[SDAChess]

Summary

Temporarily accept RUSTSEC-2026-0367, RUSTSEC-2026-0368, and RUSTSEC-2026-0369 for zip 8.6.0. It is used only by the z3-sys build script when prebuilt-z3 enables downloading and extracting upstream Z3 GitHub release assets; it is not linked into OpenShell or used to process runtime/user archives.

The accepted exposure is build-time extraction of a compromised upstream release asset. System and source-built Z3 paths do not use zip. The advisory check includes this optional path because it checks all features.

Related Issue

No issue, as explicitly requested by the maintainer. Repository ADMIN access verified.

Changes

• Add advisory-specific exceptions with the accepted exposure documented in deny.toml.
• Remove these exceptions once z3-sys supports patched zip >=9; its current ^8.2 constraint prevents that upgrade.
• Keep dependency versions, feature coverage, and other advisory checks unchanged.

Testing

• cargo deny check advisories reproduced all three failures before the change and passes afterward (run through nix develop .#default --no-write-lock-file).
• git diff --check passes.
• Unit and E2E tests are not applicable to advisory configuration only.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs: not applicable.

[alangou]

lgtm keeping track of z3 future updates