fix(deps): clear the Rust advisory audit (RUSTSEC-2026-0381/0382)

scripts/audit-rust.mjs

@@ -6,6 +6,17 @@ import { fileURLToPath } from 'node:url'
 
 const advisoryDatabaseUrl = 'https://github.com/RustSec/advisory-db.git'
 
+// Informational "unmaintained" notices only, never a vulnerability. Each entry
+// names the dependency that pulls it in, so it can be dropped once that moves.
+export const acceptedUnmaintainedAdvisories = [
+  // zvariant, zbus_names and zvariant_derive were folded into zbus 6. They reach
+  // us only through ashpd 0.13 (Linux screencast portal), which still depends on
+  // zbus 5. Remove these once an ashpd release on zbus 6 is adopted.
+  { id: 'RUSTSEC-2026-0370', crate: 'zvariant', via: 'ashpd 0.13 -> zbus 5' },
+  { id: 'RUSTSEC-2026-0371', crate: 'zbus_names', via: 'ashpd 0.13 -> zbus 5' },
+  { id: 'RUSTSEC-2026-0372', crate: 'zvariant_derive', via: 'ashpd 0.13 -> zbus 5' }
+]
+
 export function rustAuditCommands({ databasePath, databaseExists }) {
   const refresh = databaseExists
     ? ['git', ['-C', databasePath, 'pull', '--ff-only', '--quiet']]
@@ -15,7 +26,18 @@ export function rustAuditCommands({ databasePath, databaseExists }) {
   return [
     refresh,
     ['cargo', ['fetch', '--locked']],
-    ['cargo', ['audit', '--db', databasePath, '--no-fetch', '--deny', 'warnings']]
+    [
+      'cargo',
+      [
+        'audit',
+        '--db',
+        databasePath,
+        '--no-fetch',
+        '--deny',
+        'warnings',
+        ...acceptedUnmaintainedAdvisories.flatMap(({ id }) => ['--ignore', id])
+      ]
+    ]
   ]
 }
 

scripts/lib/audit-rust.test.mjs

@@ -1,20 +1,41 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
 
-import { rustAuditCommands } from '../audit-rust.mjs'
+import { acceptedUnmaintainedAdvisories, rustAuditCommands } from '../audit-rust.mjs'
+
+const ignored = [
+  '--ignore',
+  'RUSTSEC-2026-0370',
+  '--ignore',
+  'RUSTSEC-2026-0371',
+  '--ignore',
+  'RUSTSEC-2026-0372'
+]
 
 test('Rust audit clones a fresh database through system Git before auditing offline', () => {
   assert.deepEqual(rustAuditCommands({ databasePath: '/cache/rustsec', databaseExists: false }), [
     ['git', ['clone', '--quiet', 'https://github.com/RustSec/advisory-db.git', '/cache/rustsec']],
     ['cargo', ['fetch', '--locked']],
-    ['cargo', ['audit', '--db', '/cache/rustsec', '--no-fetch', '--deny', 'warnings']]
+    ['cargo', ['audit', '--db', '/cache/rustsec', '--no-fetch', '--deny', 'warnings', ...ignored]]
   ])
 })
 
 test('Rust audit fast-forwards its cached database before auditing offline', () => {
   assert.deepEqual(rustAuditCommands({ databasePath: '/cache/rustsec', databaseExists: true }), [
     ['git', ['-C', '/cache/rustsec', 'pull', '--ff-only', '--quiet']],
     ['cargo', ['fetch', '--locked']],
-    ['cargo', ['audit', '--db', '/cache/rustsec', '--no-fetch', '--deny', 'warnings']]
+    ['cargo', ['audit', '--db', '/cache/rustsec', '--no-fetch', '--deny', 'warnings', ...ignored]]
   ])
 })
+
+test('Rust audit ignores only the named unmaintained notices, each with its source', () => {
+  for (const advisory of acceptedUnmaintainedAdvisories) {
+    assert.match(advisory.id, /^RUSTSEC-\d{4}-\d{4}$/)
+    assert.ok(advisory.crate, `${advisory.id} names its crate`)
+    assert.ok(advisory.via, `${advisory.id} names the dependency that pulls it in`)
+  }
+  assert.deepEqual(
+    acceptedUnmaintainedAdvisories.map(({ id }) => id),
+    ['RUSTSEC-2026-0370', 'RUSTSEC-2026-0371', 'RUSTSEC-2026-0372']
+  )
+})