[jdx]

cargo deny check now fails lint on every branch. Two crates were marked unmaintained today, and both come in through rattler:

• astral-tokio-tar, via rattler_package_streaming, which the conda backend uses to unpack conda packages
• pin-utils, via wasmtimer in rattler_repodata_gateway

Neither advisory reports a vulnerability, and no upgrade drops either crate until rattler does. This adds ignore entries with those reasons, like the other transitive advisories in deny.toml.

Both advisories are still unnumbered (RUSTSEC-0000-0000). rustsec/advisory-db#3497 assigns them RUSTSEC-2026-0439 and RUSTSEC-2026-0437, and this ignores those IDs too. Until then, the placeholder entry is what keeps lint green. It ignores every unnumbered advisory, so it should be removed once the IDs are published.

Test plan

• With a fresh advisory database, cargo deny check advisories fails on main with cargo-deny 0.19.4 (CI's version) and passes on this branch.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: 2.1.309.

🤖 Generated with Claude Code

---

Note

Low Risk
Config-only change to cargo-deny ignores; no application logic or dependency upgrades.

Overview
Restores green cargo deny check advisories lint after two new unmaintained (not vulnerable) RustSec entries for transitive rattler dependencies: astral-tokio-tar (conda package unpacking via rattler_package_streaming) and pin-utils (via wasmtimer in rattler_repodata_gateway).

Adds documented ignore entries in deny.toml for the upcoming IDs RUSTSEC-2026-0439 and RUSTSEC-2026-0437, plus a temporary RUSTSEC-0000-0000 ignore so CI passes while those advisories are still unnumbered in the advisory DB—intended to be removed once rustsec/advisory-db#3497 lands.

^{Reviewed by Cursor Bugbot for commit 60965ff. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with the temporary blanket exception explicitly accepted by the author.

Summary

Updates deny.toml to ignore two maintenance advisories for crates brought in through rattler.

• The advisory check skips reports for two unmaintained crates.

jdx explicitly acknowledges that the temporary entry ignores every unnumbered advisory and should be removed after publication. No actionable issues were found. Checks were not run.

_{Reviews (1) · Last reviewed commit: "chore(deps): ignore unmaintained astral-..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▁▁▁▁▂███████▆	36,516,946 → 36,319,071	-0.54%	22.45 → 21.56ms	-3.98%
hook-env	▂▂▂▁▁███████▇	38,805,469 → 38,649,497	-0.40%	22.83 → 23.15ms	+1.38%
ls	▁▁▂▁▁▇▇▇██▇▇▆	41,186,077 → 41,052,667	-0.32%	24.07 → 24.22ms	+0.64%
registry	▅▅▄▅▄▅▅▄▅█▇▇▁	45,052,894 → 44,886,833	-0.37%	19.78 → 19.70ms	-0.38%
startup	▅▄▇▇▄██▆▆█▅█▁	12,670,138 → 12,607,841	-0.49%	13.36 → 13.03ms	-2.47%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{60965ff73415 vs 70c959bd1e7c · measured on the runner, not pushed to the history.}