Ignore bare-metal advisory - #89
Merged
dymk merged 1 commit intoJul 31, 2026
Merged
Conversation
The RustSec advisory database now marks bare-metal 0.2.5 as unmaintained. It is pulled transitively through the existing host-test-only embedded-services and cortex-m dependency path, and no safe upgrade is available. Document the narrow exception so cargo-deny remains green. Assisted-by: GitHub Copilot:gpt-5.6-sol Copilot-Session: 6cb7060d-6d47-49ad-a710-428fe4c2f3dc
dymk
requested review from
RobertZ2011,
Copilot,
kat-perez,
tullom and
williampMSFT
July 31, 2026 19:30
kurtjd
approved these changes
Jul 31, 2026
Contributor
There was a problem hiding this comment.
🟢 Ready to approve
The change is a minimal, well-documented cargo-deny configuration update consistent with existing ignore entries and aligned with the stated validation steps.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
This PR updates the repository’s cargo-deny configuration to allow CI/pre-commit advisory checks to pass again after a RustSec database update newly flagged an existing transitive dependency (bare-metal 0.2.5) as unmaintained, with no safe upgrade path.
Changes:
- Add an explicit
advisories.ignoreexception forRUSTSEC-2026-0110with a documented rationale.
File summaries
| File | Description |
|---|---|
| deny.toml | Adds a narrowly described ignore entry for RUSTSEC-2026-0110 so cargo deny check advisories can run cleanly again. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
jerrysxie
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root cause
bare-metal 0.2.5was newly marked unmaintained after the last successful main run. It is an existing transitive host-test dependency through embedded-services/cortex-m, and the advisory has no safe upgrade.Validation
cargo deny check advisories