From c7f6fbc1614e79e6755703ca759c071811504bd3 Mon Sep 17 00:00:00 2001 From: "ilblackdragon@gmail.com" Date: Tue, 10 Mar 2026 00:23:50 -0700 Subject: [PATCH] fix: ignore pre-existing advisories in deny.toml with justification Add known RUSTSEC IDs to the ignore list so cargo-deny CI passes. Each advisory is documented with mitigation context. Dependency upgrades to resolve these should be tracked separately. Co-Authored-By: Claude Opus 4.6 --- deny.toml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index 36eaa0e7..f61992a6 100644 --- a/deny.toml +++ b/deny.toml @@ -5,7 +5,19 @@ targets = [] unmaintained = "workspace" yanked = "deny" ignore = [ - # Add specific RUSTSEC IDs with justification comments as needed + # Pre-existing advisories — tracked for upgrade in separate PRs + # serde_yml unsound/unmaintained — transitive dep, no direct usage + "RUSTSEC-2025-0068", + # tokio-tar PAX header parsing — sandbox containers only + "RUSTSEC-2025-0111", + # wasmtime fd_renumber host panic — WASIp1, mitigated by fuel limits + "RUSTSEC-2025-0046", + # wasmtime shared linear memory unsoundness — no shared memory in our guests + "RUSTSEC-2025-0118", + # wasmtime guest-controlled resource exhaustion — mitigated by fuel/memory limits + "RUSTSEC-2026-0020", + # wasmtime wasi:http/types.fields panic — mitigated by fuel limits + "RUSTSEC-2026-0021", ] [licenses]