From 68d2412c277e0278e4ecc91a990e1bc5d73950ed Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 2 Jul 2026 11:24:38 -0400 Subject: [PATCH] chore: ignore RUSTSEC-2026-0194/0195 (transitive quick-xml, no fix path) Quick-xml <0.41 has unbounded allocation / O(N^2) attribute checks that affect attacker-controlled XML. Transitive via plist (pins ^0.39) and aws-creds/rust-s3 (pin ^0.38); no parent crate accepts the fixed 0.41 yet. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- deny.toml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deny.toml b/deny.toml index 149b39bdf0..3da63e23ee 100644 --- a/deny.toml +++ b/deny.toml @@ -6,6 +6,12 @@ ignore = [ # paste 1.0.15 — unmaintained. Transitive dep: mesh-llm → iroh → netlink-* → paste. # No safe upgrade available; tracked for upstream (iroh/netlink) replacement. { id = "RUSTSEC-2024-0436", reason = "transitive dep via mesh-llm → iroh → netlink; no upstream fix available" }, + # quick-xml <0.41 — unbounded allocation / O(N^2) attribute checks (DoS on + # attacker-controlled XML). Transitive: mesh-llm → iroh → netwatch → netdev + # → plist (pins ^0.39) and buzz-media → rust-s3/aws-creds (pin ^0.38). + # No parent accepts 0.41 yet; revisit when plist/aws-creds bump. + { id = "RUSTSEC-2026-0194", reason = "transitive quick-xml <0.41 via plist and aws-creds; parents pin below fixed version" }, + { id = "RUSTSEC-2026-0195", reason = "transitive quick-xml <0.41 via plist and aws-creds; parents pin below fixed version" }, ] [licenses]