trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-29 07:23:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): accept build-only zip advisories (#4710)

Browse Source 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
This commit is contained in:
Simon Scatton
2026-10-19 13:02:52 +00:00
committed by GitHub
parent b1cfc91720
commit b4cf1ddb0c
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deny.toml
+7
View File
@@ -21,6 +21,13 @@ ignore = [
{ id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" },
{ id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" },
{ id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" },
# zip is used only by z3-sys's build script with prebuilt-z3 enabled to
# extract upstream Z3 GitHub release assets, never runtime/user archives.
# Accept the build-time risk of a compromised upstream release asset until
# z3-sys supports zip >=9; remove these exceptions once it can be upgraded.
{ id = "RUSTSEC-2026-0367", reason = "zip privileged permission bits — build-only Z3 release extraction; awaiting z3-sys support for zip >=9" },
{ id = "RUSTSEC-2026-0368", reason = "zip symlink target escape — build-only Z3 release extraction; awaiting z3-sys support for zip >=9" },
{ id = "RUSTSEC-2026-0369", reason = "zip permissions follow symlinks — build-only Z3 release extraction; awaiting z3-sys support for zip >=9" },
]
# -- Licenses ------------------------------------------------------------------