From ae59de29501b2f72c021fed5d3b0864b8960d8e5 Mon Sep 17 00:00:00 2001
From: LuQQiu <luqiujob@gmail.com>
Date: Thu, 15 Oct 2026 12:30:28 -0700
Subject: [PATCH] ci: ignore rustls 0.23.45 advisories until 0.23.46 clears the
 release age policy (#4551)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The \`deny\` job fails on main and on every open PR (for example #4539)
because RustSec published four advisories against rustls 0.23.45:

- RUSTSEC-2026-0346: \`Debug\` impls for client session values expose
TLS secrets
- RUSTSEC-2026-0347: buffered application data sent to the outer server
after ECH rejection
- RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to
1 GiB before authentication
- RUSTSEC-2026-0349: unauthenticated ServerHello can downgrade later
connections to classical key exchange

All four are fixed in rustls 0.23.46, published 2026-10-14 09:54 UTC.
The 48-hour dependency age policy does not allow that upgrade until
2026-10-16 09:54 UTC, so this mirrors lance-format/lance#9985 and
ignores the four advisories with that reason. rustls reaches us only
through lance-io -> aws-config -> aws-smithy-http-client.

It also ignores RUSTSEC-2024-0449 (\`unsafe-libyaml\` unmaintained),
reached through lance-tokenizer -> lindera -> serde_yaml_ng. No
maintained upgrade exists, so this one stays until lindera moves off
serde_yaml_ng.

Follow-up once the window passes: drop the four rustls entries and run
\`cargo update -p rustls\`.

Validation: \`cargo deny --all-features check advisories bans licenses
sources\` (the CI invocation) passes locally with cargo-deny 0.20.2:
\`advisories ok, bans ok, licenses ok, sources ok\`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 deny.toml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/deny.toml b/deny.toml
index 20510adc2..d112095ec 100644
--- a/deny.toml
+++ b/deny.toml
@@ -78,6 +78,27 @@ ignore = [
     { id = "RUSTSEC-2026-0098", reason = "only affects rustls-webpki 0.101 from legacy aws-smithy/rustls 0.21 chain" },
     { id = "RUSTSEC-2026-0099", reason = "only affects rustls-webpki 0.101 from legacy aws-smithy/rustls 0.21 chain" },
 
+    # rustls 0.23.45: four advisories fixed in 0.23.46 (Debug impls leaking
+    # TLS secrets, ECH rejection buffering, Brotli certificate decompression
+    # allocation, ServerHello key-exchange downgrade). 0.23.46 was published
+    # 2026-10-14 and the dependency age policy requires releases to be 48
+    # hours old, so the upgrade cannot land yet. Remove these entries and run
+    # `cargo update -p rustls` once the window has passed. Mirrors lance #9985.
+    # https://rustsec.org/advisories/RUSTSEC-2026-0346
+    # https://rustsec.org/advisories/RUSTSEC-2026-0347
+    # https://rustsec.org/advisories/RUSTSEC-2026-0348
+    # https://rustsec.org/advisories/RUSTSEC-2026-0349
+    { id = "RUSTSEC-2026-0346", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" },
+    { id = "RUSTSEC-2026-0347", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" },
+    { id = "RUSTSEC-2026-0348", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" },
+    { id = "RUSTSEC-2026-0349", reason = "fixed in rustls 0.23.46; blocked on the 48-hour release age policy" },
+
+    # unsafe-libyaml: unmaintained. Transitive via lance-tokenizer → lindera
+    # → serde_yaml_ng. No maintained upgrade exists; clearing it requires
+    # lindera to move off serde_yaml_ng.
+    # https://rustsec.org/advisories/RUSTSEC-2024-0449
+    { id = "RUSTSEC-2024-0449", reason = "transitive via lindera (lance-tokenizer); no maintained upgrade available" },
+
     # rustls-webpki 0.101.7: reachable panic in CRL parsing. Same legacy
     # rustls 0.21 chain from aws-smithy-http-client as above. The 0.103 line
     # we actively use is upgraded to 0.103.13 which contains the fix.