Add Cargo dependency audit gates

.cargo/audit.toml

@@ -0,0 +1,21 @@
+[advisories]
+ignore = [
+    # Unmaintained transitive dependencies with no patched version.
+    "RUSTSEC-2020-0095", # difference via the release-only apple-codesign crate
+    "RUSTSEC-2024-0436", # paste via Iced's wgpu Metal backend
+    "RUSTSEC-2025-0134", # rustls-pemfile via apple-codesign's unused remote-signing stack
+    "RUSTSEC-2026-0192", # ttf-parser via Iced's text and SVG renderers
+    "RUSTSEC-2026-0206", # rustybuzz via Iced's SVG renderer
+
+    # No compatible upgrade exists; Cryoglyph does not call the affected LruCache::pop API.
+    "RUSTSEC-2026-0253",
+
+    # No patch exists; the release packager only creates ad-hoc signatures without RSA keys.
+    "RUSTSEC-2023-0071",
+]
+
+[output]
+deny = ["warnings"]
+format = "terminal"
+quiet = false
+show_tree = true

.gitea/workflows/dependency-audit.yml

@@ -15,6 +15,16 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit@0.22.2
+
+      - name: Audit Rust dependencies
+        run: |
+          cargo audit
+          cargo audit --file tools/macos-packager/Cargo.lock
+
       - name: Scan dependencies for known vulnerabilities
         uses: docker://ghcr.io/google/osv-scanner:v2
         with:

.gitea/workflows/release.yml

@@ -19,6 +19,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit@0.22.2
+
+      - name: Audit Rust dependencies
+        run: |
+          cargo audit
+          cargo audit --file tools/macos-packager/Cargo.lock
+
       - name: Test release-note generation
         run: python3 .gitea/scripts/release.py test
 

Cargo.lock

@@ -266,9 +266,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",

osv-scanner.toml

@@ -9,3 +9,19 @@ reason = "INFO Unmaintained with no patched version; transitive through Iced 0.1
 [[IgnoredVulns]]
 id = "RUSTSEC-2026-0192"
 reason = "INFO Unmaintained with no patched version; transitive through Iced 0.14's text and SVG renderers."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0253"
+reason = "No compatible Iced 0.14 upgrade; Cryoglyph does not call the affected LruCache::pop API."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2023-0071"
+reason = "No patched rsa release; the release packager only creates ad-hoc signatures without RSA keys."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2020-0095"
+reason = "INFO Unmaintained with no patched version; release-only transitive dependency through apple-codesign."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2025-0134"
+reason = "INFO Unmaintained with no patched version; transitive through apple-codesign's unused remote-signing stack."