ci: allow memmap2 advisory

[Donny/강동윤 (kdy1)]

Description:

Allow RUSTSEC-2026-0186 in deny.toml so cargo deny check passes after the new RustSec advisory for memmap2 0.6.2.

memmap2 is constrained by shared-buffer 0.1.4, which is pulled in through Wasmer. There is no newer crates.io release of shared-buffer, and local source inspection shows it only uses Mmap::map, not the affected range advice/flush APIs described by the advisory.

Validation:

• git submodule update --init --recursive
• cargo deny check
• cargo fmt --all
• cargo clippy --all --all-targets -- -D warnings

BREAKING CHANGE:

None.

Related issue (if exists):

CI job: https://github.com/swc-project/swc/actions/runs/28000731021/job/82872355038

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 57d0037e0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[chatgpt-codex-connector]

Verify the direct wasmer-compiler memmap2 path

This ignore suppresses RUSTSEC-2026-0186 for every memmap2 0.6.2 occurrence, but the checked lockfile shows wasmer-compiler 6.1.0-rc.3 also depends directly on memmap2 (Cargo.lock:8767-8780), in addition to the shared-buffer path. When swc_plugin_backend_wasmer is enabled it pulls in Wasmer/Cranelift (Cargo.lock:7457-7467), so the exemption currently lets cargo deny pass without covering that direct dependency; please either verify/upgrade the Wasmer compiler path as well or avoid the global advisory ignore.

Useful? React with 👍 / 👎.

[codspeed-hq]

Merging this PR will improve performance by 2.37%

⚡ 1 improved benchmark
✅ 188 untouched benchmarks
⏩ 120 skipped benchmarks¹

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Simulation	es/oxc/benches/assets/UserSettings.tsx/sourceMap=true/reactDev=false	1.2 ms	1.2 ms	+2.37%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing kdy1/ignore-memmap2-advisory (57d0037) with main (885d3e2)}

Footnotes

1. 120 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