fix(ci): ignore quick-xml RUSTSEC-2026-0194/0195 to unblock cargo-deny - #239
Merged
Merged
Conversation
Two newly-published advisories for quick-xml (quadratic runtime on duplicate attribute names, and unbounded namespace-declaration allocation) now fail `cargo deny check advisories` on every run, turning the required "Check & Test (Rust)" gate red repo-wide and breaking the nightly build. quick-xml enters only transitively on Linux via wayland-scanner -> arboard -> tauri-plugin-clipboard-manager, so it cannot be bumped without an upstream Tauri/wayland update. Ignore it alongside the other Tauri Linux transitive advisories, matching the existing policy in this file. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Rust supply-chain policy to unblock CI by ignoring two newly published RustSec advisories affecting transitive quick-xml dependencies pulled in via the Tauri Linux stack.
Changes:
- Add
RUSTSEC-2026-0194tocargo-denyadvisories ignore list. - Add
RUSTSEC-2026-0195tocargo-denyadvisories ignore list.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+25
to
+26
| "RUSTSEC-2026-0194", # quick-xml: quadratic runtime on duplicate attrs (via wayland-scanner, Tauri Linux clipboard) | ||
| "RUSTSEC-2026-0195", # quick-xml: unbounded namespace-declaration alloc (via wayland-scanner, Tauri Linux clipboard) |
Comment on lines
+25
to
+26
| "RUSTSEC-2026-0194", # quick-xml: quadratic runtime on duplicate attrs (via wayland-scanner, Tauri Linux clipboard) | ||
| "RUSTSEC-2026-0195", # quick-xml: unbounded namespace-declaration alloc (via wayland-scanner, Tauri Linux clipboard) |
adamgell
added a commit
that referenced
this pull request
Jul 13, 2026
Expand the [Unreleased] section to cover every commit since v1.3.2: - Log Text column auto-fit on load (this branch) - CCM type="0" first-class Success severity + empty-type coercion fix (#248) - clippy --all-targets enforcement (#245) - Full vs Lite editions README docs (#241) - quick-xml RUSTSEC-2026-0194/0195 advisory ignore (#239) and the Microsoft Security DevOps workflow - signed nightly build channel, updater feed, and failure alerting (#236) - a Dependencies subsection with exact Rust / frontend / GitHub Actions version deltas Version numbers and behavioral claims were taken from the commit diffs, not the commit subjects. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
cargo deny check advisories(part of the required Check & Test (Rust) gate) fails on every run right now, turning CI red repo-wide and breaking the nightly build. Two newly-published advisories are the cause:RUSTSEC-2026-0194— quick-xml: quadratic run time checking a start tag for duplicate attribute namesRUSTSEC-2026-0195— quick-xml: unbounded namespace-declaration allocation inNsReader(memory-exhaustion DoS)This is why even pure-docs PRs (e.g. #238) show a failing Rust check.
Why ignore rather than upgrade
quick-xmlis not a direct dependency. It enters only transitively on Linux via:It cannot be bumped to the fixed >=0.41.0 without an upstream Tauri/wayland update. This matches the existing policy in
deny.toml, which already ignores the rest of the Tauri Linux transitive advisory tree.Change
Add both advisories to the
[advisories] ignorelist. Verified locally:cargo deny check advisories->advisories ok.🤖 Generated with Claude Code