From ead689a6009a6a35bd6f1d93a2f646846c85e5d9 Mon Sep 17 00:00:00 2001 From: kewton Date: Tue, 13 Oct 2026 01:05:44 +0900 Subject: [PATCH] Ignore RUSTSEC-2024-0449 until the serde_yaml migration (#530) Co-Authored-By: Claude Opus 5.5 --- deny.toml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/deny.toml b/deny.toml index c199efbb..3439831d 100644 --- a/deny.toml +++ b/deny.toml @@ -9,9 +9,15 @@ # default set). See docs/dev/dev-guardrails.md for the surrounding CI contract. [advisories] -# No advisory is ignored. A new advisory must fail the check; add an entry here -# only with a written reason and a link to the tracking Issue. -ignore = [] +# A new advisory must fail the check; add an entry here only with a written +# reason and a link to the tracking Issue. +ignore = [ + # unsafe-libyaml is unmaintained (published 2026-10). It reaches us only + # through serde_yaml 0.9, which has no safe upgrade. Temporary, approved by + # the user 2026-10-13: remove this entry in the PR that migrates off + # serde_yaml (https://github.com/Kewton/CommandAgent/issues/530). + { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml via serde_yaml 0.9; migration tracked in #530" }, +] [licenses] # Curated allow list matching the current dependency graph. BSL-1.0 is required