chore(ci): ignore quick-xml advisories in cargo audit config (MAT-139)

[mpiton]

Quoi

Ajoute RUSTSEC-2026-0194 et RUSTSEC-2026-0195 (quick-xml 0.39.4) à la liste d'ignore de .cargo/audit.toml, avec commentaire, condition de retrait et date de revue (2026-10-15, alignée sur deny.toml).

Pourquoi

Les deux advisories ne sont atteignables que via wayland-scanner 0.31.10, un proc-macro de build qui parse du XML de protocole Wayland embarqué — entrée de confiance, absente du binaire livré (triage complet dans MAT-139). Le chemin runtime utilise déjà quick-xml 0.41.0 patché.

Le bump vers quick-xml 0.41 est mergé upstream (Smithay/wayland-rs d07c4f91f2, 2026-07-02) mais pas encore publié : la dernière release crates.io (0.31.10) pin ^0.39, donc cargo update ne peut pas purger l'advisory aujourd'hui. deny.toml (le gate CI) ignore déjà ces IDs ; ce PR aligne la config cargo audit locale pour que ses runs restent actionnables.

L'ignore est temporaire : à retirer via cargo update dès que wayland-scanner > 0.31.10 sort.

Vérification

• cargo audit -f src-tauri/Cargo.lock depuis la racine : exit 0, plus que des warnings autorisés (avant : 2 vulnérabilités)
• cargo deny --manifest-path src-tauri/Cargo.toml check : advisories ok, bans ok, licenses ok, sources ok (inchangé)

Refs MAT-139

---

Summary by cubic

Ignore RUSTSEC-2026-0194/0195 for quick-xml 0.39.4 in .cargo/audit.toml (build-time via wayland-scanner), with a 2026-10-15 review and removal note, matching deny.toml per MAT-139, until wayland-scanner ships a release using quick-xml >= 0.41. Also fixes the first-time contributor workflow by merging the welcome jobs and supplying both messages.

• Bug Fixes
  • actions/first-interaction v3 needs both issue_message and pr_message; combined PR/issue welcomes into one job to prevent “Input required and not supplied” failures.

^{Written for commit d87e581. Summary will update on new commits.}

Summary by CodeRabbit

• Security

  • Updated the security audit configuration to ignore two newly reviewed advisories tied to a build-time dependency.
  • Included documented review/expiration guidance for these exceptions in the upcoming release notes.
  • The ignores will be removed after the upstream fix is released.

• Fixed

  • Updated the welcome automation to satisfy the action’s runtime requirement for both issue and pull request messages by consolidating them into a single job.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

📝 Walkthrough

Walkthrough

Cargo audit now ignores two RustSec advisories associated with quick-xml through wayland-scanner. The contributor workflow combines issue and pull request welcome jobs, and the changelog records both updates.

Changes

Repository maintenance

Layer / File(s)	Summary
Advisory ignore and documentation .cargo/audit.toml, CHANGELOG.md	Cargo audit ignores RUSTSEC-2026-0194 and RUSTSEC-2026-0195, while the changelog records their build-time origin, review date, and upstream release condition.
Unified welcome workflow .github/workflows/contributor.yml, CHANGELOG.md	A single welcome job handles opened issues and pull requests, supplies both first-interaction messages, and includes issue write permission.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mpiton/vortex#167: Updates RustSec ignore configuration for the same advisories.

Suggested labels: ci, rust, configuration

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding quick-xml advisories to cargo audit ignores.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Around line 12-16: Update the changelog entry describing the cargo audit
exception to include the concrete review date 2026-10-15, while preserving the
existing context about the ignored advisories and upstream fix.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: adf0ff9a-84ce-4389-8d17-a59bfc328d14

📥 Commits

Reviewing files that changed from the base of the PR and between a4dd0eb and 1b39b2b.

📒 Files selected for processing (2)

• .cargo/audit.toml
• CHANGELOG.md

[cubic-dev-ai]

cubic analysis

No issues found across 2 files

Linked issue analysis

Linked issue: MAT-139: Suivre les advisories quick-xml 0.39 (RUSTSEC-2026-0194/0195) via wayland-scanner

Status	Acceptance criteria	Notes
✅	Add RUSTSEC-2026-0194 and RUSTSEC-2026-0195 to .cargo/audit.toml ignore list	The diff of .cargo/audit.toml shows the two IDs were added to the ignore array.
✅	Document rationale, tracking (MAT-139) and temporary removal condition / review date in the audit config	The added comment explains the build-time proc-macro context, references MAT-139, states to remove after cargo update once wayland-scanner > 0.31.10 ships, and includes a review date (2026-10-15).
✅	Ensure cargo audit exits successfully (no blocking advisories) when run against src-tauri/Cargo.lock	PR verification states `cargo audit -f src-tauri/Cargo.lock` exits 0 (previously showed 2 vulnerabilities). The PR's change is the cause of the green audit run.
✅	Record the change in CHANGELOG	CHANGELOG.md was updated with a Security section noting the temporary ignore and tracking MAT-139.

_{Re-trigger cubic}

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks

---

_{Comparing feat/mat-139-quick-xml-audit-ignore (d87e581) with main (a4dd0eb)}