Skip to main content

max / makenotwork

Prune the paste ignore from deny.toml, and stop mirroring the one that cannot match Both entries warned `advisory-not-detected` on build 60, and the file's own convention says that is the signal to prune. Only one of them had left the graph, though, so they get different treatment. paste is gone: the dependency trim in 2a53c900 took the last path to it and it is no longer in Cargo.lock. Dropped from deny.toml and from .cargo/audit.toml. proc-macro-error2 2.0.1 is still in the graph, and removing its ignore from .cargo/audit.toml makes `cargo audit` report it again — measured, not assumed. It reads as not-detected only to cargo-deny, whose `[advisories] version = 2` does not report an informational unmaintained advisory for a transitive crate. So the ignore stays where it is load-bearing and comes out of the mirror, which is the one place the two files now diverge, with a note saying why.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-08-20 02:10 UTC
Signed with PGP, not checked
Commit: a28bbed72aafea1f83c4e553a1bcb3e5f24ee7c1
Parent: 88a951f
2 files changed, +9 insertions, -3 deletions
@@ -19,9 +19,16 @@
19 19 "RUSTSEC-2023-0071", # rsa Marvin timing side-channel, only via signature *verification* crates; we never decrypt with rsa.
20 20 "RUSTSEC-2025-0141", # bincode unmaintained, transitive tooling, no code change available.
21 21 "RUSTSEC-2020-0095", # difference unmaintained, via a dev/test dep.
22 - "RUSTSEC-2024-0436", # paste unmaintained, via proc-macro deps.
23 22 "RUSTSEC-2025-0134", # rustls-pemfile unmaintained, via AWS SDK TLS.
24 - "RUSTSEC-2026-0173", # proc-macro-error2 unmaintained, via a macro dep. Was in .cargo/audit.toml but never mirrored here.
23 + # RUSTSEC-2024-0436 (paste) was dropped 2026-08-19: the dependency trim in
24 + # 2a53c900 took the last path to it and `paste` is no longer in Cargo.lock.
25 + #
26 + # RUSTSEC-2026-0173 (proc-macro-error2) is deliberately NOT mirrored here,
27 + # which is the one place this file and `.cargo/audit.toml` diverge. The crate
28 + # IS still in the graph, so the ignore stays load-bearing over there; it is
29 + # `informational = "unmaintained"`, which `[advisories] version = 2` does not
30 + # report for a transitive crate, so mirroring it only bought a permanent
31 + # `advisory-not-detected` warning on every run.
25 32 # wasmtime "Stores can mix up type indices between engines" (3.8 low), via
26 33 # yara-x 1.19.0, which pins the 43 line while the fixes skip it. Not
27 34 # applicable: the bug needs two wasmtime Engines and production builds
@@ -23,7 +23,6 @@
23 23 # available to us). Tracked for when upstreams migrate off them.
24 24 "RUSTSEC-2025-0141", # bincode (unmaintained), via transitive tooling
25 25 "RUSTSEC-2020-0095", # difference (unmaintained), via a dev/test dep
26 - "RUSTSEC-2024-0436", # paste (unmaintained), via proc-macro deps
27 26 "RUSTSEC-2025-0134", # rustls-pemfile (unmaintained), via AWS SDK TLS
28 27 "RUSTSEC-2026-0173", # proc-macro-error2 (unmaintained), via a macro dep
29 28