Repository navigation
Conversation
| [advisories] | ||
| ignore = [ | ||
| "RUSTSEC-2025-0056", # unmaintained: adler; should switch to adler2 | ||
| "RUSTSEC-2026-0007", # vulnerability: adler; irrelevant because we don't use BytesMut |
There was a problem hiding this comment.
This is in bytes, not adler.
There was a problem hiding this comment.
Good catch. Also now irrelevant, this advisory only turned up for me because I was running cargo deny against an old lock file. With a fresh one this advisory is already cleared because bytes is up to date. Since we don't track the Cargo.lock file (even though we probably should) it's irrelevant to ACK an already past advisory.
| [bans] | ||
| multiple-versions = "deny" | ||
| skip = [ | ||
| { name = "rustc-hash" }, |
There was a problem hiding this comment.
Non-blocking: Could this include the version?
There was a problem hiding this comment.
It could, but I don't think that would help. We would have to list it twice, once for each of the 1.x and 2.x versions that are required as transitive dependencies that require them. Then they would have to be updated any time minor versions of those came out and got bumped. I'd rather just let them update to minor & patch releases in the right series as long as the anything still depends on the 1.x releases.
There was a problem hiding this comment.
This is also subject to my ancient lock file. We no longer need two rustc-hash major versions. But now the same story is true for syn which we transitively depend on both 2.x and 3.x.
ca93f13 to
8a5e131
Compare
2 participants
Housekeeping... looking around for what needs attention most urgently.