mirror of
https://github.com/l0ng-ai/openidea.git
synced 2026-11-06 08:07:49 +00:00
l0ng-ai
7da58637c2
cargo deny check now passes, with a deny.toml at the repository root (advisories, licenses, bans, sources). - zip 2.4.2 → 9 as one workspace dependency (RUSTSEC-2026-0367/0368/0369). Our own extraction is hardened too: tar/zip entries cannot escape the destination, symlinks are allowed only when they resolve inside it, entries cannot traverse a symlink, and setuid/setgid/sticky bits are dropped (also after system tar). - tiberius 0.12 → 0.13 with rustls 0.23, which brings the fixed rustls / rustls-webpki (RUSTSEC-2026-0098/0099/0104/0346/0349/0382/0383). The bb8-tiberius adapter is replaced by a small bb8 connection manager in ide-db that keeps its single-redirect handling. - crypto-bigint / ctutils updated (RUSTSEC-2026-0385/0387). - rsa RUSTSEC-2023-0071 (no fixed release) is ignored with its reason: RSA is used only for MySQL password encryption and SSH signatures, never to decrypt attacker-controlled ciphertext. - Unmaintained transitive crates (paste, proc-macro-error, rustls-pemfile, zbus/zvariant) remain warnings. MPL-2.0 is allowed (file-level copyleft, dependencies used unmodified). 未在真实 SQL Server 及 Windows / Linux 上验证解压。
27 lines
842 B
TOML
27 lines
842 B
TOML
[advisories]
|
|
version = 2
|
|
unmaintained = "workspace"
|
|
yanked = "warn"
|
|
ignore = [
|
|
# SQLx MySQL uses RSA public-key encryption; russh/ssh-key use signatures.
|
|
# No RSA private-key decryption is exposed to attacker-controlled ciphertext.
|
|
{ id = "RUSTSEC-2023-0071", reason = "RSA is used for MySQL password encryption and SSH signatures, not RSA decryption" },
|
|
]
|
|
|
|
[licenses]
|
|
allow = [
|
|
"MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause",
|
|
"BSD-3-Clause", "ISC", "Zlib", "0BSD", "CC0-1.0", "Unlicense",
|
|
# File-level copyleft, used unmodified as dependencies.
|
|
"MPL-2.0",
|
|
"Unicode-3.0", "Unicode-DFS-2016", "CDLA-Permissive-2.0", "OpenSSL",
|
|
]
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|