modify deny

Author: yoshidan

deny.toml

@@ -37,7 +37,14 @@ yanked = "warn"
 ignore = [
     # This is due to the feature ['jsonwebtoken/rust_crypto']
     # We can use ['jsonwebtoken/aws_lc_rs'] instead to avoid this vulnerability.
-    "RUSTSEC-2023-0071"
+    "RUSTSEC-2023-0071",
+    # hickory-proto 0.25.x vulnerabilities - reqwest 0.13.x depends on hickory-resolver 0.25.x
+    # which requires hickory-proto 0.25.x. Waiting for reqwest to update to hickory 0.26.x.
+    # Only affects users enabling the 'hickory-dns' feature.
+    # https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465
+    "RUSTSEC-2026-0118",
+    # https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
+    "RUSTSEC-2026-0119",
 ]
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score
 # lower than the range specified will be ignored. Note that ignored advisories
@@ -86,12 +93,6 @@ confidence-threshold = 0.8
 exceptions = [
     # Each entry is the crate and version constraint, and its specific allow
     # list
-
-    # ring uses code from multiple libraries but all with permissive licenses
-    # https://tldrlegal.com/license/openssl-license-(openssl)
-    { allow = ["OpenSSL"], name = "ring" },
-    # similar to ring
-    { allow = ["OpenSSL"], name = "aws-lc-sys" },
 ]
 
 # Some crates don't have (easily) machine readable licensing information,