From f03cff9793607b44dc74c19891ce354789d693b1 Mon Sep 17 00:00:00 2001 From: Brian Fjeldstad Date: Wed, 14 Oct 2026 22:12:25 +0000 Subject: [PATCH] deny: acknowledge unsafe-libyaml maintenance advisory Suppress RUSTSEC-2024-0449 in the root cargo-deny policy, matching tools/tailor/deny.toml (#853). serde_yaml still depends on the archived unsafe-libyaml crate; replacing the YAML parser needs separate work. Other advisories remain enforced. Validated with cargo deny check advisories (RUSTSEC-2024-0449 no longer reported). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bf578387-c3f1-4356-b684-e768cfee0f93 --- deny.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/deny.toml b/deny.toml index f6a2f8091f..2219ccbc2f 100644 --- a/deny.toml +++ b/deny.toml @@ -23,6 +23,7 @@ db-urls = ["https://github.com/rustsec/advisory-db"] # output a note when they are encountered. ignore = [ #"RUSTSEC-0000-0000", + { id = "RUSTSEC-2024-0449", reason = "serde_yaml depends on unsafe-libyaml; migrate the YAML parser" }, ] # Threshold for security vulnerabilities, any vulnerability with a CVSS score # lower than the range specified will be ignored. Note that ignored advisories