From e9cd98e91fcb3c3f7006042640c79b4efcbb3ff5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 20:12:20 +0000 Subject: [PATCH] ci(deny): ignore RUSTSEC-2024-0449 (unsafe-libyaml unmaintained) unsafe-libyaml reaches the graph through serde_yaml, a non-optional dependency of zenoh-config 1.10.1, and aimdb-cli's optional yaml feature. No maintained upgrade exists; the zenoh connector builds its Config in code and never parses YAML. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01J2QULimKpNCt2w5JwQ5V6w --- .cargo/audit.toml | 1 + deny.toml | 1 + 2 files changed, 2 insertions(+) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 29665c4f..c6c46b76 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -46,4 +46,5 @@ ignore = [ # a zenoh release takes it. "RUSTSEC-2026-0041", # lz4_flex: uninitialized memory in decompression "RUSTSEC-2024-0436", # paste unmaintained (via zenoh-keyexpr/token-cell) + "RUSTSEC-2024-0449", # unsafe-libyaml unmaintained (via serde_yaml from zenoh-config; the connector builds Config in code, never from YAML) ] diff --git a/deny.toml b/deny.toml index 7e67c982..078a31e6 100644 --- a/deny.toml +++ b/deny.toml @@ -30,6 +30,7 @@ ignore = [ "RUSTSEC-2026-0173", # TEMP: proc-macro-error2 unmaintained (transitive via defmt-macros/tabled_derive) "RUSTSEC-2024-0436", # paste unmaintained: proc-macro only, via zenoh-keyexpr/token-cell (zenoh connector) "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (transitive via rumqttc and zenoh-link-commons) + "RUSTSEC-2024-0449", # unsafe-libyaml unmaintained, via serde_yaml from zenoh-config (zenoh connector never parses YAML config) and aimdb-cli's optional yaml feature "RUSTSEC-2026-0041", # lz4_flex decompression, via zenoh-transport: compiled only with transport_compression, which the zenoh connector never enables (see .cargo/audit.toml) ]