PECOS/osv-scanner.toml at dev · PECOS-packages/PECOS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# OSV-Scanner configuration for the PECOS workspace.
#
# Ignore list policy:
# - Only include entries we cannot fix from this repo (transitive, blocked on
#   an upstream release).
# - Each entry must record (a) the offending crate@version, (b) the chain that
#   pulls it in, and (c) the upstream that owns the fix.
# - Real CVEs on first-party deps are NEVER ignored here -- pin and fix them
#   in the manifest instead (see docs/requirements.txt for the idna pin).
# - Periodically review this list when bumping hugr/tket, fusion-blossom, or
#   mwpf and drop entries that the new upstream version eliminates.

[[IgnoredVulns]]
id = "RUSTSEC-2025-0057"
# fxhash@0.2.1 -- unmaintained.
# Chain: hugr-passes -> hugr -> tket -> pecos-hugr.
# Upstream owner: https://github.com/CQCL/hugr (awaiting rustc-hash/ahash swap).
reason = "Transitive via hugr/tket; unmaintained-crate warning, no exploit path in PECOS."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0436"
# paste@1.0.15 -- unmaintained proc-macro.
# Chain: hugr-passes/ascent and mwpf both pull it in.
# Upstream owners: https://github.com/CQCL/hugr and https://github.com/yuewuo/mwpf.
reason = "Transitive via hugr/tket and mwpf; unmaintained-crate warning, no runtime impact (proc-macro)."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0388"
# derivative@2.2.0 -- unmaintained proc-macro.
# Chain: fusion-blossom and mwpf both pull it in.
# Upstream owners: https://github.com/yuewuo/fusion-blossom and https://github.com/yuewuo/mwpf.
reason = "Transitive via fusion-blossom and mwpf; unmaintained-crate warning, no runtime impact (proc-macro)."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0384"
# instant@0.1.13 -- unmaintained; replaced by web-time.
# Chain: hugr-passes/ascent -> ... -> pecos-hugr.
# Upstream owner: https://github.com/CQCL/hugr (ascent is a transitive build-graph helper).
reason = "Transitive via hugr-passes/ascent; unmaintained-crate warning, no Wasm target."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0375"
# atty@0.2.14 -- unmaintained (clap 4.x dropped it).
# Chain: mwpf -> slp -> structopt 0.3 -> clap 2.34.
# Upstream owner: https://github.com/yuewuo/mwpf (awaiting clap 4 / pico-args migration in slp).
reason = "Transitive via mwpf -> slp (clap2-era CLI helper); CLI tty-detect path not exercised by PECOS."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0370"
# proc-macro-error@1.0.4 -- unmaintained; proc-macro-error2 is the maintained fork.
# Chain: mwpf -> slp -> structopt-derive (compile-time only).
# Upstream owner: https://github.com/yuewuo/mwpf.
reason = "Transitive via mwpf -> slp -> structopt-derive; compile-time proc-macro only, no runtime impact."

[[IgnoredVulns]]
id = "RUSTSEC-2021-0145"
# atty@0.2.14 -- potential unaligned read on Windows custom allocators.
# Chain: mwpf -> slp -> structopt 0.3 -> clap 2.34.
# Upstream owner: https://github.com/yuewuo/mwpf.
reason = "Transitive via mwpf -> slp -> clap2; PECOS does not invoke slp's CLI tty-detection at runtime."

[[IgnoredVulns]]
id = "RUSTSEC-2021-0139"
# ansi_term@0.12.1 -- unmaintained.
# Chain: mwpf -> slp -> structopt 0.3 -> clap 2.34.
# Upstream owner: https://github.com/yuewuo/mwpf.
reason = "Transitive via mwpf -> slp -> clap2; unmaintained-crate warning, terminal-color path unused."

[[IgnoredVulns]]
id = "RUSTSEC-2022-0104"
# structopt@0.3.26 -- maintenance mode.
# Chain: pecos-mwpf -> mwpf -> slp -> structopt 0.3.
# Upstream owner: https://github.com/yuewuo/mwpf.
reason = "Transitive via mwpf -> slp -> structopt; maintenance-mode warning for upstream CLI parser, no direct PECOS use."

[[IgnoredVulns]]
id = "PYSEC-2026-151"
# wasmtime (PyPI) 43.0.0 (uv.lock) / 38.0.0 (exp/zluppy/uv.lock) -- Wasmtime
# stack-overflow bug class; the advisory lists NO fixed release (last_affected
# 43.0.0, the latest).
# Chain: quantum-pecos -> guppylang -> guppylang-internals -> wasmtime.
# Upstream owner: https://github.com/bytecodealliance/wasmtime-py.
reason = "Transitive via guppylang; no fixed wasmtime-py release exists yet. PECOS only runs trusted, locally-generated Wasm through it. Re-check on guppylang bumps."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0075"
# unic-char-range@0.9.0 -- unmaintained (whole unic project dormant).
# Chain: guppy-zlup -> rustpython-parser 0.4 -> unic-*.
# Upstream owner: https://github.com/RustPython/Parser (itself archived; the
# long-term fix is guppy-zlup moving off rustpython-parser).
reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0080"
# unic-common@0.9.0 -- unmaintained. Same chain/owner as RUSTSEC-2025-0075.
reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0081"
# unic-char-property@0.9.0 -- unmaintained. Same chain/owner as RUSTSEC-2025-0075.
reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0090"
# unic-emoji-char@0.9.0 -- unmaintained. Same chain/owner as RUSTSEC-2025-0075.
reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0098"
# unic-ucd-version@0.9.0 -- unmaintained. Same chain/owner as RUSTSEC-2025-0075.
reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0100"
# unic-ucd-ident@0.9.0 -- unmaintained. Same chain/owner as RUSTSEC-2025-0075.
reason = "Transitive via rustpython-parser in the experimental zlup frontend; unmaintained-crate warning, parser-internal Unicode tables, no exploit path."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0196"
# cgmath@0.18.0 -- unmaintained; 0.18.0 is the latest release (no fix exists).
# Chains: cgmath -> hugr-core -> hugr -> tket -> pecos-hugr, and
#         cgmath -> tket (dev-dependency) -> pecos-hugr.
# Upstream owners: https://github.com/CQCL/hugr and https://github.com/CQCL/tket2
# (awaiting a maintained geometry dep).
reason = "Transitive via hugr-core and tket; unmaintained-crate warning, no exploit path in PECOS."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0197"
# cgmath@0.18.0 -- unsound Matrix{2,3,4}::swap_columns(a, a): identical indices
# create aliasing mutable refs passed to ptr::swap -> UB. No patched release.
# Chains: cgmath -> hugr-core -> hugr -> tket -> pecos-hugr, and
#         cgmath -> tket (dev-dependency) -> pecos-hugr.
# Upstream owners: https://github.com/CQCL/hugr and https://github.com/CQCL/tket2.
reason = "Transitive via hugr-core and tket; no swap_columns call exists in PECOS or in the pinned hugr-core 0.27.1/tket 0.19.0 sources, and no fixed cgmath release exists. Re-check on hugr/tket bumps."