From 823dd537451e705c3a26a2937ddcb8b32708ece8 Mon Sep 17 00:00:00 2001 From: dailz Date: Fri, 3 Jul 2026 11:23:48 +0800 Subject: [PATCH] chore(deps): address cargo audit findings Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- .cargo/audit.toml | 14 ++++++++++++++ Cargo.lock | 4 ++-- 2 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 .cargo/audit.toml diff --git a/.cargo/audit.toml b/.cargo/audit.toml new file mode 100644 index 0000000..801169c --- /dev/null +++ b/.cargo/audit.toml @@ -0,0 +1,14 @@ +# quick-xml is pulled in only through wayland-scanner's build-time Wayland XML +# code generation path: +# +# wayland-scanner v0.31.10 -> quick-xml v0.39.x +# +# The current wayland-scanner release requires quick-xml ^0.39, so it cannot +# accept the fixed quick-xml >=0.41.0 line yet. This project does not parse +# attacker-controlled XML at runtime through quick-xml. Remove these ignores as +# soon as wayland-scanner or the wayland-* crates release a compatible fix. +[advisories] +ignore = [ + "RUSTSEC-2026-0194", + "RUSTSEC-2026-0195", +] diff --git a/Cargo.lock b/Cargo.lock index 83adb4c..f8a94a1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -94,9 +94,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" [[package]] name = "arrayvec"