coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ci: ignore RUSTSEC-2025-0134 (rustls-pemfile unmaintained) for agent

Browse Source 
The last failing job in the security scan, and one that only became
visible once fail-fast stopped cancelling it.

Same class as the instant advisory handled in search/deny.toml:
unmaintained, not vulnerable. rustls-pemfile's repository was archived
in August 2025; there is no CVE, and the advisory itself says "No safe
upgrade is available". It arrives via cairnobs-agent -> tonic 0.12.3 ->
rustls-pemfile 2.2.0, so the migration to rustls-pki-types' PemObject
API is tonic's to make, not ours. The final rustls-pemfile release is a
thin wrapper over that same rustls-pki-types code, so the archived crate
is not running different logic from its replacement.

Recorded with a note to delete the entry at the next tonic upgrade
rather than let it ossify.
This commit is contained in:
jcoffey-dev
2026-08-22 19:26:06 -07:00
parent 81ee47b1cd
commit cf2d0437d3
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent/deny.toml
+16
View File
@@ -70,6 +70,22 @@ feature-depth = 1
# A list of advisory IDs to ignore. Note that ignored advisories will still # A list of advisory IDs to ignore. Note that ignored advisories will still
# output a note when they are encountered. # output a note when they are encountered.
ignore = [ ignore = [
{ id = "RUSTSEC-2025-0134", reason = """
`rustls-pemfile` is unmaintained -- its repository was archived in
August 2025. A maintenance advisory, not a vulnerability: no CVE, no
known exploit, and the advisory itself states "No safe upgrade is
available".
It reaches us transitively (cairnobs-agent -> tonic 0.12.3 ->
rustls-pemfile 2.2.0), so there is nothing to fix on our side; the
upstream migration is tonic's to make, to the PemObject API that
rustls-pki-types has carried since 1.9.0. The last rustls-pemfile
release is a thin wrapper over that same code, so the archived crate is
not running different logic from its replacement.
Revisit when tonic is next upgraded -- check whether it has moved to
rustls-pki-types directly, and delete this entry if so rather than
letting it become permanent.""" },
#"RUSTSEC-0000-0000", #"RUSTSEC-0000-0000",
#{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" }, #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
#"[email protected]", # you can also ignore yanked crate versions if you wish #"[email protected]", # you can also ignore yanked crate versions if you wish