From cf1bb8dd13cd9b722b96473870bae98c57609b87 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Sun, 18 Oct 2026 13:06:27 -0400 Subject: [PATCH] chore(deny): exclude buzz-mesh-smoke from cargo-deny graph (#8413) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 Excludes the test-only `buzz-mesh-smoke` crate from the `cargo-deny` graph via `[graph] exclude` in `deny.toml`. `buzz-mesh-smoke` holds hardware smoke-test examples; nothing from it ships. It is the only root-workspace crate that depends on `mesh-llm`, which brings in `zip` 8.6 (RUSTSEC-2026-0367/-0368/-0369), the `zbus` 5 unmaintained notices (RUSTSEC-2026-0370/-0371/-0372), and `negentropy` via `mesh-llm-client` → `nostr-sdk` (RUSTSEC-2026-0365). None has a usable upstream fix for the pinned `mesh-llm` v0.76.2. The `zip` bump has merged upstream in [mesh-llm#2471](https://github.com/Mesh-LLM/mesh-llm/pull/2471), but no `mesh-llm` release contains it yet (latest is v0.78.1). CI's Security job runs `cargo-deny check` from the repo root, which reads this `deny.toml`, so the exclusion applies there. These advisories remain fatal for any shipped crate that pulls in the same dependencies. No existing advisory ignores were changed. Signed-off-by: Will Pfleger Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz> --- deny.toml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deny.toml b/deny.toml index 00b4f66ae4..2362c3f7c0 100644 --- a/deny.toml +++ b/deny.toml @@ -1,3 +1,9 @@ +[graph] +# buzz-mesh-smoke is a test-only hardware smoke-test crate; nothing from it ships. +# It is the only root-workspace crate depending on mesh-llm, whose zip/zbus +# advisories have no usable upstream fix for our pinned version. +exclude = ["buzz-mesh-smoke"] + [advisories] ignore = [ # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant.