From b0e252c87166bf60b5239d9f9cc885d37a22de4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Sat, 31 Oct 2026 02:30:23 -0400 Subject: [PATCH] chore(deny): accept the unmaintained crates that have no fix unsafe-libyaml comes through serde_yaml 0.9, its final release. zvariant, zbus_names and zvariant_derive were folded into zbus 6, but dark-light, even at 3.0, still needs zbus 5. cargo deny check advisories passes. --- deny.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/deny.toml b/deny.toml index 846d09a..1ef245b 100644 --- a/deny.toml +++ b/deny.toml @@ -20,6 +20,11 @@ ignore = [ { id = "RUSTSEC-2026-0192", reason = "rustybuzz via pdf_oxide/resvg (latest); local rendering" }, { id = "RUSTSEC-2026-0195", reason = "ttf-parser via fontdb/resvg (latest); local font parsing" }, { id = "RUSTSEC-2024-0320", reason = "yaml-rust via syntect (latest); parses bundled syntax defs" }, + { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml via serde_yaml 0.9 (final release)" }, + # zbus 6 absorbed these crates; dark-light 3 (latest) still needs zbus 5. + { id = "RUSTSEC-2026-0370", reason = "zvariant via zbus 5" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names via zbus 5" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive via zbus 5" }, ] [licenses]