Skip to content

fix(deps): clear the new RustSec advisories #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheStreamCode merged 1 commit into from
Nov 4, 2026
Merged

fix(deps): clear the new RustSec advisories #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ ignore = [
{ id = "RUSTSEC-2026-0367", reason = "zip preserves SUID/SGID bits through ZipArchive::extract(). We never call extract(): pptx reads entries in memory by name, the Windows updater copies entries manually behind enclosed_name() with symlinks refused and created files never take archive modes, and the transitive office_oxide copy (zip 8.6) has zero .extract( call sites. Only a major 3→9 migration closes it." },
{ id = "RUSTSEC-2026-0368", reason = "zip extract() follows attacker symlinks. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide, and our manual copy path refuses symlinks outright. Only a major 3→9 migration closes it." },
{ id = "RUSTSEC-2026-0369", reason = "zip extract() applies Unix permissions through symlinks. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide. Only a major 3→9 migration closes it." },
{ id = "RUSTSEC-2026-0429", reason = "zip extract() sizes a symlink-target buffer from the archive's declared uncompressed size. Same reachability as RUSTSEC-2026-0367: no extract() call anywhere in this tree or in transitive office_oxide; pptx reads entries by name in memory and the Windows updater copies entries manually behind enclosed_name() with symlinks refused. Only a major 3→9 migration closes it." },
{ id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is unmaintained (repository archived 2024-03-25), not vulnerable — there is no affected API to avoid. Transitive through serde_yaml 0.9 (mermaid-to-svg), already at its last release 0.2.11, so no bump closes it; the maintained replacement is serde_yaml's call to make." },
{ id = "RUSTSEC-2026-0370", reason = "zvariant is unmaintained as a standalone crate (merged into zbus 6), not vulnerable. Transitive through zbus 5.14 (ashpd, dark-light theme detection); only a zbus 5→6 migration closes it." },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names is unmaintained as a standalone crate (merged into zbus 6), not vulnerable. Transitive through zbus 5.14 (ashpd, dark-light theme detection); only a zbus 5→6 migration closes it." },
Expand Down
Loading