deny.toml advisory missing deadline! Add a line to the…

Error message

deny.toml advisory missing deadline!
Add a line to the `reason` property for {id} with this format:

    FIX-DEADLINE: 2026-01-05

{reason:?}

What it means

A test-suite assertion panic in Gleam's own tests (compiler-core/src/tests.rs, `rust_advisories_ignore_deadlines`). It enforces a project policy: every advisory ID listed in `deny.toml` under `advisories.ignore` must have a `FIX-DEADLINE: YYYY-MM-DD` line in its `reason` string, so ignored vulnerabilities cannot be forgotten forever. The panic fires when regex captures find no deadline in an ignored advisory's reason.

Solutions

Open deny.toml, find the offending advisory `id` named in the panic, and add a `FIX-DEADLINE: YYYY-MM-DD` line inside its `reason` string.
Use the exact format `FIX-DEADLINE: 2026-01-05` (four-digit year, two-digit month/day) so the regex matches.
Re-run `cargo test -p gleam-core rust_advisories_ignore_deadlines` to confirm the check passes.

Example fix

// before (deny.toml)
[[advisories.ignore]]
id = "RUSTSEC-2024-0001"
reason = "only used in tests"
// after (deny.toml)
[[advisories.ignore]]
id = "RUSTSEC-2024-0001"
reason = """
only used in tests
FIX-DEADLINE: 2026-01-05
"""

Defensive patterns

Strategy: validation

Validate before calling

// Validate deny.toml before committing
let reason = &advisory.reason;
assert!(regex::Regex::new(r"FIX-DEADLINE: \d{4}-\d{2}-\d{2}").unwrap().is_match(reason),
    "advisory {} missing FIX-DEADLINE", advisory.id);

Prevention

Always copy the FIX-DEADLINE template shown in the panic message when adding an advisory ignore.
Use the exact ISO format YYYY-MM-DD; no other date spellings.
Add a pre-commit hook or cargo-deny lint step that validates reasons before CI.

When it happens

Trigger: Adding or editing an entry in `deny.toml` `[advisories] ignore` whose `reason` lacks a line matching `FIX-DEADLINE: \d{4}-\d{2}-\d{2}`, then running `cargo test`.

Common situations: Contributors add `id = "RUSTSEC-..."` with a plain prose reason (or a date formatted differently, e.g. `Deadline: Jan 2026`) and the policy test fails during CI.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of gleam-lang/gleam@15b07c7830 (2026-09-14). Data as JSON: /api/errors/bcb11dd2adada4f4. Report an issue: GitHub.

Appendix: source

Thrown at compiler-core/src/tests.rs:69

    );
}

fn load_cargo_deny_config() -> CargoDenyConfig {
    let toml = std::fs::read_to_string("../deny.toml").unwrap();
    let config = toml::from_str(&toml).unwrap();
    config
}

#[test]
fn rust_advisories_ignore_deadlines() {
    let today = time::OffsetDateTime::now_utc().date();
    let regex = regex::Regex::new(r"(?m)FIX-DEADLINE: (\d{4})-(\d{2})-(\d{2})").unwrap();

    for ignored in load_cargo_deny_config().advisories.ignore {
        let id = ignored.id;
        let reason = ignored.reason;
        let Some(captures) = regex.captures(&reason) else {
            panic!(
                "
deny.toml advisory missing deadline!
Add a line to the `reason` property for {id} with this format:

    FIX-DEADLINE: 2026-01-05

{reason:?}
"
            )
        };

        let year = captures[1].parse::<i32>().expect("parse year");
        let month = captures[2].parse::<u8>().expect("parse month int");
        let month = month.try_into().expect("parse month");
        let day = captures[3].parse::<u8>().expect("parse day");
        let deadline = time::Date::from_calendar_date(year, month, day).expect("construct date");

        assert!(

View on GitHub (pinned to 15b07c7830)