Zoltan KochanandClaude Opus 5
bd7d354f55
RUSTSEC-2026-0258 is accepted for one copy of h2: the 0.3.27 that libsql's gRPC stack pulls in, which has no patched release. cargo-deny scopes an ignore to an advisory id and never to a version, so that entry also silences the advisory on the 0.4 line, where a downgrade below the patched 0.4.16 would pass the check unnoticed. Two bans hold that line: a vulnerable 0.4 is refused outright, and the 0.3 line is allowed only behind its current direct dependents, so a new crate reaching for it fails instead of inheriting the exception. Both were negative-tested by widening them until they fire. Also corrects the dependency path in the ignore's rationale. It named axum on the chain to h2, but neither axum 0.6 nor 0.8 depends on h2 at all; the direct dependents of h2 0.3.27 are tonic 0.11 and hyper 0.14. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
163 lines
8.1 KiB
TOML
163 lines
8.1 KiB
TOML
# Configuration for cargo-deny (https://embarkstudios.github.io/cargo-deny/).
|
|
# The schema evolves fast; fields follow the 0.19+ format.
|
|
|
|
# --- Graph ---------------------------------------------------------------
|
|
[graph]
|
|
targets = []
|
|
all-features = false
|
|
no-default-features = false
|
|
|
|
# --- Output --------------------------------------------------------------
|
|
[output]
|
|
feature-depth = 1
|
|
|
|
# --- Advisories ----------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
|
|
[advisories]
|
|
db-path = "~/.cargo/advisory-db"
|
|
db-urls = ["https://github.com/rustsec/advisory-db"]
|
|
# Scope for RUSTSEC unmaintained advisories.
|
|
# One of "all", "workspace", "transitive", "none".
|
|
unmaintained = "workspace"
|
|
# yanked-crates check: "deny" | "warn" | "allow"
|
|
yanked = "warn"
|
|
ignore = [
|
|
# `pgp` pulls in `rsa` to verify OpenPGP signatures made by RSA Node.js
|
|
# release keys. Pacquet only performs public-key signature verification here;
|
|
# it never handles RSA private keys, so the private-key timing side channel
|
|
# described by this advisory is not reachable through this use.
|
|
{ id = "RUSTSEC-2023-0071", reason = "Only public-key OpenPGP signature verification is performed for pinned Node.js release keys; no RSA private-key operation is exposed." },
|
|
# hickory-proto 0.25.2 is pulled in transitively through reqwest 0.13.x ->
|
|
# hickory-resolver 0.25.x. The reqwest 0.13 line has not migrated to
|
|
# hickory-proto 0.26, so `cargo update` cannot resolve either advisory; the
|
|
# only paths forward are an upstream reqwest release on hickory 0.26 or
|
|
# dropping the `hickory-dns` reqwest feature, which would regress the macOS
|
|
# `mDNSResponder` / `EAI_NONAME` workaround landed in #302. Revisit when
|
|
# reqwest moves to hickory 0.26.
|
|
#
|
|
# NSEC3 closest-encloser proof unbounded loop in `DnssecDnsHandle`. The
|
|
# vulnerable path is only linked when hickory-proto is built with the
|
|
# `dnssec-ring` or `dnssec-aws-lc-rs` Cargo feature; reqwest's `hickory-dns`
|
|
# feature does not enable either, so the affected code is unreachable in
|
|
# pacquet. The advisory itself notes "No safe upgrade is available" for the
|
|
# 0.25 line.
|
|
{ id = "RUSTSEC-2026-0118", reason = "DNSSEC validation path is not linked: reqwest's `hickory-dns` feature does not enable hickory-proto's `dnssec-ring`/`dnssec-aws-lc-rs` features, and no fix exists on the 0.25 line." },
|
|
# O(n²) name compression in `BinEncoder` during DNS message encoding.
|
|
# Reachability is bounded: the BinEncoder is only invoked when reqwest's
|
|
# `hickory-dns` resolver builds outbound DNS queries for the registry
|
|
# hostnames pacquet resolves, which originate from `.npmrc` and so can be
|
|
# attacker-influenced in an untrusted-checkout / untrusted-CI scenario. We
|
|
# accept this temporary DoS risk because no upgrade is reachable: reqwest
|
|
# 0.13.x (latest 0.13.3) is locked to `hickory-resolver` 0.25, and the fix
|
|
# ships only in `hickory-proto` 0.26.1+. Revisit when reqwest moves to
|
|
# hickory 0.26.
|
|
{ id = "RUSTSEC-2026-0119", reason = "Temporary risk acceptance: reqwest 0.13.x (latest 0.13.3) is locked to hickory-resolver 0.25 and no release consumes hickory-proto 0.26.1+ yet; revisit on reqwest upgrade." },
