Repository navigation
security: 1 CVE advisories in Cargo.lock (bridge triage, Track E) #106
Description
panic-attack estate sweep — Track E bridge triage
panic-attack bridge triage (RustSec advisory DB, with reachability analysis) found 1 CVE/advisory findings in this repo's Cargo.lock (out of 473 total dependencies; 1 vulnerable).
Severity: medium: 1
Reachability: phantom: 1
Classification: informational: 1
Each finding includes a recommended action (often Remove unused dependency for phantom-imported crates). Reachability phantom = declared in Cargo.toml but never imported in any .rs file — removing the dep eliminates the CVE entirely with no behavioural change.
Estate tracker: hyperpolymath/panic-attack#32.
Findings
full advisory list
RUSTSEC-2024-0436 paste@1.0.15 medium reach=phantom class=informational fix=
🤖 Discovered during the panic-attack estate sweep (2026-05-26) — Track E (bridge triage). See hyperpolymath/panic-attack#32 for campaign tracker.
Activity
hyperpolymath commentedon May 27, 2026
Phantom claim cannot be verified — skipping PR
Track E phantom-strip fan-out (Batch A) attempted on this repo.
Finding:
paste@1.0.15flaggedreach=phantom(RUSTSEC-2024-0436, unmaintained).Verification result:
pasteis NOT declared in any of the 11+ workspaceCargo.tomlfiles in this repo (grep -rn '^paste *='across root,fuzz/,crates/*/,src/interfaces/*/returns 0 hits). It is a transitive dep.Note: file-soup#50 was able to strip
pastebecause in that repo it was pulled via aimage -> ravif -> rav1e -> pastechain rooted at a truly-phantomimagedeclaration. In this repo there is no such top-level phantom to strip — the parent chain rootingpastehere is from a crate that IS used.This is the same misclassification pattern noted in the file-soup pilot (#50 PR body): the bridge classifier labels any crate not appearing in a
use <crate>statement asphantom, but transitive deps used via parent-crate APIs aren't truly phantom.Disposition: Phantom-strip is not applicable. Closing this advisory requires either parent-chain identification + bump, or waiting for the affected parent to drop
paste. No PR filed.cc hyperpolymath/panic-attack#32 — bridge classifier may benefit from distinguishing declared-but-unused (true phantom, strippable) from transitive-only (not strippable from this repo).
hyperpolymath commentedon May 30, 2026
Closing as not-applicable
Re-verified 2026-05-30. The original owner comment already documented:
Per that triage, this finding is a bridge-classifier false positive (declared-but-unused vs transitive-only). The 1/473 medium severity rating is informational; the advisory does not require an in-repo PR.
Closing as not-actionable. The estate-wide classifier improvement is tracked at panic-attack#32. If the parent chain rooting
pasteis later bumped, the advisory will drop on its own.hyperpolymath commentedon May 30, 2026
Not-applicable per the owner triage already in the issue.