chore(deny): #221 · ignore RUSTSEC-2026-0206 — rustybuzz unmaintained, transitive via gpui/usvg#222
Merged
Merged
Conversation
… transitive via gpui/usvg) The nightly advisory scan went red on RUSTSEC-2026-0206: rustybuzz is unmaintained (superseded by harfrust). It reaches us only through the pinned gpui stack (usvg/resvg SVG text shaping); usvg has no harfrust-based release yet, so there is no in-tree fix. Same shape and justification as the existing ttf-parser entry (RUSTSEC-2026-0192); re-evaluate on just bump-gpui. Local: cargo deny check advisories → advisories ok Closes #221
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The nightly
cargo deny check advisoriesscan went red on RUSTSEC-2026-0206:rustybuzz0.20.1 is unmaintained (maintainer announcement: harfbuzz/rustybuzz#166; successor isharfrust). cargo-deny reports no safe upgrade available.Failing run: https://github.com/hellno/deckard/actions/runs/29186655113
Why an ignore, not a bump
The only path to
rustybuzzis the pinned Zed gpui stack:usvghas no harfrust-based release yet, so there is no in-tree fix; the gpui git pins are only moved viajust bump-gpui(repo rule — never hand-edited). This is exactly the shape of the existingttf-parserentry (RUSTSEC-2026-0192, also gpui→usvg): unmaintained-crate advisory, runtime font/SVG text path, no maintained drop-in in the pinned tree. The new entry sits next to it with the same re-evaluate-on-bump-gpuimarker.Unmaintained ≠ vulnerable: this is a maintenance-status advisory, not a CVE. Risk surface is SVG text shaping inside the UI toolkit, unchanged from yesterday.
Evidence
Diff is
deny.tomlonly — no code, noCargo.toml/Cargo.lockchanges.Closes #221