From f93174332211971cffaf88d0476438c3aa421bb0 Mon Sep 17 00:00:00 2001 From: Noah Gift Date: Thu, 15 Oct 2026 02:40:06 +0200 Subject: [PATCH] =?UTF-8?q?deny:=20RUSTSEC-2024-0449=20(unsafe-libyaml=20v?= =?UTF-8?q?ia=20serde=5Fyaml=200.9)=20turned=20ci=20/=20gate=20red=20on=20?= =?UTF-8?q?an=20unchanged=20main=20=E2=80=94=20a=20dated,=20ledgered=20exe?= =?UTF-8?q?mption=20(Refs=20#2172)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The advisory-db moved under the tree: main's gate was green on 2026-10-10 and `cargo deny check advisories` FAILED from PR #2171's run on 2026-10-13 (run 38477290210) and on origin/main locally on 2026-10-15. Reach (cargo tree -i, all features): serde_yaml 0.9.34+deprecated, depended on by xpile, xpile-contracts, xpile-forjar-codegen and the third-party aprender-contracts 0.33.0. Dropping the in-tree uses alone leaves it reachable. The exemption goes through the PMAT-2120 ledger: owner noah, owner_ticket PMAT-2172, removed_by 2026-11-30 (46 days, inside max_window_days 90). Measured live: exit 0 with the ignore, exit 1 with only this id removed. PMAT-2172 Co-Authored-By: Claude Opus 5.5 --- deny.toml | 1 + docs/audits/advisory-ignores.yaml | 20 +++++++++++++++++++- docs/roadmaps/roadmap.yaml | 19 +++++++++++++++++++ 3 files changed, 39 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index 58224b1e8..6f8124256 100644 --- a/deny.toml +++ b/deny.toml @@ -28,6 +28,7 @@ ignore = [ "RUSTSEC-2025-0090", # unic-emoji-char "RUSTSEC-2025-0098", # unic-ucd-version "RUSTSEC-2025-0100", # unic-ucd-ident + "RUSTSEC-2024-0449", # unsafe-libyaml (via serde_yaml 0.9; PMAT-2172, removed_by 2026-11-30) ] [licenses] diff --git a/docs/audits/advisory-ignores.yaml b/docs/audits/advisory-ignores.yaml index 3285684b0..8b0985fd4 100644 --- a/docs/audits/advisory-ignores.yaml +++ b/docs/audits/advisory-ignores.yaml @@ -28,13 +28,17 @@ # unowned obligation that expires into a red nobody consumes. The review date IS # `removed_by`; there is no second date field. # -# All seven arrive via rustpython-parser (depyler-frontend's Python parser) and +# Seven arrive via rustpython-parser (depyler-frontend's Python parser) and # are unmaintained-ecosystem advisories rather than vulnerabilities. Five of # them previously read only "# unmaintained ecosystem dep" and named no crate # (0075, 0080, 0090, 0098, 0100 — a first draft of this file said three, and a # review lane counted); # an exemption nobody can identify is one nobody can retire, so the names below # were recovered from cargo-deny's own output. +# +# The eighth, RUSTSEC-2024-0449 (unsafe-libyaml, PMAT-2172), arrives via +# serde_yaml 0.9, not rustpython-parser. It was not added to a changed tree: the +# advisory-db moved under an unchanged main and turned `ci / gate` red. max_window_days: 90 ignores: @@ -104,3 +108,17 @@ ignores: removed_by: '2026-10-20' reason: unic-ucd-ident, via rustpython-parser. Crate name recovered from cargo-deny output. MEASURED live 2026-09-20 by the removal test. +- id: RUSTSEC-2024-0449 + crate: unsafe-libyaml + class: unmaintained + source: deny + owner: noah + owner_ticket: PMAT-2172 + removed_by: '2026-11-30' + reason: 'unsafe-libyaml 0.2.11, reached via serde_yaml 0.9.34+deprecated, which xpile, xpile-contracts, + xpile-forjar-codegen and the third-party aprender-contracts 0.33.0 all depend on. Unmaintained + upstream, not a vulnerability. The advisory-db changed under an unchanged tree: main''s gate was + green on 2026-10-10 and red from PR #2171''s run on 2026-10-13. MEASURED live 2026-10-15: + removing this ignore alone takes `cargo deny check advisories` from exit 0 to exit 1. Removal + needs both halves: the in-tree crates off serde_yaml AND an aprender-contracts release without + it; dropping only the in-tree uses leaves the advisory reachable.' diff --git a/docs/roadmaps/roadmap.yaml b/docs/roadmaps/roadmap.yaml index cf7b947fc..bd9448f4e 100644 --- a/docs/roadmaps/roadmap.yaml +++ b/docs/roadmaps/roadmap.yaml @@ -27381,3 +27381,22 @@ SCOPE, honestly. The published crate is unaffected — one tree, one target dir, labels: - kind:code notes: 'Epic #2125 (v0.1.620), row 5. Pilot: C-PY-INT-ARITH (Sem 42 -> 3) and C-BASHRS-POSIX-IDEMPOTENCE (18 -> 1); statuses unchanged, 26 QUORUM / 9 PARTIAL.' +- id: PMAT-2172 + github_issue: 2172 + item_type: task + title: 'PMAT-2172: RUSTSEC-2024-0449 (unsafe-libyaml via serde_yaml 0.9) turned ci / gate red on main — a dated, ledgered exemption under the PMAT-2120 expiry gate' + status: inprogress + priority: critical + assigned_to: null + created: 2026-10-15T00:39:16Z + updated: 2026-10-15T00:39:16Z + spec: null + acceptance_criteria: + - 'deny.toml ignores RUSTSEC-2024-0449 and docs/audits/advisory-ignores.yaml carries its entry (crate unsafe-libyaml, owner, owner_ticket PMAT-2172, removed_by inside max_window_days); cargo deny check advisories exits 0 on the tree and exits 1 with that one ignore removed; advisory_expiry.rs passes with XPILE_REQUIRE_CARGO_DENY set.' + phases: [] + subtasks: [] + estimated_effort: null + labels: + - kind:code + notes: 'Removal (closes the exemption): move xpile, xpile-contracts and xpile-forjar-codegen off serde_yaml 0.9 and take an aprender-contracts release that does not depend on it. Issue #2172.' + epic: 2124