aleleba/pdfcraft
1
0
Fork 0
mirror of https://github.com/storytold/pdfcraft.git synced 2026-10-24 01:57:12 -06:00
Code Issues Packages Projects Releases Wiki Activity

deny: acknowledge the new zbus unmaintained advisories

Browse Source 
RUSTSEC-2026-0370/0371/0372 were published today for zvariant, zbus_names and
zvariant_derive. All three are unmaintained notices rather than vulnerabilities,
and none has a fixed release to move to. They reach the tree as the D-Bus stack
behind accesskit_unix -> atspi (Linux accessibility) and as a dev-dependency of
pdfcraft-platform, so nothing ships in the other targets' binaries.

This is why main went red today; no dependency version changed.
This commit is contained in:
skylar taylor-barrick
2026-10-17 12:57:57 -06:00
parent bc7a12b94a
commit cee48385b7
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deny.toml
+7
View File
@@ -48,6 +48,13 @@ ignore = [
# winprint's fmt-derive (craft-print's Windows spooler), so it runs at compile time on Windows
# and is not in the binary.
{ id = "RUSTSEC-2024-0370", reason = "compile-time proc macro of winprint's fmt-derive (craft-print Windows printing, #1107)" },
# zvariant, zbus_names and zvariant_derive are unmaintained (no vulnerability, and no fixed
# release to move to). They reach the tree as the D-Bus stack behind `accesskit_unix` ->
# `atspi`, which is Linux accessibility only, and as a dev-dependency of pdfcraft-platform.
# Revisit when the accesskit/zbus chain moves to a maintained successor.
{ id = "RUSTSEC-2026-0370", reason = "zvariant unmaintained; Linux a11y stack via accesskit_unix" },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names unmaintained; Linux a11y stack via accesskit_unix" },
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive unmaintained; Linux a11y stack via accesskit_unix" },
]
# egui's default UI fonts (Ubuntu-Light, Hack, emoji-icon-font): font licences on the AGENTS.md