From fd58e36127539aa70a39827c191e20aa017f2ab7 Mon Sep 17 00:00:00 2001 From: hellno Date: Thu, 2 Jul 2026 18:14:28 +0200 Subject: [PATCH 1/2] docs(deny): trim the quick-xml ignore comment to match house style MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The quick-xml ignore block landed in #171/#175 was ~12 comment lines with heavy ALL-CAPS emphasis and reason strings that duplicated the comment — inconsistent with the file's other ignore groups (hickory/gtk are 3-4 tight lines with concise one-line reasons). Tighten to the same style; no facts lost (trigger = a zbus_xml 5.x release on quick-xml 0.41, merged-but-unreleased upstream, no gpui bump, 6.0 caveat all retained). Comment-only; `cargo deny check advisories` stays green. --- deny.toml | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/deny.toml b/deny.toml index 9d94597..9797aa7 100644 --- a/deny.toml +++ b/deny.toml @@ -59,19 +59,15 @@ ignore = [ { id = "RUSTSEC-2024-0418", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, { id = "RUSTSEC-2024-0419", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, { id = "RUSTSEC-2024-0420", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, - # ── quick-xml 0.39.4 — two DoS advisories in the D-Bus introspection-XML parser. LINUX-ONLY and - # transitive: the only active consumer is gpui's Linux AT-SPI accessibility stack - # (gpui_linux → accesskit_unix → atspi → zbus-lockstep → zbus_xml → quick-xml); it does not - # compile into the shipped macOS binary (`cargo tree` on the mac host resolves 0 copies). - # Liveness (CPU / memory exhaustion), not a custody or confidentiality risk. No in-tree fix - # YET: the latest PUBLISHED `zbus_xml` (5.1.1) pins `quick-xml ^0.39`, so the fixed `>=0.41.0` - # is unselectable. The upgrade is already MERGED on z-galaxy/zbus main (commit c38bb96, - # 2026-06-29) but UNRELEASED. Real trigger is a new `zbus_xml` RELEASE — NOT a gpui bump: - # every consumer here accepts `zbus_xml ^5.0.2`, so once a 5.x carrying quick-xml 0.41 ships, - # `cargo update -p zbus_xml` cascades quick-xml → 0.41.0 and these two entries drop (no gpui - # bump). Caveat: a `zbus_xml` 6.0 instead would widen the fix to zbus-lockstep/atspi/accesskit. - { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic duplicate-attribute-name DoS; Linux-only, transitive via gpui AT-SPI (not in the macOS binary); liveness-only; drop when a zbus_xml 5.x release carries quick-xml 0.41 (fix merged on z-galaxy/zbus main, unreleased) → cargo update -p zbus_xml" }, - { id = "RUSTSEC-2026-0195", reason = "quick-xml unbounded namespace-declaration allocation memory-exhaustion DoS; Linux-only, transitive via gpui AT-SPI (not in the macOS binary); liveness-only; drop when a zbus_xml 5.x release carries quick-xml 0.41 (fix merged on z-galaxy/zbus main, unreleased) → cargo update -p zbus_xml" }, + # ── quick-xml 0.39.4 — two DoS advisories in the D-Bus introspection-XML parser. Linux-only and + # transitive: the only active consumer is gpui's Linux AT-SPI stack (gpui_linux → accesskit_unix + # → atspi → zbus-lockstep → zbus_xml → quick-xml); not compiled into the macOS binary. Liveness + # (CPU / memory exhaustion), not a custody risk. The fix (quick-xml 0.41) is merged on + # z-galaxy/zbus main (c38bb96) but unreleased — published zbus_xml 5.1.1 still pins `^0.39`. + # Drops when a new zbus_xml 5.x carries quick-xml 0.41 (consumers accept `^5.0.2`) via + # `cargo update -p zbus_xml`, no gpui bump; a zbus_xml 6.0 instead would widen the fix. + { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic duplicate-attribute-name DoS; Linux-only, transitive via gpui AT-SPI; liveness-only; drop when zbus_xml ships a 5.x on quick-xml 0.41" }, + { id = "RUSTSEC-2026-0195", reason = "quick-xml unbounded namespace-declaration allocation DoS; Linux-only, transitive via gpui AT-SPI; liveness-only; drop when zbus_xml ships a 5.x on quick-xml 0.41" }, ] [licenses] From 42116bd2290ffe135a949b990abc92f18f6c917e Mon Sep 17 00:00:00 2001 From: hellno Date: Thu, 2 Jul 2026 18:41:50 +0200 Subject: [PATCH 2/2] =?UTF-8?q?docs(deny):=20correct=20the=20quick-xml=20n?