ci(security): ignore RUSTSEC-2026-0235 with build-graph evidence (#7555)

[proggeramlug]

security-audit is a required branch-protection context and had failed its last six completed main runs — so every merge was bypassing it. That is CLAUDE.md's "REQUIRED + red ⇒ universal bypass" pattern, live.

The sole unignored finding was RUSTSEC-2026-0235 (rkyv 0.7.46, OOB reads validating archives containing Rc/Arc). It is not in Perry's build graph:

• rkyv is an optional feature of rust_decimal (rkyv = ["dep:rkyv"]); perry-stdlib enables only features = ["maths"].
• cargo tree -e normal -i rkyv → "did not match any packages"
• cargo tree -p rust_decimal --depth 1 -e features → arrayvec / serde / num-traits only
• zero rkyv artifacts in the dev or release deps directories

cargo audit reads Cargo.lock, which lists optional dependencies whether or not any feature activates them — so this is a lockfile-only finding, not exposure. Added to the existing --ignore list with that evidence inline and an explicit re-evaluation trigger (anything enabling rkyv/rkyv-safe). cargo audit now exits 0.

Also corrects the standing note on RUSTSEC-2026-0187 (lopdf, already ignored): dependabot #7412 proposes printpdf 0.10.1, which still pins lopdf 0.39.0. I checked out that branch's lockfile — it does not close the advisory despite appearing to. Commented on #7412 so nobody merges it as the security fix.

Summary by CodeRabbit

• Chores

  • Updated the application version to 0.5.1315.
  • Improved security audit handling and documentation for a non-active advisory.
  • Added guidance for reviewing the advisory if the affected optional component becomes active.

• Documentation

  • Updated release documentation with the latest security-audit status.
  • Clarified the current status of a separate print-related security advisory.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 410c9662-6df7-4461-a2be-653584d944d4

📥 Commits

Reviewing files that changed from the base of the PR and between 2c687ad and 4b8885f.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/security-audit.yml
• CLAUDE.md
• Cargo.toml
• changelog.d/7555-rkyv-audit-ignore.md

---

📝 Walkthrough

Walkthrough

The security audit workflow now ignores and documents the inactive rkyv advisory. The changelog records the audit evidence and corrects the lopdf note. Project version references change to 0.5.1315.

Changes

Security audit updates

Layer / File(s)	Summary
Advisory documentation and audit configuration .github/workflows/security-audit.yml, changelog.d/7555-rkyv-audit-ignore.md	The workflow documents the inactive rkyv advisory and ignores RUSTSEC-2026-0235. The changelog records verification details and corrects the lopdf advisory note.
Release version metadata Cargo.toml, CLAUDE.md	The workspace package version and documented current version change from 0.5.1314 to 0.5.1315.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• security-audit is a REQUIRED context, red on main, so every merge bypasses it — 2 real advisories (lopdf 7.5 HIGH, rkyv), and #7412 does not fix them #7555 — Documents and ignores the rkyv advisory in the security audit workflow while recording the unresolved lopdf advisory.

Possibly related PRs

• PerryTS/perry#6751 — Introduced the per-PR changelog workflow used by the new changelog fragment.

Suggested reviewers: jdalton, thehypnoo

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7555-rkyv-audit-ignore

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}