CI is green again: Windows timeout, and the zip advisories that landed on 17 October (#316)

* The Windows build leg is no longer killed after it has passed

`build (windows-latest)` takes 9 to 14 minutes on a warm cache and 30 to 35 on
a cold one. With `timeout-minutes: 30` it was cancelled after Build, Test,
Clippy and Audit were all green, while rust-cache was still saving, so main
(run 38943462546) and the 2.1.0 release PR both read as cancelled on 16 October.

The ceiling is now 60, and `cargo audit` runs on Linux only. It reads the same
Cargo.lock on both legs, and on Windows it spent six minutes compiling
cargo-audit to repeat the Linux result.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* cargo audit passes again after three zip advisories landed on 17 October

RUSTSEC-2026-0367, -0368 and -0369 affect zip below 9.0.0, and every branch,
main included, failed the Audit step on them. Two paths reached an affected zip.

duckdb 1.10504 -> 1.10506.1 (inside the existing "1" range) moves
libduckdb-sys onto zip "^9", which clears zip 6.0.0. It also drops
rust_decimal and therefore rkyv from the lockfile, so the RUSTSEC-2026-0235
ignore had nothing left to cover and is removed.

calamine 0.30.1 -> zip 4.6.1 cannot move: calamine's latest release still
requires zip "^8.6". All three advisories are in extract(), and calamine only
calls ZipArchive::new, by_name and by_index, so the three IDs are ignored with
that evidence in .cargo/audit.toml until calamine depends on zip 9.

Verified locally: cargo audit clean (3 vulnerabilities before the ignores),
cargo clippy --all-features --all-targets -D warnings clean, duckdb_test 6/6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: fabio-rovai

.cargo/audit.toml

@@ -25,18 +25,20 @@ ignore = [
     # on quick-xml 0.41 or later.
     "RUSTSEC-2026-0194",
     "RUSTSEC-2026-0195",
-    # rkyv 0.7.46 out-of-bounds reads on archives containing Rc/Arc.
-    # Not compiled by this project in any configuration. rkyv is an OPTIONAL
-    # dependency of rust_decimal (rust_decimal-1.42.1/Cargo.toml: `rkyv =
-    # ["dep:rkyv"]`), reaching us only via duckdb -> rust_decimal, and duckdb
-    # does not enable that feature. Verified: `cargo tree --all-features
-    # --target all -i rkyv` returns no results, while `-i rust_decimal` shows
-    # rust_decimal -> duckdb -> open-ontologies. cargo audit reads Cargo.lock,
-    # which records optional dependencies the compiler never sees.
-    # Unfixable by version bump: the advisory requires >= 0.8.17, but
-    # rust_decimal requires rkyv "0.7.46", which Cargo reads as at least 0.7.46
-    # and below 0.8.0, and it has not migrated to the 0.8
-    # line (it carries a separate rkyv-0_8 dev-dependency). Remove this entry
-    # once rust_decimal ships a release depending on rkyv 0.8.
-    "RUSTSEC-2026-0235",
+    # zip archive-extraction advisories (symlink escape, SUID/SGID bits kept,
+    # permissions applied through symlinks), all patched only in zip 9.0.0.
+    # Every one of them is in ZipArchive::extract / ZipStreamReader::extract,
+    # which write an archive out to disk. The one remaining path to an affected
+    # zip is calamine 0.30.1 -> zip 4.6.1 (`cargo tree --all-features -i zip`),
+    # and calamine never extracts: it opens the workbook with ZipArchive::new
+    # and reads entries into memory with by_name and by_index, and its source
+    # contains no call to extract or ZipStreamReader. Moving calamine does not
+    # help yet, because the latest release, 0.36.1, still requires zip "^8.6".
+    # The other path, duckdb's build-dependency libduckdb-sys, was cleared by
+    # updating duckdb to 1.10506.1, which requires zip "^9". That same update
+    # dropped rust_decimal and with it rkyv, so the RUSTSEC-2026-0235 entry
+    # that stood here is gone. Remove these once calamine depends on zip 9.
+    "RUSTSEC-2026-0367",
+    "RUSTSEC-2026-0368",
+    "RUSTSEC-2026-0369",
 ]

.github/workflows/ci.yml

@@ -14,7 +14,13 @@ concurrency:
 
 jobs:
   build:
-    timeout-minutes: 30
+    # 60, not 30. The Windows leg takes 9 to 14 minutes on a warm cache and 30
+    # to 35 on a cold or partial one, and the 30-minute ceiling killed it AFTER
+    # every step had passed: on 16 October 2026 main (run 38943462546) and the
+    # 2.1.0 release PR were reported cancelled while Build, Test, Clippy and
+    # Audit were all green and only the rust-cache save was still running.
+    # The same happened on main on 13 October. A hung job is still caught.
+    timeout-minutes: 60
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -88,6 +94,10 @@ jobs:
       - name: Clippy
         run: cargo clippy -- -D warnings
       - name: Audit
+        # Linux only. `cargo audit` reads Cargo.lock, which is the same file on
+        # both legs, so the Windows run reported nothing the Linux run had not,
+        # and it spent six minutes compiling cargo-audit from source to do it.
+        if: runner.os == 'Linux'
         run: |
           # --locked installs cargo-audit with its own published Cargo.lock.
           # Without it cargo resolves transitive deps to latest, and