Add cargo-deny config for advisories

.github/workflows/deny.yml

@@ -3,16 +3,16 @@ name: Security Audit
 on:
   push:
     paths:
-      - '**/Cargo.toml'
-      - '**/Cargo.lock'
-      - 'deny.toml'
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "deny.toml"
   pull_request:
     paths:
-      - '**/Cargo.toml'
-      - '**/Cargo.lock'
-      - 'deny.toml'
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "deny.toml"
   schedule:
-    - cron: '0 0 * * 0'
+    - cron: "0 0 * * 0"
 
 jobs:
   deny:
@@ -26,7 +26,8 @@ jobs:
       - name: Advisories
         uses: EmbarkStudios/cargo-deny-action@v2
         with:
-          command: check --exclude-dev advisories
+          command: check advisories
+          arguments: --config deny-advisories.toml
 
       - name: Bans, Licenses, and Sources
         uses: EmbarkStudios/cargo-deny-action@v2

deny-advisories.toml

@@ -0,0 +1,7 @@
+[graph]
+exclude-dev = true
+
+[advisories]
+ignore = [
+    { id = "RUSTSEC-2026-0173", reason = "Introduced by `validator` crate. Just declared unmaintained." },
+]

deny.toml

@@ -16,30 +16,6 @@
 [graph]
 # exclude-dev = true
 
-# This section is considered when running `cargo deny check advisories`
-# More documentation for the advisories section can be found here:
-# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
-[advisories]
-# The path where the advisory databases are cloned/fetched into
-#db-path = "$CARGO_HOME/advisory-dbs"
-# The url(s) of the advisory databases to use
-#db-urls = ["https://github.com/rustsec/advisory-db"]
-# A list of advisory IDs to ignore. Note that ignored advisories will still
-# output a note when they are encountered.
-ignore = [
-    #"RUSTSEC-0000-0000",
-    #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
-    #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
-    #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" },
-    { id = "RUSTSEC-2026-0173", reason = "Introduced by `validator` crate. Just declared unmaintained." },
-
-]
-# If this is true, then cargo deny will use the git executable to fetch advisory database.
-# If this is false, then it uses a built-in git library.
-# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
-# See Git Authentication for more information about setting up git authentication.
-#git-fetch-with-cli = true
-
 # This section is considered when running `cargo deny check licenses`
 # More documentation for the licenses section can be found here:
 # https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html