1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
[]
= [
{ = 'x86_64-unknown-linux-gnu' },
{ = 'x86_64-apple-darwin' },
{ = 'x86_64-pc-windows-msvc' },
]
[]
= 2
= [
"RUSTSEC-2025-0141",
"RUSTSEC-2024-0436",
# ttf-parser is unmaintained but no upgrade path exists; comes through resvg and ratex-render
"RUSTSEC-2026-0192",
# quick-xml 0.39.x has quadratic attribute-dedup (RUSTSEC-2026-0194) and unbounded namespace
# resolver allocation (RUSTSEC-2026-0195); fix requires >= 0.41.0, but plist 1.9.0 (the latest,
# pulled in by syntect) still pins 0.39.x — no upgrade path available yet.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
# crossbeam-epoch's fmt::Display invalid-pointer-deref bug; pulled in transitively via
# rayon (image -> exr/ravif) for sixel/image support. No direct dependency, and the fix
# (crossbeam-epoch >= 0.9.20) is not yet picked up by rayon-core 1.13.0.
"RUSTSEC-2026-0204",
# rustybuzz is unmaintained; pulled in transitively via resvg -> usvg for SVG image
# support. No direct dependency and no upgrade path (harfrust migration not yet
# available in resvg).
"RUSTSEC-2026-0206",
]
[]
= 2
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"MPL-2.0",
"Zlib",
"LPPL-1.3c",
"Unicode-3.0",
"ISC",
"CC0-1.0",
]
[]
= "allow"