From ce4dec73fcdfa41cc50c4a2f9b6d98c67a28781d Mon Sep 17 00:00:00 2001
From: "ilblackdragon@gmail.com" <ilblackdragon@gmail.com>
Date: Tue, 10 Mar 2026 11:15:11 -0700
Subject: [PATCH] fix(deny.toml): correct serde_yml advisory comment to reflect
 direct dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 deny.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deny.toml b/deny.toml
index dd7a2373..44007a33 100644
--- a/deny.toml
+++ b/deny.toml
@@ -3,7 +3,7 @@ unmaintained = "workspace"
 yanked = "deny"
 ignore = [
     # Pre-existing advisories — tracked for upgrade in separate PRs
-    # serde_yml unsound/unmaintained — transitive dep, no direct usage
+    # serde_yml unsound/unmaintained — direct dep, upgrade tracked separately
     "RUSTSEC-2025-0068",
     # tokio-tar PAX header parsing — sandbox containers only
     "RUSTSEC-2025-0111",