deny: RUSTSEC-2024-0449 turned ci / gate red on an unchanged main — a dated, ledgered exemption (Refs #2172)

deny.toml

@@ -28,6 +28,7 @@ ignore = [
     "RUSTSEC-2025-0090",  # unic-emoji-char
     "RUSTSEC-2025-0098",  # unic-ucd-version
     "RUSTSEC-2025-0100",  # unic-ucd-ident
+    "RUSTSEC-2024-0449",  # unsafe-libyaml (via serde_yaml 0.9; PMAT-2172, removed_by 2026-11-30)
 ]
 
 [licenses]

docs/audits/advisory-ignores.yaml

@@ -28,13 +28,17 @@
 # unowned obligation that expires into a red nobody consumes. The review date IS
 # `removed_by`; there is no second date field.
 #
-# All seven arrive via rustpython-parser (depyler-frontend's Python parser) and
+# Seven arrive via rustpython-parser (depyler-frontend's Python parser) and
 # are unmaintained-ecosystem advisories rather than vulnerabilities. Five of
 # them previously read only "# unmaintained ecosystem dep" and named no crate
 # (0075, 0080, 0090, 0098, 0100 — a first draft of this file said three, and a
 # review lane counted);
 # an exemption nobody can identify is one nobody can retire, so the names below
 # were recovered from cargo-deny's own output.
+#
+# The eighth, RUSTSEC-2024-0449 (unsafe-libyaml, PMAT-2172), arrives via
+# serde_yaml 0.9, not rustpython-parser. It was not added to a changed tree: the
+# advisory-db moved under an unchanged main and turned `ci / gate` red.
 
 max_window_days: 90
 ignores:
@@ -104,3 +108,17 @@ ignores:
   removed_by: '2026-10-20'
   reason: unic-ucd-ident, via rustpython-parser. Crate name recovered from cargo-deny output.
     MEASURED live 2026-09-20 by the removal test.
+- id: RUSTSEC-2024-0449
+  crate: unsafe-libyaml
+  class: unmaintained
+  source: deny
+  owner: noah
+  owner_ticket: PMAT-2172
+  removed_by: '2026-11-30'
+  reason: 'unsafe-libyaml 0.2.11, reached via serde_yaml 0.9.34+deprecated, which xpile, xpile-contracts,
+    xpile-forjar-codegen and the third-party aprender-contracts 0.33.0 all depend on. Unmaintained
+    upstream, not a vulnerability. The advisory-db changed under an unchanged tree: main''s gate was
+    green on 2026-10-10 and red from PR #2171''s run on 2026-10-13. MEASURED live 2026-10-15:
+    removing this ignore alone takes `cargo deny check advisories` from exit 0 to exit 1. Removal
+    needs both halves: the in-tree crates off serde_yaml AND an aprender-contracts release without
+    it; dropping only the in-tree uses leaves the advisory reachable.'

docs/roadmaps/roadmap.yaml

@@ -27381,3 +27381,22 @@ SCOPE, honestly. The published crate is unaffected — one tree, one target dir,
   labels:
   - kind:code
   notes: 'Epic #2125 (v0.1.620), row 5. Pilot: C-PY-INT-ARITH (Sem 42 -> 3) and C-BASHRS-POSIX-IDEMPOTENCE (18 -> 1); statuses unchanged, 26 QUORUM / 9 PARTIAL.'
+- id: PMAT-2172
+  github_issue: 2172
+  item_type: task
+  title: 'PMAT-2172: RUSTSEC-2024-0449 (unsafe-libyaml via serde_yaml 0.9) turned ci / gate red on main — a dated, ledgered exemption under the PMAT-2120 expiry gate'
+  status: inprogress
+  priority: critical
+  assigned_to: null
+  created: 2026-10-15T00:39:16Z
+  updated: 2026-10-15T00:39:16Z
+  spec: null
+  acceptance_criteria:
+  - 'deny.toml ignores RUSTSEC-2024-0449 and docs/audits/advisory-ignores.yaml carries its entry (crate unsafe-libyaml, owner, owner_ticket PMAT-2172, removed_by inside max_window_days); cargo deny check advisories exits 0 on the tree and exits 1 with that one ignore removed; advisory_expiry.rs passes with XPILE_REQUIRE_CARGO_DENY set.'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: 'Removal (closes the exemption): move xpile, xpile-contracts and xpile-forjar-codegen off serde_yaml 0.9 and take an aprender-contracts release that does not depend on it. Issue #2172.'
+  epic: 2124