6e1041a1f6
All checks were successful
build-and-release / build (companies) (push) Successful in 5s
build-and-release / build (cron) (push) Successful in 5s
build-and-release / build (developers) (push) Successful in 6s
build-and-release / build (employees) (push) Successful in 6s
build-and-release / build (fitness-trainers) (push) Successful in 6s
build-and-release / build (gateway) (push) Successful in 7s
build-and-release / build (graphic-designers) (push) Successful in 8s
build-and-release / build (job-seekers) (push) Successful in 10s
build-and-release / build (customers) (push) Successful in 20s
build-and-release / build (catering-services) (push) Successful in 21s
build-and-release / build (makeup-artists) (push) Successful in 7s
build-and-release / build (jobs) (push) Successful in 6s
build-and-release / build (payments) (push) Successful in 7s
build-and-release / build (photographers) (push) Successful in 7s
build-and-release / build (ugc-content-creators) (push) Successful in 7s
build-and-release / build (tutors) (push) Successful in 8s
build-and-release / build (social-media-managers) (push) Successful in 11s
build-and-release / build (users) (push) Successful in 5s
build-and-release / build (video-editors) (push) Successful in 6s
cargo audit flagged RUSTSEC-2026-0235 (rkyv, out-of-bounds read) via rust_decimal's optional rkyv feature, which apps/payments never enables (features = ["db-tokio-postgres"] only) - confirmed absent from the actual feature-resolved graph via cargo tree, and cargo-deny (which is feature-aware) already doesn't flag it. Added to both deny.toml and .cargo/audit.toml so cargo audit also exits 0. Also re-documented the 4 pre-existing crate-name-collision ignores in .cargo/audit.toml (RUSTSEC-2020-0128/2021-0006/2023-0040/2023-0059 - our own workspace crates crates/cache and apps/users happen to share name+version with unrelated abandoned crates.io packages) with fuller explanation, and mirrored them into deny.toml for a single source of truth even though cargo-deny's real graph resolution never matched them in the first place. Verified: cargo audit and cargo deny check advisories bans both now exit 0 against the live server runbook's requirement. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
2.8 KiB
TOML
44 lines
2.8 KiB
TOML
# cargo-audit configuration for nxtgauge-backend-rust
|
|
# https://github.com/rustsec/rustsec/tree/main/cargo-audit#configuration
|
|
#
|
|
# Keep this in sync with the [advisories].ignore list in deny.toml — cargo-deny
|
|
# is the gate that actually runs in CI/policy checks, but the live-server
|
|
# runbook also runs `cargo audit` directly, so both need to agree on
|
|
# accepted risk to both exit 0.
|
|
|
|
[advisories]
|
|
ignore = [
|
|
# RUSTSEC-2023-0071 - rsa: Marvin Attack timing side-channel — no upstream fix available.
|
|
# Impact: potential RSA key recovery via timing. Low risk: we use RSA only for JWT
|
|
# verification (public-key ops), not for decryption. Acknowledged (see deny.toml).
|
|
"RUSTSEC-2023-0071",
|
|
# RUSTSEC-2025-0141 - bincode: unmaintained (not a vulnerability, just no active maintainer).
|
|
# bincode is used transitively; no replacement available in our dep tree.
|
|
"RUSTSEC-2025-0141",
|
|
# RUSTSEC-2026-0235 - rkyv: out-of-bounds read validating Rc/Arc in archives.
|
|
# Pulled in only as an optional dependency of rust_decimal (apps/payments); we use
|
|
# rust_decimal with `features = ["db-tokio-postgres"]` only — the "rkyv" feature is
|
|
# never enabled, so this crate is never actually compiled into our binaries.
|
|
# Confirmed via `cargo tree -p payments -e features | grep rkyv` (empty). Cargo.lock
|
|
# still lists it because lock files record the full possible graph, not just the
|
|
# feature-activated one — that's also why cargo-deny (which resolves features) never
|
|
# flags it while cargo-audit (which scans the lockfile as-is) does. Re-check this
|
|
# exemption if rust_decimal's default features ever change.
|
|
"RUSTSEC-2026-0235",
|
|
|
|
# ── False positives: crate-name collisions with our own workspace crates ──────
|
|
# cargo-audit matches by (name, version) against Cargo.lock and does not check
|
|
# whether the entry is a local path dependency vs a crates.io registry crate.
|
|
# Our internal workspace crates crates/cache ("cache" 0.1.0) and apps/users
|
|
# ("users" 0.1.0) happen to share both name and version with unrelated,
|
|
# long-abandoned crates.io packages that these advisories target. cargo-deny
|
|
# (which resolves the real dependency graph, not just name+version matching)
|
|
# correctly does not flag any of these — confirmed via
|
|
# `cargo deny check advisories` showing none of these IDs. Verify via
|
|
# `grep -A3 '^name = "cache"$' Cargo.lock` (no `source = "registry+..."` line)
|
|
# before ever removing these.
|
|
"RUSTSEC-2020-0128", # "cache" — Cache<K> Send/Sync soundness (unrelated crates.io crate)
|
|
"RUSTSEC-2021-0006", # "cache" — exposes internal raw pointer (unrelated crates.io crate)
|
|
"RUSTSEC-2023-0040", # "users" — unmaintained (unrelated crates.io crate)
|
|
"RUSTSEC-2023-0059", # "users" — unaligned pointer read (unrelated crates.io crate)
|
|
]
|