From cf2d0437d34488521faa53d620f6870441d2a053 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 22 Aug 2026 19:26:06 -0700 Subject: [PATCH] ci: ignore RUSTSEC-2025-0134 (rustls-pemfile unmaintained) for agent The last failing job in the security scan, and one that only became visible once fail-fast stopped cancelling it. Same class as the instant advisory handled in search/deny.toml: unmaintained, not vulnerable. rustls-pemfile's repository was archived in August 2025; there is no CVE, and the advisory itself says "No safe upgrade is available". It arrives via cairnobs-agent -> tonic 0.12.3 -> rustls-pemfile 2.2.0, so the migration to rustls-pki-types' PemObject API is tonic's to make, not ours. The final rustls-pemfile release is a thin wrapper over that same rustls-pki-types code, so the archived crate is not running different logic from its replacement. Recorded with a note to delete the entry at the next tonic upgrade rather than let it ossify. --- agent/deny.toml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/agent/deny.toml b/agent/deny.toml index 9517449..51ff068 100644 --- a/agent/deny.toml +++ b/agent/deny.toml @@ -70,6 +70,22 @@ feature-depth = 1 # A list of advisory IDs to ignore. Note that ignored advisories will still # output a note when they are encountered. ignore = [ + { id = "RUSTSEC-2025-0134", reason = """ +`rustls-pemfile` is unmaintained -- its repository was archived in +August 2025. A maintenance advisory, not a vulnerability: no CVE, no +known exploit, and the advisory itself states "No safe upgrade is +available". + +It reaches us transitively (cairnobs-agent -> tonic 0.12.3 -> +rustls-pemfile 2.2.0), so there is nothing to fix on our side; the +upstream migration is tonic's to make, to the PemObject API that +rustls-pki-types has carried since 1.9.0. The last rustls-pemfile +release is a thin wrapper over that same code, so the archived crate is +not running different logic from its replacement. + +Revisit when tonic is next upgraded -- check whether it has moved to +rustls-pki-types directly, and delete this entry if so rather than +letting it become permanent.""" }, #"RUSTSEC-0000-0000", #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" }, #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish