Repository navigation
ci: fail when a deny.toml advisory ignore outlives its reason - #10194
Merged
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
github-actions
Bot
added
A-deps
![lance-gatekeeper[bot]](https://avatars.githubusercontent.com/in/4433141?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
lance-gatekeeper
Bot
added
the
K-approved
lance-format#9985 ignored four rustls advisories until the fix was 48 hours old, as ci/check_dependency_age.py requires. Nothing brought us back once the fix was old enough, and rustls stayed on the vulnerable 0.23.45 for a week, until lance-format#10193. Every advisory ignore's reason now starts with `expires YYYY-MM-DD:` or `no fix:`. ci/check_advisory_ignores.py runs in the cargo-deny job and fails on a reason without a marker, a malformed date, or an expires day (UTC) that has passed. deny.toml also sets unused-ignored-advisory = "deny", so cargo-deny fails on an ignore that no longer matches a crate. The existing reasons are rewritten from the advisories and Cargo.lock. The quick-xml one was stale: object_store and opendal are on 0.41 now, and what remains is lance-namespace-impls asking for 0.40 and pprof's inferno pulling in 0.26. The RUSTSEC-2026-0381 and 0382 ignores match nothing now, so they are removed: lance-format#10215 moved rustls-webpki to the fixed 0.103.16, and the advisory lists webpki-roots 0.26.11, which only re-exports 1.x, as unaffected. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
hf-hub 0.4 and tokenizers 0.15 pull in indicatif 0.17, which depends on the unmaintained number_prefix (RUSTSEC-2025-0119). hf-hub 0.4 also pulls in ureq 2, which gets its roots through the webpki-roots 0.26 shim. hf-hub 0.5.0 and tokenizers 0.22.2 are the smallest releases on indicatif 0.18, and hf-hub 0.5 moves to ureq 3, which depends on webpki-roots 1.x directly. Nothing matches the number_prefix ignore now, so it is removed. hf-hub's default features turn on native-tls for ureq and reqwest. The example only uses the sync API, so hf-hub now gets just its ureq feature. That drops native-tls and openssl from Cargo.lock. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The wikitext parquet files the example downloads are snappy compressed, and the workspace builds parquet without codecs, so the example failed reading them with "Disabled feature at compile time: snap". The examples now enable parquet's snap feature. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
lance-format#10215 allowlisted rustls-webpki 0.103.16 and webpki-roots and webpki-root-certs 1.0.10 so the eMudhra fixes could land before they were 48 hours old. All three are past 48 hours now, rustls-webpki, the youngest, since 2026-10-22 08:58 UTC, and each entry said to remove it after that time. ci/check_dependency_age.py passes on all three lockfiles without them. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
twmb
force-pushed
the
twmb/advisory-ignore-guard
branch
3 times, most recently
from
October 22, 2026 19:13
9f2bb4d to
185bcc2
Compare
lance-gatekeeper
Bot
removed
the
K-approved
lance-gatekeeper
Bot
added
the
K-approved
westonpace
approved these changes
Oct 22, 2026
westonpace
left a comment
westonpace
left a comment
Member
There was a problem hiding this comment.
Seems like a good idea. Just one suggestion.
The commented examples at the top of the advisory ignore list still showed a bare id and free-form reasons, which ci/check_advisory_ignores.py now rejects. They now show an expires entry, a no fix entry and a yanked crate entry in the form the check accepts, so the list stays a usable template once the current expiring ignores are gone. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
lance-gatekeeper
Bot
removed
the
K-approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#9985 ignored four rustls advisories until the fix was 48 hours old. Nothing brought us back once the fix was old enough, and rustls stayed on the vulnerable 0.23.45 for a week, until #10193. This makes CI fail when an advisory ignore outlives its reason.
[advisories] ignorereason indeny.tomlmust start withexpires YYYY-MM-DD:(an ignore we expect to drop, about a week out for a fix waiting on the 48 hour rule) orno fix:(nothing to upgrade to).ci/check_advisory_ignores.pyruns in the cargo-deny job. It fails on a missing marker, a malformed date, or anexpiresdate (UTC) that has passed, and says to upgrade and remove the ignore or move the date with a reason.unused-ignored-advisory = "deny"makes cargo-deny fail on an ignore that no longer matches any crate.Cargo.lock. The quick-xml one was stale: object_store and opendal now use 0.41, and the remaining copies come from lance-namespace-impls (0.40) and pprof's inferno (0.26).ci/dependency-age-allowlist.tomlentries are removed too.ureqfeature, which also drops native-tls and openssl fromCargo.lock.snapfeature, becausellm_dataset_creationfailed reading the snappy-compressed wikitext files with "Disabled feature at compile time: snap".