= =?UTF-8?q?ote=20=E2=80=94=20two=20sources,=20narrow=20don't=20drop?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A parallel investigation (+ the upstream nudge z-galaxy/zbus#1837) surfaced that these advisories fire on TWO sub-0.41 quick-xml copies, not one: - 0.39.4 — runtime, via the gpui Linux AT-SPI stack (fixed by a zbus_xml 5.x) - 0.30.0 — a *build* dep of xcb 1.7.0 (X11 protocol XML; trusted input, no runtime surface, and no released xcb uses quick-xml >=0.41) The advisories have no lower bound, so both match; cargo-deny just collapses the report to the 0.39.4 node. So the earlier "drop the two ignores once zbus_xml ships" was over-optimistic — after `cargo update -p zbus_xml` the xcb 0.30.0 build-dep still fires. Correct the note to NARROW (not delete) the entries to the xcb residual, and reference the upstream release nudge. --- deny.toml | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/deny.toml b/deny.toml index 9797aa7..1f9ddac 100644 --- a/deny.toml +++ b/deny.toml @@ -59,15 +59,17 @@ ignore = [ { id = "RUSTSEC-2024-0418", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, { id = "RUSTSEC-2024-0419", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, { id = "RUSTSEC-2024-0420", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, - # ── quick-xml 0.39.4 — two DoS advisories in the D-Bus introspection-XML parser. Linux-only and - # transitive: the only active consumer is gpui's Linux AT-SPI stack (gpui_linux → accesskit_unix - # → atspi → zbus-lockstep → zbus_xml → quick-xml); not compiled into the macOS binary. Liveness - # (CPU / memory exhaustion), not a custody risk. The fix (quick-xml 0.41) is merged on - # z-galaxy/zbus main (c38bb96) but unreleased — published zbus_xml 5.1.1 still pins `^0.39`. - # Drops when a new zbus_xml 5.x carries quick-xml 0.41 (consumers accept `^5.0.2`) via - # `cargo update -p zbus_xml`, no gpui bump; a zbus_xml 6.0 instead would widen the fix. - { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic duplicate-attribute-name DoS; Linux-only, transitive via gpui AT-SPI; liveness-only; drop when zbus_xml ships a 5.x on quick-xml 0.41" }, - { id = "RUSTSEC-2026-0195", reason = "quick-xml unbounded namespace-declaration allocation DoS; Linux-only, transitive via gpui AT-SPI; liveness-only; drop when zbus_xml ships a 5.x on quick-xml 0.41" }, + # ── quick-xml — two liveness-only DoS advisories (0194 quadratic dup-attr, 0195 unbounded + # namespace alloc), Linux-only. The advisories have no lower bound, so BOTH sub-0.41 copies in + # the tree match (cargo-deny collapses the report to one node): 0.39.4 (runtime, gpui Linux + # AT-SPI: gpui_linux → accesskit_unix → atspi → zbus_xml; not in the macOS binary) and 0.30.0 + # (build-dep of xcb 1.7.0 parsing its trusted X11 protocol XML; no runtime surface, and no + # released xcb uses quick-xml >=0.41). The 0.39.4 half clears when a new zbus_xml 5.x ships on + # quick-xml 0.41 (merged on z-galaxy/zbus main c38bb96, unreleased; release nudge is + # z-galaxy/zbus#1837): then `cargo update -p zbus_xml` (no gpui bump) and NARROW these two to + # xcb's 0.30.0 build-dep — do not delete them. + { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic dup-attribute-name DoS; Linux-only, liveness-only; two sources — zbus_xml 0.39.4 (gpui AT-SPI runtime; clears on a zbus_xml 5.x carrying quick-xml 0.41) + xcb 1.7.0's 0.30.0 build-dep (trusted X11 protocol XML, no upstream fix)" }, + { id = "RUSTSEC-2026-0195", reason = "quick-xml unbounded namespace-declaration allocation DoS; Linux-only, liveness-only; two sources — zbus_xml 0.39.4 (gpui AT-SPI runtime; clears on a zbus_xml 5.x carrying quick-xml 0.41) + xcb 1.7.0's 0.30.0 build-dep (trusted X11 protocol XML, no upstream fix)" }, ] [licenses]