thebadking/obscura
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(deny): ignore the rustybuzz and ttf-parser unmaintained advisories

Browse Source 
RUSTSEC-2026-0206 (rustybuzz) and RUSTSEC-2026-0192 (ttf-parser) were
published after the last lockfile change. Both crates are transitive
through cosmic-text, which is pinned to =0.14.2 on purpose (its raster
backend must stay aligned with swash), and through the SVG stack. There
is no upgrade path without replacing the shaping engine, so the policy
audit now fails for any PR that touches Cargo.lock (#1072). Ignore the
two advisories with the same justification as the existing entries.

Note: the Policy job audits with the base branch's deny.toml, so this
change only takes effect for other PRs once it is on main.
This commit is contained in:
Andrey Mnatsakanov
2026-09-26 13:29:01 +02:00
parent 1a3169da27
commit aa90521ec0
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
deny.toml
View File

@@ -8,6 +8,8 @@
ignore = [
"RUSTSEC-2025-0057", # fxhash unmaintained, transitive via selectors
"RUSTSEC-2024-0436", # paste unmaintained, transitive via v8
"RUSTSEC-2026-0206", # rustybuzz unmaintained, transitive via the pinned cosmic-text
"RUSTSEC-2026-0192", # ttf-parser unmaintained, transitive via cosmic-text and the SVG stack
]
[bans]