[avi-starkware]

Makes the advisories check an honest gate and delivers the "comment on the PR" behaviour:

• main.yml cargo-deny job: no longer behind optimize_ci (a lockfile scan needs no build, and the Graphite optimizer was skipping it on stacked PRs). Split into a blocking cargo deny check advisories step and a continue-on-error licenses bans sources step: licenses still rejects the GPL-3.0 rhexdump, bans still reports starknet_proof_verifier's versionless git dependency (both need a decision, not a config edit), and sources passes. Job name unchanged, so merge-gatekeeper still sees it.
• deny.toml: unmaintained = "workspace" (transitive unmaintained crates are not actionable here) and one { id, reason } ignore entry per remaining advisory, each naming the dependency that holds the version back.
• New dependency_review.yml: actions/dependency-review-action v4.9.0 (SHA-pinned) with comment-summary-in-pr: always and warn-only: true. Requires the repo's Dependency graph (already on — alerts exist).
• Cargo.lock: libz-sys 1.1.22 → 1.1.31 for RUSTSEC-2026-0418 (build script leaks environment variables), published after the check above was first green; nothing else moves.

Verified: cargo deny check advisories → advisories ok; full check → advisories ok, bans FAILED, licenses FAILED, sources ok (bans = the single deliberate starknet_proof_verifier wildcard finding from #15115; licenses = rhexdump GPL + 7 unlicensed stwo-circuits crates, see #15111); actionlint clean on the new workflow. Re-run on main; the ignore list now also covers RUSTSEC-2026-0367/0368/0369 (zip 0.6, held by cairo-vm 3.2.0) RUSTSEC-2026-0387 (crypto-bigint 0.5, held by elliptic-curve 0.13), and RUSTSEC-2026-0391/0398/0403 (zstd 0.13 / zstd-safe 7, a direct dependency whose fix needs the semver-breaking zstd 0.14.3).

🤖 Generated with Claude Code

[reviewable-StarkWare]

This change is 

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	d23441a48e516b6c34aea4fa41551a30e30af803	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/dependency-review-action	2031cfc080254a8a887f58cffee85186f0e49e48	🟢 7.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 9 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits
cargo/libz-sys	1.1.31	🟢 6.3	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Packaging 🟢 10 packaging workflow detected

Scanned Files

• .github/workflows/dependency_review.yml
• Cargo.lock

[cursor]

PR Summary

Medium Risk
Advisories now fail PRs unless explicitly ignored in deny.toml, which tightens supply-chain gating but leaves documented exceptions; dependency review and non-blocking license/ban checks reduce merge friction.

Overview
RustSec advisories become a blocking CI gate, while license, ban, and source checks stay informational until known policy issues (GPL rhexdump, starknet_proof_verifier wildcard dep) are resolved.

The cargo-deny job no longer depends on Graphite optimize_ci, so lockfile scans run on every PR. It is split into a required cargo deny check advisories step and a continue-on-error step for licenses bans sources. deny.toml adds unmaintained = "workspace" and a documented ignore list for remaining advisories that are blocked by upstream or semver-breaking upgrades.

A new .github/workflows/dependency_review.yml runs GitHub’s dependency review on PRs (warn-only, always posts a comment summary). Cargo.lock bumps libz-sys from 1.1.22 to 1.1.31.

^{Reviewed by Cursor Bugbot for commit a72f91f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

There hasn't been any activity on this pull request recently, and in order to prioritize active work, it has been marked as stale.
This PR will be closed and locked in 7 days if no further activity occurs.
Thank you for your contributions!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 356a865. Configure here.}

[cursor]

Unmaintained scope skips direct dependencies

Medium Severity

unmaintained = "workspace" matches only workspace member crates, not their direct dependencies. External crates are the transitive scope, so unmaintained advisories on direct deps such as paste and bincode are dropped. The new blocking advisories gate therefore never fails on an unmaintained third-party crate.

 

^{Reviewed by Cursor Bugbot for commit 356a865. Configure here.}

[github-actions]

Artifacts upload workflows:

• Started at 2026-10-29T16:19:48Z
• Started at 2026-10-29T16:46:54Z