Nilock currently carries a documented temporary exception for:

• RUSTSEC-2026-0194
• RUSTSEC-2026-0195

Reason:

• wayland-scanner 0.31.x still depends on quick-xml 0.39.x
• a vendored patch was intentionally removed to keep the repository smaller and easier to review

This exception is currently documented in:

• deny.toml
• .github/workflows/security.yml

It should be removed as soon as the upstream wayland-scanner / wayland-rs dependency chain moves to a non-vulnerable quick-xml release.