[rust] Update Selenium Manager dependencies

[bonigarcia]

🔗 Related Issues

💥 What does this PR do?

This PR updated the SM dependencies to avoid vulnerability problems (detected in zip:8.6.0, fixed in 9.0.5).

🔧 Implementation Notes

🤖 AI assistance

• No substantial AI assistance used
• AI assisted (complete below)
  • Tool(s):
  • What was generated:
  • I reviewed all AI output and can explain the change

💡 Additional Considerations

🔄 Types of changes

• Cleanup (formatting, renaming)

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[selenium-ci]

/agentic_describe

[selenium-ci]

/agentic_review

[qodo-code-review]

PR Summary by Qodo

Update Selenium Manager dependencies to address zip vulnerability

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Upgrade Selenium Manager’s zip dependency to 9.0.5 to address a vulnerability in 8.6.0.
• Refresh related Rust dependencies and the lockfile.
• Adapt ZIP extraction to the new filename API.

Diagram

graph TD
  A["Cargo manifest"] --> B["Locked crates"] --> C["zip 9.0.5"] --> D["Unzip routine"] --> E["Extracted files"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Upgrade only zip and required transitive crates

• ➕ Minimizes unrelated dependency churn and review scope.
• ➕ Makes the security remediation easier to isolate.
• ➖ Leaves other dependencies at their existing versions.
• ➖ May require a separate dependency-refresh PR.

Recommendation: Prefer a targeted zip upgrade if urgent vulnerability remediation is the sole goal. If the wider refresh is intentional, retain it but verify archive extraction and cross-platform builds because the lockfile also changes unrelated crates.

Files changed (3) +130 / -107

Bug fix (1) +1 / -1

files.rsHandle fallible ZIP entry names during extraction +1/-1

Handle fallible ZIP entry names during extraction

• Propagates errors from the upgraded ZIP API’s 'file.name()' call before checking whether an entry is a directory. The existing extraction flow otherwise remains unchanged.

rust/src/files.rs

Other (2) +129 / -106

Cargo.tomlRaise zip to 9.0.5 and refresh Rust dependency versions +17/-17

Raise zip to 9.0.5 and refresh Rust dependency versions

• Raises the zip requirement from major version 8 to 9.0.5 to address the reported vulnerability. Also updates several runtime and development dependency requirements.

rust/Cargo.toml

Cargo.lockLock upgraded zip and refreshed transitive crates +112/-89

Lock upgraded zip and refreshed transitive crates

• Locks zip at 9.0.5 instead of 8.6.0 and refreshes other resolved crates. The new resolution adds nix and a second cfb version.

rust/Cargo.lock

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can import rules and skills only from the repositories your team follows

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