From 317cbb33a607ba9ffc4c62228d48e3d4cbdc1355 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 01:21:21 +0000
Subject: [PATCH] chore: sync public mirror from internal

---
 .repository-projection.json | 6 +++---
 deny.toml                   | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.repository-projection.json b/.repository-projection.json
index 517b0262b..b87329acc 100644
--- a/.repository-projection.json
+++ b/.repository-projection.json
@@ -3,11 +3,11 @@
   "projection": "deixic-code",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "915d91afd3e2038786a2e1cf12dd920ce17a8316",
+  "sourceSha": "472723d5518ff0fe2388e859241df115f6388f82",
   "destinationRepository": "dx-corp/code",
-  "priorProjectedBase": "09d57e69e8649768da349fb38eb9c513df0e5d01",
+  "priorProjectedBase": "b3bfb1dc84e6c93c4798adc2736faadd4ee9b3b2",
   "definitionDigest": "cc5446d8982464d5504de96b74641fe6f74b8e430830d0cca507e19fab0041b8",
   "toolDigest": "de718162d050963e0c04ca9cbc0e38b1db545e838e587f949bcd9fd8aded6bcd",
-  "contentDigest": "eeeb25196b828d9c832f1193fd3974f52c00fd422ed308c137262393d8a9b7d4",
+  "contentDigest": "5e7f7a6047ed2f2dc9bb6226d26da886adebb7e23b19531c950454c84ef70086",
   "publicationEligible": true
 }
diff --git a/deny.toml b/deny.toml
index 171a5835b..3cb84f51a 100644
--- a/deny.toml
+++ b/deny.toml
@@ -31,6 +31,9 @@ ignore = [
     { id = "RUSTSEC-2024-0436", reason = "paste 1.0.15 unmaintained; proc-macro pulled in by ratatui (production, TUI rendering). No ratatui release has dropped it yet. expires: 2026-10-23" },
     { id = "RUSTSEC-2026-0192", reason = "ttf-parser 0.25.1 unmaintained; pulled in transitively via lopdf 0.42.0 (the fix version for RUSTSEC-2026-0187) via pdf-extract 0.12.0. No known vulnerability; re-check when lopdf/pdf-extract bump their ttf-parser dependency or adopt a maintained fork. expires: 2026-10-23" },
 
+    # --- Vulnerabilities without a fixed release ---
+    { id = "RUSTSEC-2023-0071", reason = "rsa 0.9.10 (Marvin timing side channel) pulled in by jsonwebtoken 10.4.0 via octocrab 0.54.2 (ambient-agent, production). No fixed rsa release exists; the same advisory is already ignored in products/computer, platform/cerebro and the root workspace cargo-audit step. expires: 2026-10-23" },
+
     # --- Unsound (no known exploitable vulnerability reported here) ---
     { id = "RUSTSEC-2026-0002", reason = "lru 0.12.5: IterMut violates Stacked Borrows (Miri/unsafe-code soundness issue), pulled in by ratatui (production). Not a memory-safety issue under normal (non-Miri) execution; tracked for the next ratatui bump that picks up a fixed lru. expires: 2026-10-23" },
     { id = "RUSTSEC-2026-0285", reason = "rustls <0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level after a key change in the same record (GHSA-2mjx-qc3c-rqvc, CVSS 5.3). Fixed in rustls 0.23.45, published 2026-09-14; that upgrade also resolves aws-lc-rs 1.18.1 and aws-lc-sys 0.45.0, all still inside the 14-day dependency-admission cool-off in security/rust-dependency-admission.toml. Bump the lockfile once they age past it. expires: 2026-09-30" },