浏览代码

v3.0: Ignore security advisory from tracing-subscriber dep (#7846)

The only users of this dependency are crates that support test harnesses
such as solana-program-test; this is not used in production code
steviez 2 月之前
父节点
当前提交
ddca2f97a9
共有 1 个文件被更改,包括 10 次插入0 次删除
  1. 10 0
      ci/do-audit.sh

+ 10 - 0
ci/do-audit.sh

@@ -59,6 +59,16 @@ cargo_audit_ignores=(
   # URL:       https://rustsec.org/advisories/RUSTSEC-2024-0376
   # URL:       https://rustsec.org/advisories/RUSTSEC-2024-0376
   # Solution:  Upgrade to >=0.12.3
   # Solution:  Upgrade to >=0.12.3
   --ignore RUSTSEC-2024-0376
   --ignore RUSTSEC-2024-0376
+
+  # === solana-banks-client / solana-banks-interface / solana-banks-server ===
+  # Crate:     tracing-subscriber
+  # Version:   0.3.7
+  # Title:     Logging user input may result in poisoning logs with ANSI escape sequences
+  # Date:      2025-08-29
+  # ID:        RUSTSEC-2025-0055
+  # URL:       https://rustsec.org/advisories/RUSTSEC-2025-0055
+  # Solution:  Upgrade to >=0.3.20
+  --ignore RUSTSEC-2025-0055
 )
 )
 scripts/cargo-for-all-lock-files.sh audit "${cargo_audit_ignores[@]}" | $dep_tree_filter
 scripts/cargo-for-all-lock-files.sh audit "${cargo_audit_ignores[@]}" | $dep_tree_filter
 # we want the `cargo audit` exit code, not `$dep_tree_filter`'s
 # we want the `cargo audit` exit code, not `$dep_tree_filter`'s