fix(deps): clear RUSTSEC advisory failures in supply-chain CI

.cargo/audit.toml

@@ -19,6 +19,25 @@ ignore = [
     # Re-evaluate when the `rsa` crate ships a constant-time implementation.
     "RUSTSEC-2023-0071",
 
+    # quick-xml 0.26.0 — memory-exhaustion DoS via unbounded namespace-
+    # declaration allocation (RUSTSEC-2026-0195) and quadratic run time on
+    # duplicate-attribute checks (RUSTSEC-2026-0194), both severity 7.5.
+    # Pulled transitively only via `inferno` (flamegraph rendering) <-
+    # `pprof` (optional `profiling` feature of ruvector-bench, never a
+    # production dependency). No lockfile-only bump is possible: `pprof`
+    # 0.15.0 (the newest release on crates.io as of this review) still
+    # requires `inferno = "^0.11"`, and `inferno` 0.11.21 (the newest
+    # patch in that line) still requires `quick-xml = "^0.26"` — verified
+    # directly via `cargo update -p inferno`/`cargo update -p quick-xml`
+    # dry runs, not from changelog inspection alone. quick-xml here only
+    # parses profiler-internal XML on the local machine (never
+    # network-facing or attacker-supplied input), so the DoS surface is
+    # not reachable in our usage even before a fix ships. Re-review when
+    # `pprof` cuts a release depending on `inferno` >=0.12, or track
+    # https://github.com/jonhoo/inferno for a quick-xml bump.
+    "RUSTSEC-2026-0195",
+    "RUSTSEC-2026-0194",
+
     # ------------------------------------------------------------------
     # "Unmaintained" warnings (informational, not vulnerabilities)
     # ------------------------------------------------------------------

deny.toml

@@ -125,6 +125,21 @@ ignore = [
     # 2026-08-01.
     "RUSTSEC-2026-0105",
 
+    # ttf-parser — unmaintained, upstream author stated no further fixes
+    # will be released (RUSTSEC-2026-0192); the advisory itself states
+    # "No safe upgrade is available!". Reaches the graph at three
+    # independent versions, none of them fixable by a version bump:
+    #   0.15.2 via rusttype 0.9.3 -> owned_ttf_parser (dev-only, scipix)
+    #   0.20.0 via plotters 0.3.7 -> criterion (dev-dep, workspace-wide) and
+    #           -> ruvector-bench's own chart rendering (publish = false)
+    #   0.25.1 via imageproc 0.25.1 -> ab_glyph -> owned_ttf_parser (scipix)
+    # All three paths are dev-dependencies or unpublished bench-only tooling,
+    # never linked into a published/production artifact; font-parsing
+    # inputs are local example assets, not attacker-controlled. Re-review
+    # 2026-08-01 or when a maintained fork (e.g. skrifa) is adopted by
+    # rusttype/plotters/imageproc upstream.
+    "RUSTSEC-2026-0192",
+
     # memmap2 0.9.x — unsound `Unchecked pointer offset` API (RUSTSEC-2026-0186,
     # "unsound", not an exploitable vuln). Transitive via safetensors/candle
     # mmap loading and other crates; no fixed release on the 0.9 line yet.