[sentry-junior]

Adds the RUSTSEC advisories we reviewed and closed as not affecting sentry-cli to the ignore input of the weekly rustsec/audit-check job, so it stops re-filing issues for them. The action's built-in dedup (by issue title) isn't reliable here: #3319 was filed even though #2978 already existed.

The action splits ignore on commas and trims whitespace, then passes each ID as cargo audit --ignore <ID>.

Advisory	Crate	Why it's ignored	Issue(s)
RUSTSEC-2025-0119	number_prefix	Informational "unmaintained" notice; comes in via the intentionally pinned indicatif 0.14	#2978, #3319
RUSTSEC-2026-0253	lru	Needs pop() plus a key whose drop panics; we only use LruCache<String, ()> and never call pop()	#3394
RUSTSEC-2026-0285, -0346, -0348, -0349	rustls	Only an optional reqwest dependency in Cargo.lock; never compiled (cargo tree -i rustls --target all is empty, we use native-tls)	#3416, #3433, #3434, #3435
RUSTSEC-2026-0367, -0368, -0369	zip	Only affect ZipArchive::extract() / stream extraction, which we don't call; our extraction writes files manually via enclosed_name() + File::create	#3436–#3440

RUSTSEC-2026-0258 (h2) is intentionally not ignored; it was fixed in #3441.

These should be re-evaluated if usage of the affected crates changes (e.g. if we start calling zip's extract() or enable rustls).

via @szokeasaurusrex.

--

View Junior Session [Sentry]