{"record":{"id":"bcb11dd2adada4f4","repo":"gleam-lang/gleam","slug":"deny-toml-advisory-missing-deadline-add-a-line-to-the-reason","errorCode":null,"errorMessage":"deny.toml advisory missing deadline!\nAdd a line to the `reason` property for {id} with this format:\n\n    FIX-DEADLINE: 2026-01-05\n\n{reason:?}\n","messagePattern":"deny\\.toml advisory missing deadline!\nAdd a line to the `reason` property for (.+?) with this format:\n\n    FIX-DEADLINE: 2026-01-05\n\n(.+?)\n","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"compiler-core/src/tests.rs","lineNumber":69,"sourceCode":"    );\n}\n\nfn load_cargo_deny_config() -> CargoDenyConfig {\n    let toml = std::fs::read_to_string(\"../deny.toml\").unwrap();\n    let config = toml::from_str(&toml).unwrap();\n    config\n}\n\n#[test]\nfn rust_advisories_ignore_deadlines() {\n    let today = time::OffsetDateTime::now_utc().date();\n    let regex = regex::Regex::new(r\"(?m)FIX-DEADLINE: (\\d{4})-(\\d{2})-(\\d{2})\").unwrap();\n\n    for ignored in load_cargo_deny_config().advisories.ignore {\n        let id = ignored.id;\n        let reason = ignored.reason;\n        let Some(captures) = regex.captures(&reason) else {\n            panic!(\n                \"\ndeny.toml advisory missing deadline!\nAdd a line to the `reason` property for {id} with this format:\n\n    FIX-DEADLINE: 2026-01-05\n\n{reason:?}\n\"\n            )\n        };\n\n        let year = captures[1].parse::<i32>().expect(\"parse year\");\n        let month = captures[2].parse::<u8>().expect(\"parse month int\");\n        let month = month.try_into().expect(\"parse month\");\n        let day = captures[3].parse::<u8>().expect(\"parse day\");\n        let deadline = time::Date::from_calendar_date(year, month, day).expect(\"construct date\");\n\n        assert!(","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/gleam-lang/gleam/blob/15b07c783065c92bb016b1b74ed0995a5259850f/compiler-core/src/tests.rs#L51-L87","documentation":"A test-suite assertion panic in Gleam's own tests (compiler-core/src/tests.rs, `rust_advisories_ignore_deadlines`). It enforces a project policy: every advisory ID listed in `deny.toml` under `advisories.ignore` must have a `FIX-DEADLINE: YYYY-MM-DD` line in its `reason` string, so ignored vulnerabilities cannot be forgotten forever. The panic fires when regex captures find no deadline in an ignored advisory's reason.","triggerScenarios":"Adding or editing an entry in `deny.toml` `[advisories] ignore` whose `reason` lacks a line matching `FIX-DEADLINE: \\d{4}-\\d{2}-\\d{2}`, then running `cargo test`.","commonSituations":"Contributors add `id = \"RUSTSEC-...\"` with a plain prose reason (or a date formatted differently, e.g. `Deadline: Jan 2026`) and the policy test fails during CI.","solutions":["Open deny.toml, find the offending advisory `id` named in the panic, and add a `FIX-DEADLINE: YYYY-MM-DD` line inside its `reason` string.","Use the exact format `FIX-DEADLINE: 2026-01-05` (four-digit year, two-digit month/day) so the regex matches.","Re-run `cargo test -p gleam-core rust_advisories_ignore_deadlines` to confirm the check passes."],"exampleFix":"// before (deny.toml)\n[[advisories.ignore]]\nid = \"RUSTSEC-2024-0001\"\nreason = \"only used in tests\"\n// after (deny.toml)\n[[advisories.ignore]]\nid = \"RUSTSEC-2024-0001\"\nreason = \"\"\"\nonly used in tests\nFIX-DEADLINE: 2026-01-05\n\"\"\"","handlingStrategy":"validation","validationCode":"// Validate deny.toml before committing\nlet reason = &advisory.reason;\nassert!(regex::Regex::new(r\"FIX-DEADLINE: \\d{4}-\\d{2}-\\d{2}\").unwrap().is_match(reason),\n    \"advisory {} missing FIX-DEADLINE\", advisory.id);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always copy the FIX-DEADLINE template shown in the panic message when adding an advisory ignore.","Use the exact ISO format YYYY-MM-DD; no other date spellings.","Add a pre-commit hook or cargo-deny lint step that validates reasons before CI."],"tags":["rust","cargo-deny","ci","policy-check","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"15b07c783065c92bb016b1b74ed0995a5259850f","analyzedAt":"2026-09-14T11:14:59.388Z","contentChangedAt":"2026-09-14T11:14:59.388Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}