CVE-2026-43965

@@ -517,8 +517,13 @@
   ([evipepota](https://github.com/evipepota) and
   ([Louis Pilfold](https://github.com/lpil))
 
-- Restrict publication tarball creation so they cannot contain files from
-  outside the project root.
+- Stricter deserialisation rules for files internal the build directory to
+  reject corrupted data.
   ([Abdelrahman Ahmed Aboelkasem](https://github.com/0x2face),
   ([Aly](https://github.com/spect3r1), and
   ([Louis Pilfold](https://github.com/lpil))
+
+- Restrict publication tarball creation so they cannot contain files from
+  outside the project root.
+  ([Abdelrahman Ahmed Aboelkasem](https://github.com/0x2face),
+  ([Aly](https://github.com/spect3r1), and ([Louis Pilfold](https://github.com/lpil))

@@ -571,13 +571,14 @@ fn write_manifest_to_disc(paths: &ProjectPaths, manifest: &Manifest) -> Result<(
 // the `project/build/packages` directory.
 // For descriptions of packages provided by paths and git deps, see the ProvidedPackage struct.
 // The same package may appear in both at different times.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
 struct LocalPackages {
-    packages: HashMap<String, Version>,
+    #[serde(deserialize_with = "gleam_core::config::map_with_package_name_keys::deserialize")]
+    packages: HashMap<EcoString, Version>,
 }
 
 impl LocalPackages {
-    pub fn extra_local_packages(&self, manifest: &Manifest) -> Vec<(String, Version)> {
+    pub fn extra_local_packages(&self, manifest: &Manifest) -> Vec<(EcoString, Version)> {
         let manifest_packages: HashSet<_> = manifest
             .packages
             .iter()
@@ -634,12 +635,43 @@ impl LocalPackages {
             packages: manifest
                 .packages
                 .iter()
-                .map(|p| (p.name.to_string(), p.version.clone()))
+                .map(|p| (p.name.clone(), p.version.clone()))
                 .collect(),
         }
     }
 }
 
+#[test]
+fn local_packages_deserialise_ok() {
+    let toml = r#"
+[packages]
+gleam_stdlib = "1.0.0"
+gleam_otp = "1.1.0"
+"#;
+    let packages: LocalPackages = toml::from_str(toml).unwrap();
+    assert_eq!(
+        packages,
+        LocalPackages {
+            packages: HashMap::from_iter([
+                ("gleam_stdlib".into(), Version::new(1, 0, 0)),
+                ("gleam_otp".into(), Version::new(1, 1, 0)),
+            ])
+        }
+    )
+}
+
+#[test]
+fn local_packages_deserialise_invalid_name() {
+    let toml = r#"
+[packages]
+gleam_stdlib = "1.0.0"
+"../../stuff" = "1.1.0"
+"#;
+    let error = toml::from_str::<LocalPackages>(toml)
+        .expect_err("should fail to deserialise because of invalid name");
+    insta::assert_snapshot!(insta::internals::AutoName, error.to_string());
+}
+
 fn is_same_requirements(
     requirements1: &HashMap<EcoString, Requirement>,
     requirements2: &HashMap<EcoString, Requirement>,

@@ -0,0 +1,9 @@
+---
+source: compiler-cli/src/dependencies.rs
+expression: error.to_string()
+---
+TOML parse error at line 2, column 1
+  |
+2 | [packages]
+  | ^^^^^^^^^^
+invalid value: string "../../stuff", expected a package name containing only lowercase letter, numbers, and underscores

@@ -34,8 +34,6 @@ fn default_javascript_runtime() -> Runtime {
     Runtime::NodeJs
 }
 
-pub type Dependencies = HashMap<EcoString, Requirement>;
-
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SpdxLicense {
     pub licence: String,
@@ -166,16 +164,16 @@ pub struct PackageConfig {
     #[serde(
         default,
         serialize_with = "ordered_map",
-        deserialize_with = "dependencies_map::deserialize"
+        deserialize_with = "map_with_package_name_keys ::deserialize"
     )]
-    pub dependencies: Dependencies,
+    pub dependencies: HashMap<EcoString, Requirement>,
     #[serde(
         default,
         alias = "dev-dependencies",
         serialize_with = "ordered_map",
-        deserialize_with = "dependencies_map::deserialize"
+        deserialize_with = "map_with_package_name_keys ::deserialize"
     )]
-    pub dev_dependencies: Dependencies,
+    pub dev_dependencies: HashMap<EcoString, Requirement>,
     #[serde(default)]
     pub repository: Option<Repository>,
     #[serde(default)]
@@ -217,7 +215,7 @@ where
 }
 
 impl PackageConfig {
-    pub fn dependencies_for(&self, mode: Mode) -> Result<Dependencies> {
+    pub fn dependencies_for(&self, mode: Mode) -> Result<HashMap<EcoString, Requirement>> {
         match mode {
             Mode::Dev | Mode::Lsp => self.all_direct_dependencies(),
             Mode::Prod => Ok(self.dependencies.clone()),
@@ -226,7 +224,7 @@ impl PackageConfig {
 
     // Return all the dependencies listed in the configuration, that is, all the
     // direct dependencies, both in the `dependencies` and `dev_dependencies`.
-    pub fn all_direct_dependencies(&self) -> Result<Dependencies> {
+    pub fn all_direct_dependencies(&self) -> Result<HashMap<EcoString, Requirement>> {
         let mut deps =
             HashMap::with_capacity(self.dependencies.len() + self.dev_dependencies.len());
         for (name, requirement) in self.dependencies.iter().chain(&self.dev_dependencies) {
@@ -1207,7 +1205,7 @@ pub(crate) mod package_name {
     }
 }
 
-pub(crate) mod dependencies_map {
+pub mod map_with_package_name_keys {
     use ecow::EcoString;
     use serde::{Deserialize, Deserializer, de};
     use std::collections::HashMap;

@@ -13,7 +13,7 @@ use itertools::Itertools;
 pub struct Manifest {
     #[serde(
         serialize_with = "ordered_map",
-        deserialize_with = "super::config::dependencies_map::deserialize"
+        deserialize_with = "super::config::map_with_package_name_keys ::deserialize"
     )]
     pub requirements: HashMap<EcoString, Requirement>,
     #[serde(serialize_with = "sorted_vec")]