ITADN

Request: ignore `informational = "unsound"` advisories by default

#824Closedtarcieri 创建于 2026-01-08
enhancement
T
tarciericommented
Hi there, I'm the author of `cargo-audit` and the `rustsec` crate. [We've gotten some recent reports of alert fatigue / low SNR regarding the RustSec database](https://github.com/rustsec/advisory-db/issues/2572), and it seems one of the reasons is `cargo-deny` is surfacing `informational = "unsound"` advisories per default. We don't recommend doing that because they are tagged this way explicitly because they're not security advisories and don't have an associated threat model. We like to make it possible to opt-in to surfacing them via e.g. config files for people who are genuinely interested in them, but to reduce problems like alert fatigue it would probably be good not to display them by default.
关闭于 2026-01-08 0 条评论