|
|
# quick-xml DoS advisories (quadratic duplicate-attribute check, unbounded
|
|
# namespace-declaration allocation). quick-xml is reached only through
|
|
# object_store's S3 XML response parsing in pnpr, so the XML comes from the
|
|
# operator-configured S3-compatible storage backend, not from untrusted
|
|
# clients. Both fixes ship only in quick-xml 0.41.0, which no object_store
|
|
# release can resolve yet: object_store 0.13 requires ^0.39 and 0.14
|
|
# requires ^0.40.1. Revisit when object_store consumes quick-xml 0.41+.
|
|
{ id = "RUSTSEC-2026-0194", reason = "Temporary risk acceptance: XML parsed by quick-xml comes only from the operator-configured S3 backend via object_store; no object_store release consumes the patched quick-xml 0.41 yet." },
|
|
{ id = "RUSTSEC-2026-0195", reason = "Temporary risk acceptance: XML parsed by quick-xml comes only from the operator-configured S3 backend via object_store; no object_store release consumes the patched quick-xml 0.41 yet." },
|
|
# Unbounded queueing of empty HTTP/2 DATA frames (low-severity DoS). Only the
|
|
# `h2` 0.3 line is left unpatched here: pnpr's own HTTP/2 server surface runs
|
|
# on axum 0.8 -> hyper 1.x, which is on the fixed h2 0.4.16. The 0.3 copy is
|
|
# reached solely through libsql's gRPC client stack, whose `tonic` 0.11 and
|
|
# `hyper` 0.14 both depend on it directly. pnpr uses that client to talk out
|
|
# to the operator-configured libsql/sqld backend, so the frames it queues
|
|
# come from that backend rather than from untrusted registry clients. The fix
|
|
# ships only in h2 0.4.16 and 0.3.27 is the final 0.3 release, so no upgrade
|
|
# is reachable while the newest stable libsql (0.9.30) is pinned to tonic
|
|
# 0.11. Revisit when libsql 0.10 leaves prerelease.
|
|
#
|
|
# cargo-deny scopes an ignore to an advisory id, never to a version, so this
|
|
# entry would also silence the advisory on the 0.4 line. The `h2` bans below
|
|
# hold that line instead.
|
|
{ id = "RUSTSEC-2026-0258", reason = "Temporary risk acceptance: the unpatched h2 0.3 copy is reached only by libsql's outbound gRPC client to the operator-configured backend; pnpr's own server is on the patched h2 0.4.16, and no stable libsql release moves off tonic 0.11." },
|
|
]
|
|
|
|
# --- Licenses ------------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
|
|
[licenses]
|
|
allow = [
|
|
"MIT",
|
|
"MPL-2.0", # required by mockito, used by crates/tarball tests and tasks/micro-benchmark
|
|
"Apache-2.0",
|
|
"Unicode-3.0", # newer ICU crates switched from Unicode-DFS-2016 to this
|
|
"Unicode-DFS-2016",
|
|
"BSD-3-Clause",
|
|
"BSL-1.0",
|
|
"CDLA-Permissive-2.0", # `webpki-root-certs`, pulled in by reqwest's `rustls` feature
|
|
"ISC",
|
|
"Zlib", # required by foldhash, a transitive dep of rusqlite
|
|
]
|
|
confidence-threshold = 0.8
|
|
exceptions = [
|
|
# `pnpr` and `pnpr-fixtures` are first-party crates licensed under
|
|
# PolyForm Shield (see `pnpr/LICENSE.md`), not the MIT used by the rest
|
|
# of the workspace. cargo-deny only recognizes the PolyForm-Noncommercial
|
|
# identifier for this license text, so allow that id for just these two
|
|
# crates (the clarify entries below pin it by file hash).
|
|
{ name = "pnpr", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
{ name = "pnpr-fixtures", allow = ["PolyForm-Noncommercial-1.0.0"] },
|
|
]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "pnpr-fixtures"
|
|
expression = "PolyForm-Noncommercial-1.0.0"
|
|
license-files = [{ path = "../../LICENSE.md", hash = 0x652a978e }]
|
|
|
|
[[licenses.clarify]]
|
|
name = "ring"
|
|
version = "*"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [
|
|
{ path = "LICENSE", hash = 0xbd0eed23 },
|
|
]
|
|
|
|
[licenses.private]
|
|
ignore = false
|
|
registries = []
|
|
|
|
# --- Bans ----------------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
wildcards = "allow"
|
|
highlight = "all"
|
|
workspace-default-features = "allow"
|
|
external-default-features = "allow"
|
|
allow = []
|
|
deny = [
|
|
# RUSTSEC-2026-0258 is ignored above, and cargo-deny can only ignore an
|
|
# advisory for the whole workspace. These two bans keep that ignore from
|
|
# covering more than the one copy it was accepted for: a vulnerable `h2` on
|
|
# the 0.4 line is refused outright, and the unpatched 0.3 line stays reachable
|
|
# only from libsql's gRPC stack, whose `tonic` and `hyper` are its sole direct
|
|
# dependents. Drop both once libsql moves off tonic 0.11 and the ignore goes.
|
|
{ name = "h2", version = ">=0.4, <0.4.16" },
|
|
{ name = "h2", version = "<0.4", wrappers = ["hyper", "tonic"] },
|
|
]
|
|
skip = []
|
|
skip-tree = []
|
|
|
|
# --- Sources -------------------------------------------------------------
|
|
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
|
|
[sources]
|
|
unknown-registry = "warn"
|
|
unknown-git = "warn"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
allow-git = []
|
|
|
|
[sources.allow-org]
|
|
github = []
|
|
gitlab = []
|
|
bitbucket = []
|