From ea73cce5b7e72330290cd9512a0e365a21828574 Mon Sep 17 00:00:00 2001 From: hellno Date: Mon, 29 Jun 2026 23:14:15 +0200 Subject: [PATCH] ci(deny): ignore RUSTSEC-2026-0192 (ttf-parser unmaintained) (#123) ttf-parser is flagged unmaintained (RUSTSEC-2026-0192, advisory not a vulnerability). It is transitive via gpui (fontdb -> usvg) for runtime font/SVG glyph parsing, with no maintained drop-in in the pinned tree, so the documented remedy is a justified ignore alongside the other transitive unmaintained advisories. Re-evaluate on the next just bump-gpui. Unblocks the required cargo-deny-advisories gate (verified: advisories ok). --- deny.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/deny.toml b/deny.toml index 354c1cf..58f0670 100644 --- a/deny.toml +++ b/deny.toml @@ -48,6 +48,7 @@ ignore = [ { id = "RUSTSEC-2025-0052", reason = "async-std discontinued; transitive, no maintained drop-in in the pinned tree" }, { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained (superseded by rustls-pki-types); transitive via Helios + the Zed gpui fork" }, { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained; build-time proc-macro only, no runtime surface" }, + { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained; transitive via gpui (fontdb->usvg) runtime font/SVG glyph parsing; no maintained drop-in in the pinned tree; re-evaluate on just bump-gpui" }, # ── gtk-rs GTK3 bindings — unmaintained (the gtk3-rs project is EOL, superseded by gtk4-rs). Pulled # ONLY by the optional `tray` feature (libappindicator → gtk3); not in the default build. The tray # ecosystem (tray-icon/libappindicator) has no GTK4 path yet, so this rides until that lands.