Scope the neural audit around the zip 8.6 advisories Candle cannot avoid

.github/workflows/neural.yml

@@ -101,5 +101,5 @@ jobs:
       - uses: dtolnay/rust-toolchain@4716b85f2fac3e324e64fa2810f6b5c3905760a5
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
       - run: cargo install cargo-audit --locked --version 0.22.0
-      # Scoped, documented maintenance-only exception. Root CI remains unchanged.
-      - run: cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436
+      # Scoped, documented exceptions (see neural/SECURITY.md). Root CI remains unchanged.
+      - run: cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0367 --ignore RUSTSEC-2026-0368 --ignore RUSTSEC-2026-0369

neural/SECURITY.md

@@ -2,7 +2,10 @@
 
 This companion is opt-in. It does not change the root crate's dependencies or audit policy.
 
-The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436`. This single exception covers `paste` 1.0.15, an unmaintained build-time macro dependency of Candle. The advisory reports maintenance status, not a known memory-safety exploit. Replacement requires an upstream-compatible Candle update or an independently reviewed patch. Review this exception at each dependency update. No other advisory is ignored. The root audit still denies all warnings.
+The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings` with four documented exceptions. No other advisory is ignored, and the root audit still denies all warnings. Review every exception at each dependency update.
+
+- `RUSTSEC-2024-0436` covers `paste` 1.0.15, an unmaintained build-time macro dependency of Candle. The advisory reports maintenance status, not a known memory-safety exploit. Replacement requires an upstream-compatible Candle update or an independently reviewed patch.
+- `RUSTSEC-2026-0367`, `RUSTSEC-2026-0368` and `RUSTSEC-2026-0369` cover `zip` 8.6.0, which `candle-core` 0.11.0 requires as `^8.6.0`. All three advisories concern `ZipArchive::extract()` and `ZipStreamReader::extract()` writing attacker-controlled archives to disk: SUID and SGID bits are kept, permissions are applied through symlinks, and symlink targets may resolve outside the destination directory; the fix is in `zip` 9, a semver-major change that no released Candle accepts. Candle uses `zip` only to read `.npz` and PyTorch pickle entries through `ZipArchive::new` and to write `.npz` files through `ZipWriter`; it never calls `extract()`, and the worker loads only the hash-pinned GGUF model from the bundle, so no archive is extracted to disk. Remove these three exceptions when Candle moves to `zip` 9.
 
 Worker files are executable code supplied by the embedding application. Install them in a directory writable only by trusted users. The model manifest is not a signature; compatibility comes from hashes compiled into the library. Runtime loading hashes the exact owned bytes used by inference. The worker has no network API, file writes, clipboard access or input-injection code. Process isolation bounds hangs and crashes; it is not an operating-system security sandbox.