[alangou]

Summary

Upgrade the Z3 bindings so prebuilt Z3 builds use zip 9.1.3 instead of the vulnerable 8.6.0 release. This addresses GHSA-m665-v7pm-7grj / CVE-2026-115905.

Related Issue

Dependabot alert 79. No separate issue, as requested.

Changes

• Upgrade z3 to 0.22, resolving z3-sys 0.14.0 and zip 9.1.3.
• Refresh the related lockfile dependencies, including vendored Z3 5.3.2.
• Remove the three resolved zip advisory exceptions and the resolved zstd-sys exception.

Release Notes

Testing

• cargo test --locked -p openshell-prover -p openshell-prover-cli — 147 tests passed, including the doctest.
• cargo check --locked -p openshell-prover --features prebuilt-z3
• uv run --no-project --offline --python /usr/bin/python3 tasks/scripts/check_cargo_lockfile_alignment.py
• git diff --check
• cargo deny --locked check advisories — blocked only by the existing pulldown-cmark 0.13.3 advisory RUSTSEC-2026-0414, also present in the base lockfile. No zip findings remain.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/5026 does not exist yet. A maintainer needs to comment /ok to test e51c32c3100b8294d81bd1ca742351cbf0c5a655 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[alangou]

/ok to test e51c32c