cmtrace-open 1.5.0

Free, open-source CMTrace replacement: Windows log viewer with ConfigMgr/SCCM, Intune, and Autopilot ESP diagnostics, DSRegCmd triage, and real-time tailing.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

[advisories]
# Most of these unresolved advisories are in transitive Tauri/evtx dependencies.
# The quick-xml advisories are different: quick-xml is now ALSO a first-party
# dependency (src-tauri/Cargo.toml intune-diagnostics feature, in the default
# full feature), and its Reader + attributes API parses untrusted .evtx-derived
# XML in production (src-tauri/src/intune/evtx_parser.rs). That use is NOT
# test-only. The continued suppression is justified by the layered mitigations
# applied before and around parsing, spelled out on the per-ID lines below.
# RUSTSEC-2026-0009 is not ignored: time resolves from crates.io at >= 0.3.47,
# which carries the upstream recursion limit, and its exact boundary is tested.
ignore = [
    "RUSTSEC-2021-0153", # encoding: unmaintained (via evtx crate)
    "RUSTSEC-2024-0370", # proc-macro-error: unmaintained (via Tauri)
    "RUSTSEC-2024-0384", # fxhash: unmaintained (transitive)
    "RUSTSEC-2024-0411", # gtk: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0412", # gdk: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0413", # atk: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0414", # gdk-pixbuf: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0415", # gio: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0416", # glib: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0429", # glib: VariantStrIter unsoundness, fixed in glib 0.20; blocked by Tauri's gtk-rs 0.18 pin (Tauri Linux)
    "RUSTSEC-2024-0417", # pango: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0418", # cairo-rs: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0419", # gtk-sys etc: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2024-0420", # glib-sys etc: GTK3 unmaintained (Tauri Linux)
    "RUSTSEC-2025-0057", # gtk-related (Tauri Linux)
    "RUSTSEC-2025-0075", # gtk-related (Tauri Linux)
    "RUSTSEC-2025-0080", # gtk-related (Tauri Linux)
    "RUSTSEC-2025-0081", # gtk-related (Tauri Linux)
    "RUSTSEC-2025-0098", # gtk-related (Tauri Linux)
    "RUSTSEC-2025-0100", # gtk-related (Tauri Linux)
    "RUSTSEC-2026-0194", # quick-xml duplicate-attribute O(n^2) CPU DoS; reachable via evtx_parser Reader/attributes on untrusted .evtx XML but bounded by layered caps: 512KB per-record (MAX_ESP_EVTX_RECORD_BYTES), legal-XML-char prefilter, 64-level nesting cap, 256-attribute per-element cap bounding the quadratic, and 50k-entry / 32MB-batch caps (also plist/Tauri, wayland-scanner)
    "RUSTSEC-2026-0195", # quick-xml NsReader allocation DoS; evtx_parser uses Reader, never NsReader, so no reachable path (also plist/Tauri, wayland-scanner)
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "MPL-2.0",
    "OpenSSL",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[bans]
multiple-versions = "warn"
wildcards = "allow"

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []