From 849a0658b8a273182ad2530383b259c19266060f Mon Sep 17 00:00:00 2001 From: Paco Date: Tue, 13 Oct 2026 16:53:09 -0700 Subject: [PATCH] tailor: temporarily ignore unmaintained libyaml advisory Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tools/tailor/deny.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/tailor/deny.toml b/tools/tailor/deny.toml index 63ed157f7..8bbc0492a 100644 --- a/tools/tailor/deny.toml +++ b/tools/tailor/deny.toml @@ -48,6 +48,9 @@ allow-wildcard-paths = true # Fail on a dependency pinned to a yanked release; RustSec vulnerability/unmaintained findings use # cargo-deny's defaults. yanked = "deny" +ignore = [ + { id = "RUSTSEC-2024-0449", reason = "serde_yaml_ng depends on unsafe-libyaml; migrate the YAML parser" }, +] [sources] # Only crates.io; reject unknown registries or git sources so nothing sneaks in off-registry.