chore(deps): ignore unsafe-libyaml unmaintained advisory

[tessneau]

Summary

Cargo deny fails because serde_yaml and VRL's serde_yaml_ng pull in the now-flagged, unmaintained unsafe-libyaml crate. Add a scoped exception with no dependency or YAML parsing changes. There is no patched release, and the serde_yaml_ng backend migration is still pending upstream.

Vector needs its own exception because VRL's deny configuration does not carry over.

References

• RUSTSEC-2024-0449
• Upstream serde_yaml_ng migration
• Related: chore(deps): ignore unsafe-libyaml unmaintained advisory vrl#1991

Vector configuration

N/A

How did you test this PR?

N/A

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

Contributor Guidelines

• Please read our Vector contributor resources.
• Do not hesitate to use @vectordotdev/vector to reach out to us regarding this PR.
• Before pushing, follow our pre-push guidance.
• After a review is requested, please avoid force pushes to help us review incrementally.
  • Feel free to push as many commits as you want. They will be squashed into one before merging.
  • For example, you can run git merge origin master and git push.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T13:26:50.473286Z	67c4131	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadoghq-integration]

More details

The exception targets the intended unsafe-libyaml advisory, and Cargo.lock confirms both YAML dependencies use that crate. The configuration parses successfully; cargo-deny itself was unavailable.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 67c4131}