chore(ci): known-accepted list for 2 quick-xml CVEs pending upstream#207
Merged
Conversation
The cargo-audit CI gate is currently red on 2 quick-xml real vulnerabilities (RUSTSEC-2026-0194/0195). The fix exists upstream: - wayland-rs PR #938 (MarijnS95, merged 2026-07-08): wayland-scanner: Bump quick-xml dependency to 0.41 - NOT YET RELEASED to crates.io (next wayland-rs release will include it) - Master has the bump; subsequent unreleased work adds breaking enum changes so we can't patch to latest master This commit adds a small, documented "known-accepted" mechanism to scripts/cargo-audit-check.sh. Not a silent --ignore blanket — the IDs are: 1. Listed in the script header with the upstream tracking link 2. Echoed in every CI job output under a "WAITING FOR UPSTREAM" header with the rationale 3. Listed in the GitHub Step Summary 4. Tracked in issue #206 When upstream publishes, dependabot will offer the bump. To clear: remove the IDs from the KNOWN_ACCEPTED array, commit, push. The cargo-audit gate goes green naturally. Why this is different from the original #188 --ignore approach that was killed: - #188: 28 advisories hidden behind a single --ignore block, no documentation, no tracking issue - This: 2 advisories, listed with full rationale, tracked, single purpose, scoped to a known upstream-pending fix Refs: #206
EVWorth
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a small, documented "known-accepted" mechanism to
scripts/cargo-audit-check.shso the cargo-audit CI gate stops being permanently red on 2 quick-xml real CVEs that are blocked by upstream.Why
The 2 quick-xml advisories (RUSTSEC-2026-0194, RUSTSEC-2026-0195) come from
wayland-scanner 0.31.10constrainingquick-xml = "0.39". The fix is already committed upstream:quick-xmldependency to0.41"master, NOT YET on crates.io — waiting for next wayland-rs releaseWhen upstream publishes, dependabot will offer the bump; remove the 2 IDs from the
KNOWN_ACCEPTEDarray, commit, push. CI gate goes green naturally.Why this is different from the original
--ignoreapproach (#188, killed)The original 17 gtk-rs chain + glib unsound + unic-* advisories remain in the "warnings" bucket — visible in output, not blocking, not in KNOWN_ACCEPTED. Only the 2 quick-xml (which are REAL vulns, not warnings) are silenced, with full visibility into the why and when-to-clear.
Changes
KNOWN_ACCEPTEDarray at top of script with 2 quick-xml IDscargo auditinvocation now passes--ignorefor each ID in the listHow to clear (when upstream ships)
cargo update -p wayland-scanner(or dependabot does it)cargo auditfromsrc-tauri/: no more RUSTSEC-2026-0194/0195KNOWN_ACCEPTEDarray inscripts/cargo-audit-check.shCI
scripts/cargo-audit-check.shRelated
--ignoreblocks in ci: pin known cargo-audit advisories #188 (which was killed for the "fix not hide" reason)