deps: unmaintained rustls-pemfile via qdrant-client → tonic (RUSTSEC-2025-0134)

[bug-ops]

Summary

cargo deny check advisories reports RUSTSEC-2025-0134: rustls-pemfile v2.2.0 is unmaintained.

Dependency chain

qdrant-client v1.17.0 → tonic v0.12.3 → rustls-pemfile v2.2.0

Status

• Not a vulnerability — unmaintained crate advisory only
• No safe upgrade available (transitive dep)
• Resolution requires either: qdrant-client updating tonic, or tonic 0.13+ adoption
• rustls-pki-types >= 1.9.0 includes the PEM parsing code directly (no rustls-pemfile needed)

Action required

Monitor qdrant-client releases; upgrade when a version with tonic ≥ 0.13 is available (uses rustls-pki-types directly).

Priority

Low — cosmetic advisory, no active vulnerability.

[bug-ops]

Advisory is already suppressed in .github/deny.toml with ignore = ["RUSTSEC-2025-0134"] and a comment referencing qdrant/rust-client#255.

Checked latest qdrant-client on crates.io: still 1.17.0 with tonic 0.12.3 — no upgrade path available yet.

Closing as handled. Will reopen when a qdrant-client release with tonic ≥ 0.13 (uses rustls-pki-types directly without rustls-pemfile) lands on crates.io.