From 6b27b16b5337fd8610d7992ef18e23ea7e3eaf8c Mon Sep 17 00:00:00 2001 From: Bhaskar Gurram Date: Tue, 13 Oct 2026 19:15:04 -0400 Subject: [PATCH] ci: ignore RUSTSEC-2024-0449 (unsafe-libyaml unmaintained) until #53 RustSec marked unsafe-libyaml unmaintained on 2026-10-12, which fails cargo deny on main. provio pulls it in through serde_yaml 0.9. The notice is not a vulnerability and has no patched version; the migration off serde_yaml is tracked in #53. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017bQP5nwJVPMXqMhewzhQv5 Signed-off-by: Bhaskar Gurram --- deny.toml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index 446f2bb..25e8a68 100644 --- a/deny.toml +++ b/deny.toml @@ -1,7 +1,12 @@ [advisories] version = 2 yanked = "deny" -ignore = [] +ignore = [ + # unsafe-libyaml (via serde_yaml 0.9) was archived in 2024 and marked + # unmaintained on 2026-10-12. Not a vulnerability; no patched version. + # Remove once provio moves off serde_yaml: https://github.com/writ-agent/provio/issues/53 + { id = "RUSTSEC-2024-0449", reason = "unmaintained notice only; migration tracked in #53" }, +] [licenses] version = 2