We use cargo-deny to check our dependencies for known issues (and license compliance, but that's less relevant here).

See deny.toml for 'ignored' advisories.