From 75c15d4b293fc7f2f86dc889577c57ee9214f667 Mon Sep 17 00:00:00 2001 From: Arnold Loubriat Date: Mon, 13 Jul 2026 23:34:20 +0200 Subject: [PATCH 1/2] fix: Ignore security advisories on dev dependencies --- deny.toml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index b40581e9c..9de842000 100644 --- a/deny.toml +++ b/deny.toml @@ -15,7 +15,11 @@ all-features = true [advisories] db-path = "~/.cargo/advisory-db" db-urls = ["https://github.com/rustsec/advisory-db"] -ignore = [] +ignore = [ + { id = "RUSTSEC-2026-0192", reason = "ttf-parser is unmaintained; pulled in by sctk-adwaita via ab_glyph/owned_ttf_parser; only a dev dependency" }, + { id = "RUSTSEC-2026-0194", reason = "quick-xml DoS on untrusted XML; only used at build time by wayland-scanner on trusted protocol files, and wayland-scanner requires quick-xml 0.37.2; only a dev dependency" }, + { id = "RUSTSEC-2026-0195", reason = "same quick-xml build-time usage as RUSTSEC-2026-0194; only a dev dependency" }, +] [licenses] allow = [ From c4eccc179cc7eaf9a23a2e2d97bc195977070b19 Mon Sep 17 00:00:00 2001 From: Arnold Loubriat Date: Tue, 14 Jul 2026 18:31:03 +0200 Subject: [PATCH 2/2] Update wording to include zbus-lockstep build-time path --- deny.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/deny.toml b/deny.toml index 9de842000..9f584ece8 100644 --- a/deny.toml +++ b/deny.toml @@ -17,8 +17,8 @@ db-path = "~/.cargo/advisory-db" db-urls = ["https://github.com/rustsec/advisory-db"] ignore = [ { id = "RUSTSEC-2026-0192", reason = "ttf-parser is unmaintained; pulled in by sctk-adwaita via ab_glyph/owned_ttf_parser; only a dev dependency" }, - { id = "RUSTSEC-2026-0194", reason = "quick-xml DoS on untrusted XML; only used at build time by wayland-scanner on trusted protocol files, and wayland-scanner requires quick-xml 0.37.2; only a dev dependency" }, - { id = "RUSTSEC-2026-0195", reason = "same quick-xml build-time usage as RUSTSEC-2026-0194; only a dev dependency" }, + { id = "RUSTSEC-2026-0194", reason = "quick-xml DoS on untrusted XML; only used at build time by wayland-scanner on trusted protocol files, and wayland-scanner requires quick-xml 0.37.2; doesn't execute on end-users system" }, + { id = "RUSTSEC-2026-0195", reason = "same quick-xml build-time usage as RUSTSEC-2026-0194; doesn't execute on end-users system" }, ] [licenses]