      astral-tokio-tar issue.

      Any discrepancy in how tar parsers honor file size can be used to create
      archives that appear differently when unpacked by different archivers. In this
      case, the tar-rs (Rust tar) crate is an outlier in checking for the header size
      — other tar parsers (including e.g. Go [`archive/tar`][go-tar]) unconditionally
      use the PAX size override. This can affect anything that uses the tar crate to
      parse archives and expects to have a consistent view with other parsers.

      This issue has been fixed in version 0.4.45.

      [astral-cve]: https://www.cve.org/CVERecord?id=CVE-2025-62518
      [astral-tokio-tar]: https://github.com/astral-sh/tokio-tar
      [go-tar]: https://pkg.go.dev/archive/tar
    ├ Solution: Upgrade to >=0.4.45 (try `cargo update -p tar`)
    ├ tar v0.4.44
      └── (build) radicle-surf v0.27.0
          └── radicle-cli v0.19.0
              └── radicle-remote-helper v0.15.0
```
---
 Cargo.lock | 8 ++++----
 Cargo.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c2be54cf..2cfebdff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3342,9 +3342,9 @@ checksum = "fb935931bdd2a2966f3b584f3031d9d54ec0713ddbc563a0193d54e62a88ec73"
 
 [[package]]
 name = "radicle-surf"
-version = "0.27.0"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2c6a29eac2e55a6d0632c8faeb3cbe91afb1e07be60d157a27fdadb8cc4c508"
+checksum = "a2dfaa46d3e05ca10fc5841bb9cfac9fe6d3685cf2a02b16972f4cafbb888bd1"
 dependencies = [
  "anyhow",
  "base64 0.21.7",
@@ -4274,9 +4274,9 @@ dependencies = [
 
 [[package]]
 name = "tar"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
 dependencies = [
  "filetime",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index bf819b4b..418d26fe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -83,7 +83,7 @@ zeroize = "1.5.7"
 # `radicle-surf` → `radicle-git-ext` → `git-ref-format` → `git-ref-format-core`
 # Also note that `radicle-surf → git2` so try to also sync with `git2`.
 git-ref-format-core = { version = "0.6.0", default-features = false }
-radicle-surf = "0.27.0"
+radicle-surf = "0.27.1"
 
 [workspace.lints]
 clippy.type_complexity = "allow"