Skip to content

chore(audit): ignore RUSTSEC-2026-0459 until OpenShell bumps libsqlite3-sys #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilanh merged 1 commit into from
Nov 9, 2026
Merged

chore(audit): ignore RUSTSEC-2026-0459 until OpenShell bumps libsqlite3-sys #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .cargo/audit.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# cargo-audit configuration (read by `cargo audit`, which the `audit` job in .github/workflows/ci.yml runs).
# Every ignore must name one advisory, say why it cannot be fixed here, and when to remove it.

[advisories]
ignore = [
# RUSTSEC-2026-0459: libsqlite3-sys 0.37.0 (C SQLite CVE-2026-119375), fixed in >= 0.39.0.
# https://rustsec.org/advisories/RUSTSEC-2026-0459 - tracked in https://github.com/ilanh/openshell-annotate/issues/76
# Transitive and not upgradable from this repo: OpenShell v0.1.7 openshell-crypto -> sqlx 0.9.0 -> sqlx-sqlite =0.9.0
# (exact pin) -> libsqlite3-sys 0.37.0. openshell-annotate does not use SQLite itself.
# Remove this entry once an OpenShell release bumps sqlx/libsqlite3-sys and we move the pin to it.
"RUSTSEC-2026-0459",
]
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ version section and adds the squash-merged PR titles since the previous tag. Ver

## [Unreleased]

- chore(audit): ignore RUSTSEC-2026-0459 (`libsqlite3-sys` 0.37.0, pinned by OpenShell v0.1.7 through `sqlx` 0.9.0) in `.cargo/audit.toml` until OpenShell upgrades it (#76)
- chore(deps): build against OpenShell v0.1.7 (`openshell-policy-schema`, `openshell-policy`); docs and generated policy headers now name v0.1.7
- fix(diff-logs): ignore OCSF Network Activity Refuse records (policy DNS `policy_dns_ineligible`) that have no port, so OCSF JSON and shorthand logs report the same denials

Expand Down
4 changes: 4 additions & 0 deletions docs/DEVELOPING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,10 @@ turns a normal PR red. A failed *scheduled* run opens (or comments on) a single
target, the upstream commit and a link to the log. The resolved upstream commit is in each run's job summary.
When a target breaks, fix it on a branch (or bump the pin when `latest-release` moves on).

`cargo audit` ignores are listed in `.cargo/audit.toml`, each with its advisory and the condition for removing it.
Today that is `RUSTSEC-2026-0459` (`libsqlite3-sys` pinned by OpenShell's `sqlx`, #76): whenever you bump the OpenShell
pin, run `cargo tree -i libsqlite3-sys --target all` and drop the ignore once it resolves to 0.39.0 or newer.

## 5. Try it on a tiny project

```
Expand Down
Loading