Skip to content

chore(deps): document ttf-parser migration decision (RUSTSEC-2026-0192) #900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yfedoseev merged 3 commits into from
Jul 19, 2026
+26 −8
Merged

chore(deps): document ttf-parser migration decision (RUSTSEC-2026-0192) #900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d143e22
chore(deps): document ttf-parser migration decision (RUSTSEC-2026-0192)
yfedoseev Jul 18, 2026
6d83c57
Merge branch 'main' into fix/issue-852-ttfparser-skrifa
yfedoseev Jul 19, 2026
efae6fe
style(cargo): taplo fmt — single space before subsetter inline comment
yfedoseev Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
ignored-paths = [
# Runnable examples — not declared as [[example]] targets because they use
# `cargo run --manifest-path examples/rust/.../Cargo.toml` pattern.
"examples/rust/*/main.rs",

Check warning on line 35 in Cargo.toml

View workflow job for this annotation

GitHub Actions / Unused deps (cargo-shear)

shear/redundant_ignore_path 

redundant ignored paths pattern `examples/rust/*/main.rs` (remove from ignored paths list)
# Placeholder modules kept disabled for future work (see src/pipeline/mod.rs)
"src/pipeline/input_parsers/mod.rs",
"src/structure/builder.rs",
Expand Down Expand Up @@ -148,8 +148,9 @@
brotli = "8" # Brotli compression (PDF 2.0, ISO 32000-2:2020)

# Font parsing
ttf-parser = "0.25" # TrueType font parser for embedded font cmap tables
subsetter = "0.2" # Binary TrueType/OpenType subsetting (Typst's; MIT/Apache). Used by writer-side
ttf-parser = "0.25" # TrueType/OpenType parsing: embedded-font cmap, glyph outlines, metrics, name records.
# Unmaintained (RUSTSEC-2026-0192); fontations (skrifa) migration is upstream-gated — rationale in osv-scanner.toml.
subsetter = "0.2" # Binary TrueType/OpenType subsetting (Typst's; MIT/Apache). Used by writer-side
# EmbeddedFont to shrink embedded fonts to only the glyphs actually used.
taffy = { version = "0.12", default-features = false, features = [
"std",
Expand Down
29 changes: 23 additions & 6 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,27 @@ ignoreUntil = 2026-09-23
[[IgnoredVulns]]
id = "RUSTSEC-2026-0192"
# `ttf-parser` crate: "unmaintained" advisory (informational, not a CVE; no
# memory-safety or RCE implication — the author has simply stated the crate
# will receive no further fixes). There is no patched version. We use it only
# to read embedded-font `cmap` tables; the actively-maintained replacement
# (`skrifa`, already a dependency for glyph outlines) requires a non-trivial
# migration of the cmap path. Re-evaluate once that migration lands.
ignoreUntil = 2026-09-30
# memory-safety or RCE implication — the author has stated the crate will
# receive no further fixes; its repo has since moved under the harfbuzz org).
# There is no patched version.
#
# Decision: keep waiting. Removing ttf-parser is NOT achievable by a version
# bump — it reaches the tree three independent ways:
# 1. directly — we parse embedded-font cmap tables, glyph outlines, metrics
# and name records through it (core font parsing + the render outline
# path), ~29 call sites;
# 2. fontdb (system-fonts) -> ttf-parser — latest fontdb 0.23.0 still depends
# on it and ships no skrifa/fontations release;
# 3. imageproc (ml) -> ab_glyph -> owned_ttf_parser -> ttf-parser — likewise
# no fontations-based release exists.
# The actively-maintained successor is `skrifa`/`read-fonts` (fontations),
# already in our tree via subsetter (and via harfrust once the shaping
# migration off rustybuzz lands). Fully clearing this advisory requires porting
# our direct usage to skrifa AND replacing both fontdb and ab_glyph with
# fontations-based equivalents — a large, multi-crate migration touching the
# core font-parsing and render paths, with real regression risk that is
# disproportionate while the advisory remains informational-only.
# Re-evaluate when fontdb or ab_glyph ship a fontations backend, or when the
# standalone font-stack migration is scheduled.
ignoreUntil = 2026-12-31

Loading