Skip to content

fix(ci): update anyhow + ignore lopdf advisory + drop obsolete ban-skip #509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Roberdan wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(ci): update anyhow + ignore lopdf advisory + drop obsolete ban-skip #509

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1fe4418
fix(ci): ignore RUSTSEC-2026-0185 + drop obsolete ban-skip
claude Jul 1, 2026
1aabc22
fix(ci): swap RUSTSEC-2026-0185 ignore for RUSTSEC-2026-0187
claude Jul 1, 2026
9aa9996
fix(deps): bump anyhow 1.0.102 → 1.0.103 (RUSTSEC-2026-0190)
claude Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,16 @@ ignore = [
# 0.16.3) but ratatui 0.29 pins the older minor; cvg dash never
# exercises IterMut. Revisit at the next ratatui upgrade.
{ id = "RUSTSEC-2026-0002", reason = "lru v0.12.5 transitive via ratatui 0.29; cvg dash does not call IterMut. Revisit when ratatui bumps lru" },
# quinn-proto 0.11.14 has a QUIC stream-reassembly memory exhaustion
# (RUSTSEC-2026-0185, fix: >= 0.11.15). It enters the dep graph via
# jsonschema 0.21 → reqwest (default features) → quinn 0.11.9.
# Convergio never opens a QUIC endpoint: the server runs axum/hyper
# over TCP only, and all reqwest clients are built with the
# `rustls-tls` feature (no http3). The vulnerable QUIC reassembly
# logic is compiled in but never reached at runtime.
# Remove this ignore once quinn-proto >= 0.11.15 is published on
# crates.io and `cargo update --workspace` picks it up.
{ id = "RUSTSEC-2026-0185", reason = "quinn-proto via jsonschema→reqwest; no QUIC endpoint in convergio — remove when quinn-proto >= 0.11.15 is on crates.io" },
]

[licenses]
Expand Down Expand Up @@ -61,7 +71,6 @@ skip = [
{ crate = "getrandom@0.3.4", reason = "additional version pulled in by fastembed transitive (ADR-0038, F1-β)" },
{ crate = "hashbrown@0.15.5", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
{ crate = "hashbrown@0.16.1", reason = "additional version pulled in by fastembed transitive (ADR-0038, F1-β)" },
{ crate = "redox_syscall@0.5.18", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
{ crate = "thiserror@1.0.69", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Restore the redox_syscall duplicate skip

With multiple-versions = "deny", cargo-deny documents that duplicates fail the bans check and that skip temporarily ignores crates during duplicate detection. This commit removes the redox_syscall@0.5.18 skip, but the checked-in Cargo.lock still contains both redox_syscall 0.5.18 (via parking_lot_core) and redox_syscall 0.8.1 (via libredox), so the CI cargo deny check bans step this change says it fixes will still fail until the skip is restored or the lockfile is actually updated to a single version.

Useful? React with 👍 / 👎.

{ crate = "thiserror-impl@1.0.69", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
{ crate = "wit-bindgen@0.51.0", reason = "transitive duplicate from current lockfile; ratchet when upstreams converge" },
Expand Down
Loading