deny: RUSTSEC-2024-0449 turned ci / gate red on an unchanged main — a dated, ledgered exemption (Refs #2172)

[noahgift]

Summary

ci / gate went red on an unchanged main: the advisory database gained RUSTSEC-2024-0449 (unsafe-libyaml, no fixed release), reached through serde_yaml 0.9.34 (xpile, xpile-contracts, xpile-forjar-codegen and third-party aprender-contracts 0.33.0). Removing the in-tree uses alone would not clear it.

• deny.toml ignores RUSTSEC-2024-0449 with a reason.
• docs/audits/advisory-ignores.yaml ledgers it under the existing PMAT-2120 expiry gate: owner noah, owner_ticket PMAT-2172, removed_by 2026-11-30.

Evidence

• cargo deny check advisories exits 0 with the ignore, 1 with only that id removed.
• advisory_expiry 15/15 with XPILE_REQUIRE_CARGO_DENY=1.
• Review: 3/3 PASS (claude-sonnet-5-5, claude-haiku-4-5, gemini-3.8-flash-high); planted control rejected 3/3; the ignore was judged a dated, ledgered exemption rather than a waiver, 3/3.

Merge order after this: #2167, then merge main into #2171.

Refs #2172

🤖 Generated with Claude Code

[noahgift]

APPROVE — seat 1, aprender-a7, head f931743

Read the full diff at this head; CI green on it.

• deny.toml: one id added, RUSTSEC-2024-0449, with crate and ticket named inline.
• docs/audits/advisory-ignores.yaml: entry has crate, class unmaintained, owner, owner_ticket PMAT-2172, removed_by 2026-11-30 (46 days, inside max_window_days: 90), so the existing expiry gate retires it.
• Reason states the reach (serde_yaml 0.9 via xpile, xpile-contracts, xpile-forjar-codegen, aprender-contracts 0.33.0) and the two-part removal condition; the cause is advisory-db drift under an unchanged tree, not a new dependency.
• Not a waiver: the gate still runs and still fails on any other advisory, and this id goes red again on its date.

Note (non-blocking): unlike the sibling ruchy change, there is no test bounding the ignore's reach (a new crate linking unsafe-libyaml is covered only by the date). Worth adding with the PMAT-2172 removal work.

[noahgift]

seat 2, aprender-clerk @f931743322 — APPROVE.

Not an author: f931743 is the only commit, written by infra-38-worker.

• deny.toml adds RUSTSEC-2024-0449 (unsafe-libyaml, class unmaintained, not a vulnerability) to the ignore list. Its ledger row in docs/audits/advisory-ignores.yaml names the crate, the class, owner noah, owner_ticket PMAT-2172 and removed_by 2026-11-30, which is 46 days out and inside max_window_days 90. The header comment now counts eight ignores instead of seven.
• The row is enforced: crates/xpile/tests/advisory_expiry.rs checks that deny.toml and the ledger agree and turns red when a date passes. It runs under cargo test --workspace (workspace-test), which is green on this head.
• Reach is stated honestly: xpile, xpile-contracts and xpile-forjar-codegen use serde_yaml 0.9 directly, so removal needs both the in-tree port and an upstream release, as the row says.
• The lock has no rustls or wasmtime, so the rustls 0.23.45 and wasmtime 48.0.5 audit reds seen on ruchy#261 do not apply here.
• The required checks gate and workspace-test are green @f931743322.
  Note: the quorum receipt (i38-q2171) is bound to the stacked head ebb825fd, which contains this commit. It is not bound to f931743 alone.