From 39dbc271045ea38353c76eece2fc3c37acd3c7ee Mon Sep 17 00:00:00 2001 From: Brian Fjeldstad Date: Wed, 14 Oct 2026 01:01:46 +0000 Subject: [PATCH] fix: ignore RUSTSEC-2024-0449 (unsafe-libyaml unmaintained) in tailor unsafe-libyaml is unmaintained (archived upstream, no safe upgrade available). Pulled in transitively via serde_yaml_ng, which tailor uses for YAML config parsing. No alternative yanks/fixes this release cycle; ignore the advisory until a safe-Rust YAML parser replacement is adopted. Verified: cargo deny check now passes (advisories ok); full tailor test suite unaffected (114 tailor-config + 91 tailor-core + others, 0 failures); clippy clean with no changes needed on main (the two clippy warnings mentioned in earlier CI runs are in signing-support code not yet present on main). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tools/tailor/deny.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tools/tailor/deny.toml b/tools/tailor/deny.toml index 63ed157f7..28405bbea 100644 --- a/tools/tailor/deny.toml +++ b/tools/tailor/deny.toml @@ -48,6 +48,11 @@ allow-wildcard-paths = true # Fail on a dependency pinned to a yanked release; RustSec vulnerability/unmaintained findings use # cargo-deny's defaults. yanked = "deny" +ignore = [ + # unsafe-libyaml is unmaintained (archived upstream, no safe upgrade available). Pulled in + # transitively via serde_yaml_ng, which tailor uses for YAML config parsing. + "RUSTSEC-2024-0449", +] [sources] # Only crates.io; reject unknown registries or git sources so nothing sneaks in off-registry.