jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-02 15:31:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: ignore RUSTSEC-2026-0194/0195 (transitive quick-xml, no fix path)

Browse Source 
Quick-xml <0.41 has unbounded allocation / O(N^2) attribute checks that affect
attacker-controlled XML. Transitive via plist (pins ^0.39) and aws-creds/rust-s3
(pin ^0.38); no parent crate accepts the fixed 0.41 yet.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
This commit is contained in:
Will Pfleger
2026-07-02 11:24:38 -04:00
parent 89c4f76579
commit 68d2412c27
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
deny.toml
View File

@@ -6,6 +6,12 @@ ignore = [
# paste 1.0.15 — unmaintained. Transitive dep: mesh-llm → iroh → netlink-* → paste.
# No safe upgrade available; tracked for upstream (iroh/netlink) replacement.
{ id = "RUSTSEC-2024-0436", reason = "transitive dep via mesh-llm → iroh → netlink; no upstream fix available" },
# quick-xml <0.41 — unbounded allocation / O(N^2) attribute checks (DoS on
# attacker-controlled XML). Transitive: mesh-llm → iroh → netwatch → netdev
# → plist (pins ^0.39) and buzz-media → rust-s3/aws-creds (pin ^0.38).
# No parent accepts 0.41 yet; revisit when plist/aws-creds bump.
{ id = "RUSTSEC-2026-0194", reason = "transitive quick-xml <0.41 via plist and aws-creds; parents pin below fixed version" },
{ id = "RUSTSEC-2026-0195", reason = "transitive quick-xml <0.41 via plist and aws-creds; parents pin below fixed version" },
]
[licenses]