cargo deny check advisories runs daily at 11:17 UTC (offset from Trivy
at 11:08 to spread DB load). This catches new CVEs published against
Cargo dependencies between code pushes, matching the coverage Trivy
provides for container vulnerabilities.
Runs advisories-only so duplicate/license warnings don't obscure newly
published CVEs - the full cargo deny check already runs in build.yml on
every push/PR. Guarded to the upstream repo to avoid fork hammering the
RustSec DB. Supports workflow_dispatch for manual triggering.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6995
**Author:** [@TriplEight](https://github.com/TriplEight)
**Created:** 3/22/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `pr/3x8_scheduled-advisory-scan`
---
### 📝 Commits (1)
- [`0d66306`](https://github.com/dani-garcia/vaultwarden/commit/0d6630676694a680537755db6da2de63e4551da6) ci: add daily scheduled RustSec advisory scan
### 📊 Changes
**1 file changed** (+41 additions, -0 deletions)
<details>
<summary>View changed files</summary>
➕ `.github/workflows/cargo-deny-scheduled.yml` (+41 -0)
</details>
### 📄 Description
cargo deny check advisories runs daily at 11:17 UTC (offset from Trivy
at 11:08 to spread DB load). This catches new CVEs published against
Cargo dependencies between code pushes, matching the coverage Trivy
provides for container vulnerabilities.
Runs advisories-only so duplicate/license warnings don't obscure newly
published CVEs - the full cargo deny check already runs in build.yml on
every push/PR. Guarded to the upstream repo to avoid fork hammering the
RustSec DB. Supports workflow_dispatch for manual triggering.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6995
Author: @TriplEight
Created: 3/22/2026
Status: ❌ Closed
Base:
main← Head:pr/3x8_scheduled-advisory-scan📝 Commits (1)
0d66306ci: add daily scheduled RustSec advisory scan📊 Changes
1 file changed (+41 additions, -0 deletions)
View changed files
➕
.github/workflows/cargo-deny-scheduled.yml(+41 -0)📄 Description
cargo deny check advisories runs daily at 11:17 UTC (offset from Trivy
at 11:08 to spread DB load). This catches new CVEs published against
Cargo dependencies between code pushes, matching the coverage Trivy
provides for container vulnerabilities.
Runs advisories-only so duplicate/license warnings don't obscure newly
published CVEs - the full cargo deny check already runs in build.yml on
every push/PR. Guarded to the upstream repo to avoid fork hammering the
RustSec DB. Supports workflow_dispatch for manual triggering.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.