From 54d73d9cb193b762e69f5b1bdad0698900ab06bd Mon Sep 17 00:00:00 2001
From: Stephen Waits <steve@waits.net>
Date: Sun, 10 May 2026 14:25:54 -0600
Subject: [PATCH] ci: ignore transitive hickory CVEs blocked by iroh's hard-pin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RUSTSEC-2026-0119 (hickory-proto O(n²) name-compression DoS) and
RUSTSEC-2026-0120 (hickory-net NSEC3 unbounded loop / OOM) both fire
against hickory 0.26.0-beta.4. Fixed upstream in hickory 0.26.1, but
iroh 0.98.2 hard-pins hickory-resolver = "=0.26.0-beta.4" so we
can't bump transitively. Unblock once iroh releases a version that
relaxes the pin.
---
 .github/workflows/ci.yml |  4 +++-
 deny.toml                | 18 +++++++++++++-----
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4aa441..244561f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,7 +62,9 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-audit
-      - run: cargo audit
+      # cargo-audit doesn't read deny.toml, so mirror its ignore list here.
+      # See deny.toml [advisories] for rationale on each ID.
+      - run: cargo audit --ignore RUSTSEC-2026-0119 --ignore RUSTSEC-2026-0120
 
   # ── Public-API semver compliance (PR only) ────────────────────────
   semver:
diff --git a/deny.toml b/deny.toml
index 9532147..c5bafa9 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,15 +15,23 @@ all-features = true
 [advisories]
 version = 2
 yanked = "deny"
-# Allow transitive "unmaintained" advisories that come via iroh's dep graph
-# and can't be fixed downstream. Re-evaluate on each iroh bump.
-# Note: cargo-deny and cargo-audit disagree on which advisories currently fire;
-# cargo-audit reports atomic-polyfill, cargo-deny's db may not. We list it here
-# for cargo-audit's benefit via deny.toml being the canonical source.
+# Allow transitive advisories that come via iroh's dep graph and can't be
+# fixed downstream. Re-evaluate on each iroh bump.
+# Note: cargo-audit does NOT read this file — mirror any vulnerability-class
+# entries below into the `cargo audit --ignore …` flag list in ci.yml.
 ignore = [
     # paste — no longer maintained. Pulled in via iroh → portmapper → netwatch
     # → netlink-packet-core. No direct dep; stuck until iroh migrates.
     "RUSTSEC-2024-0436",
+    # hickory-proto 0.26.0-beta.4 — CPU exhaustion via O(n²) name compression
+    # during message encoding. Transitive via iroh → hickory-resolver
+    # (=0.26.0-beta.4, hard-pinned). Fixed in hickory 0.26.1; unblock when
+    # iroh releases a version that bumps the pin.
+    "RUSTSEC-2026-0119",
+    # hickory-net 0.26.0-beta.4 — NSEC3 closest-encloser proof enters an
+    # unbounded loop on cross-zone responses (OOM in release builds; panic
+    # in debug). Same transitive path and same iroh pin as RUSTSEC-2026-0119.
+    "RUSTSEC-2026-0120",
 ]
 
 # ── Licenses ───────────────────────────────────────────────────────