Bump astral-tokio-tar from 0.6.4 to 0.7.0 in /rust

[dependabot]

Bumps astral-tokio-tar from 0.6.4 to 0.7.0.

Release notes

Sourced from astral-tokio-tar's releases.

astral-tokio-tar v0.7.0

What's Changed

• Bump the github-actions group across 1 directory with 5 updates by @​dependabot[bot] in astral-sh/tokio-tar#108
• Fix Clippy with Rust 1.98 by @​woodruffw in astral-sh/tokio-tar#111
• Add dependency cooldown for release script by @​woodruffw in astral-sh/tokio-tar#110
• Use safe transmute and remove all unsafe code by @​konstin in astral-sh/tokio-tar#48
• Use astral-dev-toolchain by @​woodruffw in astral-sh/tokio-tar#112
• Revert "Apply PAX size overrides to entry headers" by @​woodruffw in astral-sh/tokio-tar#114
• Undo manual version bump by @​woodruffw in astral-sh/tokio-tar#115
• Fix release.py lock by @​woodruffw in astral-sh/tokio-tar#116
• Bump version to 0.7.0 by @​github-actions[bot] in astral-sh/tokio-tar#117

Full Changelog: astral-sh/tokio-tar@v0.6.4...v0.7.0

Changelog

Sourced from astral-tokio-tar's changelog.

0.7.0

• Remove all unsafe code from the crate
• New API: Entry::effective_size returns the effective size of an archive entry, including any pax size records that apply to it
• Changed: Header::entry_size is now Header::raw_entry_size
• Changed: Header::size is now Header::raw_file_size

0.5.6

• Fixed a parser desynchronization vulnerability when reading tar archives that contain mismatched size information in PAX/ustar headers.

  This vulnerability is being tracked as GHSA-j5gw-2vrg-8fgx and CVE-2025-62518.

0.5.5

• This is a corrective release for 0.5.4 to fix a debugging artifact that was accidentally left in the release.

0.5.4

• Fixed a path traversal vulnerability when using the unpack_in_raw API by @​charliermarsh

  This vulnerability is being tracked as GHSA-3wgq-wrwc-vqmv.

0.5.3

• Expose TarError publicly by @​konstin in astral-sh/tokio-tar#52

0.5.2

• Enable opt-in to deny creation of symlinks outside target directory by @​charliermarsh in astral-sh/tokio-tar#46

0.5.1

• Add test to reproduce issue in impl Stream for Entries causing filename truncation by @​charliermarsh in astral-sh/tokio-tar#41
• Avoid truncation during pending reads by @​charliermarsh in astral-sh/tokio-tar#40

0.5.0

• Setting preserve_permissions to false will avoid setting any permissions on extracted files. In alexcrichton/tar-rs, setting preserve_permissions to false will still set read, write, and execute permissions on extracted files, but will avoid setting extended permissions (e.g., setuid, setgid, and sticky bits).
• Avoid creating directories outside the unpack target (see: alexcrichton/tar-rs#259).
• Added unpack_in_raw which memoizes the set of validated paths (and assumes a pre-canonicalized) unpack target to avoid redundant filesystem operations.

Commits

• 978c1d2 Bump version to 0.7.0 (#117)
• 73ff7e5 Fix release.py lock (#116)
• 356e172 Undo manual version bump (#115)
• 4cf17c2 Revert "Apply PAX size overrides to entry headers" (#114)
• c6a7d4f Use astral-dev-toolchain (#112)
• 4743b87 Use safe transmute and remove all unsafe code (#48)
• bc57f71 Add dependency cooldown for release script (#110)
• 72d1999 Fix Clippy with Rust 1.98 (#111)
• d80334f Bump the github-actions group across 1 directory with 5 updates (#108)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)