# cargo-audit configuration — triaged advisory posture for the MNW server.
#
# Every ignore below is a transitive advisory we cannot resolve by bumping our
# own direct deps, each with a rationale and (where relevant) the upstream we're
# waiting on. Directly-fixable advisories are NOT parked here — they get fixed in
# Cargo.toml/Cargo.lock (e.g. the ammonia mXSS RUSTSEC-2026-0193 was closed by
# bumping to 4.1.3, not ignored). Re-review this list on every dependency audit.

[advisories]
ignore = [
    # rsa — Marvin timing side-channel on RSA *decryption*. Pulled only by the
    # signature-*verification* crates (apple-codesign, authenticode, yara-x); we
    # never decrypt with rsa, so the decryption-oracle attack does not apply.
    "RUSTSEC-2023-0071",

    # The rustls-webpki 0.101 trio (RUSTSEC-2026-0098/0099/0104) and the git2 UB
    # pair (RUSTSEC-2026-0183/0184) were dropped on 2026-07-21: the EOL rustls
    # 0.21 stack left s3-storage in d7a50c5a and git2 has since been bumped, so
    # neither advisory is reachable. cargo-deny flags unreachable ignores as
    # `advisory-not-detected`; that is the signal to prune this list.

    # Unmaintained-crate warnings, all transitive (no direct dep, no code change
    # available to us). Tracked for when upstreams migrate off them.
    "RUSTSEC-2025-0141", # bincode (unmaintained) — via transitive tooling
    "RUSTSEC-2020-0095", # difference (unmaintained) — via a dev/test dep
    "RUSTSEC-2024-0436", # paste (unmaintained) — via proc-macro deps
    "RUSTSEC-2025-0134", # rustls-pemfile (unmaintained) — via AWS SDK TLS
    "RUSTSEC-2026-0173", # proc-macro-error2 (unmaintained) — via a macro dep
]