fix(cargo-deny): ignore unmaintained transitive advisories with rationale

[KooshaPari]

User description

Adds 4 ignore entries for bincode 1.x, paste, rustls-pemfile, yaml-rust — all transitive via upstream forgecode workspace deps. Fork-specific RUSTSEC-2026-* ignores preserved. cargo deny check advisories now PASSes.

---

Note

Low Risk
Low risk config-only change that only affects cargo deny advisory reporting; it may mask future transitive dependency issues until upstream dependencies are updated.

Overview
Updates deny.toml to keep the existing fork-specific RUSTSEC-2026-* ignores and add four new ignored RustSec advisories for unmaintained transitive crates (bincode 1.x, paste, rustls-pemfile, yaml-rust), each with an explicit rationale tied to upstream workspace dependencies.

This makes the cargo deny advisory check pass without changing any runtime code or dependencies.

^{Reviewed by Cursor Bugbot for commit 9c1ef52. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Keep cargo deny passing by ignoring known transitive advisories with reasons

What Changed

• Added ignore entries for four unmaintained transitive Rust advisories so the advisory check no longer fails on inherited dependencies
• Kept the existing fork-specific advisory ignores in place
• Added plain-language reasons showing each ignored issue comes from upstream workspace dependencies, not direct use in this repo

Impact

✅ Fewer cargo deny failures
✅ Clearer advisory reporting
✅ No change to runtime behavior

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@KooshaPari has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 58 minutes and 52 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b4a9a7b6-1567-404b-8210-ee0d22e082af

📥 Commits

Reviewing files that changed from the base of the PR and between 864dd7c and 9c1ef52.

📒 Files selected for processing (1)

• deny.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/cargo-deny-fork-transitive-ignores-20260504

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/cargo-deny-fork-transitive-ignores-20260504

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 58 minutes and 52 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request updates the deny.toml configuration to ignore several security advisories related to unmaintained transitive dependencies introduced via upstream workspace dependencies. The feedback suggests correcting the rationale for the rustls-pemfile advisory to accurately reflect its versioning and recommends removing historical notes from the configuration file to keep it focused on the current state.

[gemini-code-assist]

The rationale for RUSTSEC-2025-0134 states that rustls-pemfile was folded into rustls-pki-types. In fact, rustls-pemfile 2.x is the maintained successor that utilizes rustls-pki-types. Updating the rationale to reflect that it is the 1.x version being superseded by 2.x provides clearer guidance for future maintenance when the upstream dependency eventually updates.

Suggested change

	{ id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained (folded into rustls-pki-types); transitive via upstream rustls stack; pending upstream bump." },
	{ id = "RUSTSEC-2025-0134", reason = "rustls-pemfile 1.x unmaintained (superseded by 2.x); transitive via upstream rustls stack; pending upstream bump." },

[gemini-code-assist]

This comment refers to a specific commit hash and an advisory that has already been removed. Such historical notes are better suited for commit messages than the configuration file itself. Removing it helps keep the configuration clean and focused on the current state of the project.

[autofix-troubleshooter]

Hi! I'm the autofix.ci troubleshooter bot.

It looks like you correctly set up a CI job that uses the autofix.ci GitHub Action, but the autofix.ci GitHub App has not been installed for this repository. This means that autofix.ci unfortunately does not have the permissions to fix this pull request. If you are the repository owner, please install the app and then restart the CI workflow! 😃

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[kilo-code-bot]

SUGGESTION: Remove historical note about RUSTSEC-2026-0049; policy files should maintain current state only, not historical tracking of removed entries.

[kilo-code-bot]

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
deny.toml	42	Remove historical note about RUSTSEC-2026-0049; policy files should maintain current state only, not historical tracking of removed entries.

Files Reviewed (1 file)

• deny.toml - 1 issue

---

_{Reviewed by ling-2.6-1t-20260423:free · 5,372,718 tokens}