docs(deny): correct the quick-xml ignore trigger (zbus_xml release, not bump-gpui) - #175
Merged
Merged
Conversation
…ot bump-gpui) The two RUSTSEC-2026-0194/-0195 ignore entries added in #171 said "re-evaluate on just bump-gpui". That trigger is wrong. The advisories clear when a new `zbus_xml` release carries quick-xml 0.41 — independent of gpui: - The fix is already merged on z-galaxy/zbus main (commit c38bb96, 2026-06-29, a Cargo.toml-only bump) but unreleased; latest published zbus_xml 5.1.1 still pins quick-xml ^0.39. - Every consumer in our tree accepts `zbus_xml ^5.0.2`, so once a 5.x carrying quick-xml 0.41 ships, `cargo update -p zbus_xml` cascades quick-xml -> 0.41.0 and these entries drop — no gpui bump, no accesskit/atspi/zed change. - Caveat noted: a zbus_xml 6.0 (rather than 5.x) would break the ^5.0.2 chain and widen the fix to zbus-lockstep/atspi/accesskit. Comment-only change to deny.toml; `cargo deny check advisories` stays green.
This was referenced Jul 2, 2026
hellno
added a commit
that referenced
this pull request
Jul 2, 2026
The quick-xml ignore block landed in #171/#175 was ~12 comment lines with heavy ALL-CAPS emphasis and reason strings that duplicated the comment — inconsistent with the file's other ignore groups (hickory/gtk are 3-4 tight lines with concise one-line reasons). Tighten to the same style; no facts lost (trigger = a zbus_xml 5.x release on quick-xml 0.41, merged-but-unreleased upstream, no gpui bump, 6.0 caveat all retained). Comment-only; `cargo deny check advisories` stays green.
hellno
added a commit
that referenced
this pull request
Jul 2, 2026
* docs(deny): trim the quick-xml ignore comment to match house style The quick-xml ignore block landed in #171/#175 was ~12 comment lines with heavy ALL-CAPS emphasis and reason strings that duplicated the comment — inconsistent with the file's other ignore groups (hickory/gtk are 3-4 tight lines with concise one-line reasons). Tighten to the same style; no facts lost (trigger = a zbus_xml 5.x release on quick-xml 0.41, merged-but-unreleased upstream, no gpui bump, 6.0 caveat all retained). Comment-only; `cargo deny check advisories` stays green. * docs(deny): correct the quick-xml note — two sources, narrow don't drop A parallel investigation (+ the upstream nudge z-galaxy/zbus#1837) surfaced that these advisories fire on TWO sub-0.41 quick-xml copies, not one: - 0.39.4 — runtime, via the gpui Linux AT-SPI stack (fixed by a zbus_xml 5.x) - 0.30.0 — a *build* dep of xcb 1.7.0 (X11 protocol XML; trusted input, no runtime surface, and no released xcb uses quick-xml >=0.41) The advisories have no lower bound, so both match; cargo-deny just collapses the report to the 0.39.4 node. So the earlier "drop the two ignores once zbus_xml ships" was over-optimistic — after `cargo update -p zbus_xml` the xcb 0.30.0 build-dep still fires. Correct the note to NARROW (not delete) the entries to the xcb residual, and reference the upstream release nudge.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #171. The
RUSTSEC-2026-0194/-0195(quick-xml 0.39.4) ignore entries said "re-evaluate onjust bump-gpui" — that trigger is wrong, and codex's independent root-cause validation confirmed it.Why the old trigger was wrong
The advisories don't clear on a gpui bump. They clear when
zbus_xmlpublishes a release carryingquick-xml 0.41— which is independent of gpui:z-galaxy/zbusmain (commitc38bb96, 2026-06-29, a Cargo.toml-only bump) but unreleased — latest publishedzbus_xml 5.1.1still pinsquick-xml ^0.39.zbus_xml ^5.0.2, so once a 5.x carrying quick-xml 0.41 ships,cargo update -p zbus_xmlcascadesquick-xml → 0.41.0and these entries drop — no gpui bump, no accesskit/atspi/zed change.zbus_xml6.0 (instead of 5.x) would break the^5.0.2chain and widen the fix to zbus-lockstep/atspi/accesskit.A separate finding from the same investigation (not in this PR):
just bump-gpuicurrently would not build — our directgpuitracks zedmainwhilegpui-component@a9a7341cpins an older zed rev, producing two gpui copies. So the old "re-evaluate on bump-gpui" note pointed at an action that's both wrong and currently broken.Change
Comment-only edit to
deny.toml(the ignore-entry note + the tworeasonstrings). No functional change.