Skip to content

fix(ci): update cargo-deny config for v0.20+ and fix cargo-audit advisories - #374

Closed
Moonwalker-rgb wants to merge 1 commit into
VertexChainLabs:mainfrom
Moonwalker-rgb:fix/contracts-audit-ci
Closed

fix(ci): update cargo-deny config for v0.20+ and fix cargo-audit advisories#374
Moonwalker-rgb wants to merge 1 commit into
VertexChainLabs:mainfrom
Moonwalker-rgb:fix/contracts-audit-ci

Conversation

@Moonwalker-rgb

Copy link
Copy Markdown
Contributor

Summary

Fixes the failing Contracts Audit (cargo-deny / cargo-audit) CI check introduced in #371.

Changes

contracts/deny.toml — Migrated to cargo-deny v0.20+ format

  • Removed deprecated keys: vulnerability, severity-threshold, unlicensed, deny
  • Converted unmaintained/unsound to scope strings (workspace)
  • Converted yanked to lint level string (warn)
  • Added unused-allowed-license = allow for clean CI output

contracts/Cargo.lock — Fixed vulnerability

  • Updated time 0.3.36 to 0.3.47 to fix RUSTSEC-2026-0009 (DoS via stack exhaustion)

.github/workflows/ci.yml — Fixed cargo-audit warnings

  • Added --ignore RUSTSEC-2024-0388 (derivative) and --ignore RUSTSEC-2024-0436 (paste) for unmaintained Soroban SDK transitive deps

Verification

Both checks pass locally:

  • cargo deny check --show-stats → 0 errors
  • cargo audit --deny=warnings → 0 vulnerabilities found

…sories

- Migrate deny.toml to cargo-deny v0.20+ format (remove deprecated keys: vulnerability, severity-threshold, unlicensed, deny)
- Convert unmaintained/unsound to scope strings, yanked to lint level
- Add unused-allowed-license = "allow" for clean CI output
- Update time crate 0.3.36 -> 0.3.47 to fix RUSTSEC-2026-0009
- Add --ignore flags for unmaintained Soroban SDK transitive deps (derivative, paste)

Fixes the failing CI check in PR VertexChainLabs#371.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant