Repository navigation
[DEP-09] Unmaintained proc-macro-error 0.4.12 (RUSTSEC-2024-0370) — not in CI ignore list #317
Description
Audit finding from #300 (commit 679f9fe)
Severity: low
Category: dependencies / supply chain
File: Cargo.lock proc-macro-error 0.4.12 ; advisory RUSTSEC-2024-0370
Obvious fix: no (transitive, requires identifying parent)
Description
proc-macro-error 0.4.x (note: not 1.x) is unmaintained per RUSTSEC-2024-0370. Also drags in syn 1.x causing duplicate-syn issues. Not in the CI ignore list, so the next dependency-changing PR could break the audit gate.
Impact / Threat
CI gate may break unexpectedly; carrying an unmaintained proc-macro dep is a long-term risk.
Suggested fix
cargo tree -i proc-macro-error@0.4.12 to identify the dragging crate; bump that crate or replace with proc-macro-error2. If unfixable now, add --ignore RUSTSEC-2024-0370 with a tracking issue.
Verify
cargo-audit audit 2>&1 | grep -A3 RUSTSEC-2024-0370
Activity
intendednull commentedon Apr 27, 2026
Tracked. PR #402 add audit ignore for RUSTSEC-2024-0370. Issue stay open til iroh-blobs drop genawaiter or we bump iroh.
Generated by Claude Code
Merge pull request #402 from intendednull/claude/audit-ignores-rustse…
intendednull commentedon Apr 28, 2026
Already fixed. PR #402 added
--ignore RUSTSEC-2024-0370tocargo auditstep in.github/workflows/ci.yml(line 169), tagged# proc-macro-error unmaintained, via iroh-blobs->genawaiter (#317). Merged to main 2026-04-27. Parent:iroh-blobs -> bao-tree -> genawaiter -> genawaiter-proc-macro(transitive, no trivial bump). Closing — tracking lives in the inline ignore comment until upstream fixes land.Generated by Claude Code
chore(skill): pre-dispatch sync, already-fixed path, webhook informat…
ci: ignore RUSTSEC-2026-0119 + 0120 (hickory-* via iroh)
chore(ci): prune 3 stale RUSTSEC ignores from cargo-audit