From 5fc76fe9c3cb94b67feb862b742aa84107f98327 Mon Sep 17 00:00:00 2001 From: hellno Date: Mon, 13 Jul 2026 10:47:17 +0200 Subject: [PATCH] =?UTF-8?q?chore(deny):=20#221=20=C2=B7=20ignore=20RUSTSEC?= =?UTF-8?q?-2026-0206=20(rustybuzz=20unmaintained,=20transitive=20via=20gp?= =?UTF-8?q?ui/usvg)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nightly advisory scan went red on RUSTSEC-2026-0206: rustybuzz is unmaintained (superseded by harfrust). It reaches us only through the pinned gpui stack (usvg/resvg SVG text shaping); usvg has no harfrust-based release yet, so there is no in-tree fix. Same shape and justification as the existing ttf-parser entry (RUSTSEC-2026-0192); re-evaluate on just bump-gpui. Local: cargo deny check advisories → advisories ok Closes #221 --- deny.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/deny.toml b/deny.toml index 1f9ddac..b08951c 100644 --- a/deny.toml +++ b/deny.toml @@ -49,6 +49,7 @@ ignore = [ { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained (superseded by rustls-pki-types); transitive via Helios + the Zed gpui fork" }, { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained; build-time proc-macro only, no runtime surface" }, { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained; transitive via gpui (fontdb->usvg) runtime font/SVG glyph parsing; no maintained drop-in in the pinned tree; re-evaluate on just bump-gpui" }, + { id = "RUSTSEC-2026-0206", reason = "rustybuzz unmaintained (superseded by harfrust); transitive via gpui (usvg/resvg) runtime SVG text shaping; usvg has no harfrust release yet, so no in-tree fix; re-evaluate on just bump-gpui (#221)" }, # ── gtk-rs GTK3 bindings — unmaintained (the gtk3-rs project is EOL, superseded by gtk4-rs). Pulled # ONLY by the optional `tray` feature (libappindicator → gtk3); not in the default build. The tray # ecosystem (tray-icon/libappindicator) has no GTK4 path yet, so this rides until that lands.