From e78e7bc2a55503b611d43c623a1f25f5890b9fee Mon Sep 17 00:00:00 2001 From: Mollusk Date: Thu, 16 Jul 2026 23:46:13 -0400 Subject: [PATCH] supply-chain: ignore quick-xml build-time DoS advisories + ttf-parser unmaintained MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RUSTSEC-2026-0194/0195 (quick-xml 0.39.4, published 2026-06-29) broke the deny/audit CI gates on every push since June 29. quick-xml is reached only via the wayland-scanner proc-macro parsing vendored protocol XML at compile time — attacker input never touches it and it is absent from the shipped binary. The fixed 0.41.0 is semver-incompatible with wayland-scanner's `^0.39` req (no upstream bump yet); documented ignores until one exists. RUSTSEC-2026-0192 (ttf-parser unmaintained, via iced/cosmic-text) joins the existing unmaintained ignores (paste, audiopus_sys) — same class, same lockfile-pinning protection. New .cargo/audit.toml keeps cargo-audit in sync with deny.toml. Known leftover warning (allowed, non-failing): spin 0.10.0 is yanked but futures-buffered (via iroh) requires ^0.10 and no unyanked 0.10.x exists. Co-Authored-By: Claude Fable 5 --- .cargo/audit.toml | 11 +++++++++++ deny.toml | 13 +++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 .cargo/audit.toml diff --git a/.cargo/audit.toml b/.cargo/audit.toml new file mode 100644 index 0000000..d5d8f1c --- /dev/null +++ b/.cargo/audit.toml @@ -0,0 +1,11 @@ +# cargo-audit configuration. Keep the ignore list in sync with deny.toml, +# which carries the full justification for each entry. +[advisories] +ignore = [ + # quick-xml DoS advisories: build-time only, reached solely via the + # wayland-scanner proc-macro parsing trusted vendored protocol XML. + # Fix (0.41.0) is semver-incompatible with wayland-scanner's `^0.39`; + # drop once wayland-scanner bumps. See deny.toml. + "RUSTSEC-2026-0194", + "RUSTSEC-2026-0195", +] diff --git a/deny.toml b/deny.toml index 9011218..77ea954 100644 --- a/deny.toml +++ b/deny.toml @@ -24,6 +24,19 @@ ignore = [ # audiopus_sys: unmaintained FFI bindings to the stable libopus C library, # pulled in via our direct `opus 0.3.1` dep. No drop-in replacement. "RUSTSEC-2026-0150", + # ttf-parser: unmaintained, transitive via iced/cosmic-text (font parsing + # for the GUI). Inputs are system + embedded fonts, not network data. No + # upstream migration yet; revisit when iced moves off it. + "RUSTSEC-2026-0192", + # quick-xml 0.39.4 DoS advisories (quadratic dup-attr check; unbounded + # namespace allocation). Build-time only: quick-xml is reached solely via + # the wayland-scanner PROC-MACRO, which parses the wayland protocol XML + # files vendored inside the wayland-* crates at compile time. Attacker + # input never reaches it and it is not in the shipped binary. The fix + # (0.41.0) is semver-incompatible with wayland-scanner 0.31.x's `^0.39` + # requirement; drop both ignores once wayland-scanner releases a bump. + "RUSTSEC-2026-0194", + "RUSTSEC-2026-0195", ] # ---------------------------------------------------------------------------