Bump oxiarc-core from 0.3.6 to 0.4.2 in /eck/fuzz

[dependabot]

Bumps oxiarc-core from 0.3.6 to 0.4.2.

Release notes

Sourced from oxiarc-core's releases.

OxiArc 0.4.2 Release

[0.4.2] - 2026-09-12

The P2/P3 program: HTTP Content-Encoding decoding and three new image container formats, all Pure Rust, closing the two routes (flate2 via ureq's default gzip feature, and png/tiff via the image facade) that accounted for flate2 in 39 of 93 ~/work project lockfiles. Five new crates — oxiarc-http, oxiarc-png, oxiarc-jpeg, oxiarc-tiff, oxiarc-image — bring the workspace from 13 to 18 member crates. The keystone underneath all of them is a rewritten, genuinely resumable DEFLATE/zlib/gzip core (InflateStream, WrappedInflate, InflateReader/ AsyncInflateReader) that replaces the read_to_end-then-decode decoders every streaming consumer used to be built on; oxiarc-zstd and oxiarc-brotli gained the equivalent push decoders (ZstdStream, BrotliStream). Alongside the new crates: a from-scratch DEFLATE encoder rewrite (oxiarc-deflate, now byte-identical to CPython's zlib.compress at every level 1-9; level 0's stored blocks are cut at a different, RFC-legal boundary, so its bytes differ — never by being larger), a decode-throughput rebuild of oxiarc-zstd around the reference decoder's data layout, a TIFF/GIF LZW decoder rebuilt to libtiff's own algorithm shape, Brotli shared-dictionary support and Content-Encoding: dcb/dcz (RFC 9842), the legacy UNIX compress/.Z container (oxiarc-lzw::z, Content-Encoding: compress), and CCITT Group 3/4 uncompressed mode. No archive/stream wire format changed and no public read/decode-path API was removed. Four narrow breaking changes, all scoped and named at their own entries below: (1) LzwConfig::GIF is now genuinely LSB-first (it was accidentally identical to TIFF_OLD_STYLE's MSB-first value before this release — no published version ever carried the old, wrong value); (2) LzwConfig gained a bit_order field, so any external struct-literal construction of it no longer compiles without setting one (LzwConfig::new and the named constants are unaffected — oxiarc-lzw has been published since before this cycle, unlike the five brand-new crates below, so this one reaches real downstream callers); (3) oxiarc-zstd's decompress_multi_frame and its _with_dict twin no longer tolerate leading garbage or a truncated-but-recognised skippable-frame prefix (callers relying on Ok(vec![]) for non-Zstandard input must check the error instead — trailing-garbage tolerance is unchanged); (4) the dcz wire preamble gained a dictionary-binding header within this same unreleased cycle, so a dcz body produced by an earlier unreleased build of oxiarc-http is no longer readable by the version shipping in this release (no published consumer is affected either way). Final state, measured 2026-09-12 on the full workspace: 5,505 tests passing, 0 failed, 0 skipped (5,159 via cargo nextest run --workspace --all-features + 346 doctests via cargo test --doc --workspace --all-features); zero clippy warnings on every crate individually (--all-features --all-targets -D warnings, also with --no-default-features) as reported by each track, and workspace-wide: cargo fmt --all -- --check, cargo clippy --workspace in both feature sets, cargo build --workspace --no-default-features, `RUSTDOCFLAGS='-D

... (truncated)

Changelog

Sourced from oxiarc-core's changelog.

[0.4.2] - 2026-09-12

The P2/P3 program: HTTP Content-Encoding decoding and three new image container formats, all Pure Rust, closing the two routes (flate2 via ureq's default gzip feature, and png/tiff via the image facade) that accounted for flate2 in 39 of 93 ~/work project lockfiles. Five new crates — oxiarc-http, oxiarc-png, oxiarc-jpeg, oxiarc-tiff, oxiarc-image — bring the workspace from 13 to 18 member crates. The keystone underneath all of them is a rewritten, genuinely resumable DEFLATE/zlib/gzip core (InflateStream, WrappedInflate, InflateReader/ AsyncInflateReader) that replaces the read_to_end-then-decode decoders every streaming consumer used to be built on; oxiarc-zstd and oxiarc-brotli gained the equivalent push decoders (ZstdStream, BrotliStream). Alongside the new crates: a from-scratch DEFLATE encoder rewrite (oxiarc-deflate, now byte-identical to CPython's zlib.compress at every level 1-9; level 0's stored blocks are cut at a different, RFC-legal boundary, so its bytes differ — never by being larger), a decode-throughput rebuild of oxiarc-zstd around the reference decoder's data layout, a TIFF/GIF LZW decoder rebuilt to libtiff's own algorithm shape, Brotli shared-dictionary support and Content-Encoding: dcb/dcz (RFC 9842), the legacy UNIX compress/.Z container (oxiarc-lzw::z, Content-Encoding: compress), and CCITT Group 3/4 uncompressed mode. No archive/stream wire format changed and no public read/decode-path API was removed. Four narrow breaking changes, all scoped and named at their own entries below: (1) LzwConfig::GIF is now genuinely LSB-first (it was accidentally identical to TIFF_OLD_STYLE's MSB-first value before this release — no published version ever carried the old, wrong value); (2) LzwConfig gained a bit_order field, so any external struct-literal construction of it no longer compiles without setting one (LzwConfig::new and the named constants are unaffected — oxiarc-lzw has been published since before this cycle, unlike the five brand-new crates below, so this one reaches real downstream callers); (3) oxiarc-zstd's decompress_multi_frame and its _with_dict twin no longer tolerate leading garbage or a truncated-but-recognised skippable-frame prefix (callers relying on Ok(vec![]) for non-Zstandard input must check the error instead — trailing-garbage tolerance is unchanged); (4) the dcz wire preamble gained a dictionary-binding header within this same unreleased cycle, so a dcz body produced by an earlier unreleased build of oxiarc-http is no longer readable by the version shipping in this release (no published consumer is affected either way). Final state, measured 2026-09-12 on the full workspace: 5,505 tests passing, 0 failed, 0 skipped (5,159 via cargo nextest run --workspace --all-features + 346 doctests via cargo test --doc --workspace --all-features); zero clippy warnings on every crate individually (--all-features --all-targets -D warnings, also with --no-default-features) as reported by each track, and workspace-wide: cargo fmt --all -- --check, cargo clippy --workspace in both feature sets, cargo build --workspace --no-default-features, RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps --all-features and a real

... (truncated)

Commits

• f99d13b Availability of 0.4.2
• ebd6644 Availability of 0.4.1
• 337fd87 Availability of 0.4.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.