From cee48385b76631270f68ea1e928060cc378bf405 Mon Sep 17 00:00:00 2001 From: skylar taylor-barrick Date: Sat, 17 Oct 2026 12:57:57 -0600 Subject: [PATCH] deny: acknowledge the new zbus unmaintained advisories RUSTSEC-2026-0370/0371/0372 were published today for zvariant, zbus_names and zvariant_derive. All three are unmaintained notices rather than vulnerabilities, and none has a fixed release to move to. They reach the tree as the D-Bus stack behind accesskit_unix -> atspi (Linux accessibility) and as a dev-dependency of pdfcraft-platform, so nothing ships in the other targets' binaries. This is why main went red today; no dependency version changed. --- deny.toml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/deny.toml b/deny.toml index 2362d5682..ed9c26c20 100644 --- a/deny.toml +++ b/deny.toml @@ -48,6 +48,13 @@ ignore = [ # winprint's fmt-derive (craft-print's Windows spooler), so it runs at compile time on Windows # and is not in the binary. { id = "RUSTSEC-2024-0370", reason = "compile-time proc macro of winprint's fmt-derive (craft-print Windows printing, #1107)" }, + # zvariant, zbus_names and zvariant_derive are unmaintained (no vulnerability, and no fixed + # release to move to). They reach the tree as the D-Bus stack behind `accesskit_unix` -> + # `atspi`, which is Linux accessibility only, and as a dev-dependency of pdfcraft-platform. + # Revisit when the accesskit/zbus chain moves to a maintained successor. + { id = "RUSTSEC-2026-0370", reason = "zvariant unmaintained; Linux a11y stack via accesskit_unix" }, + { id = "RUSTSEC-2026-0371", reason = "zbus_names unmaintained; Linux a11y stack via accesskit_unix" }, + { id = "RUSTSEC-2026-0372", reason = "zvariant_derive unmaintained; Linux a11y stack via accesskit_unix" }, ] # egui's default UI fonts (Ubuntu-Light, Hack, emoji-icon-font): font licences on the AGENTS.md