| 1 |
# cargo-audit configuration — triaged advisory posture for the MNW server. |
| 2 |
# |
| 3 |
# Every ignore below is a transitive advisory we cannot resolve by bumping our |
| 4 |
# own direct deps, each with a rationale and (where relevant) the upstream we're |
| 5 |
# waiting on. Directly-fixable advisories are NOT parked here — they get fixed in |
| 6 |
# Cargo.toml/Cargo.lock (e.g. the ammonia mXSS RUSTSEC-2026-0193 was closed by |
| 7 |
# bumping to 4.1.3, not ignored). Re-review this list on every dependency audit. |
| 8 |
|
| 9 |
[advisories] |
| 10 |
ignore = [ |
| 11 |
# rsa — Marvin timing side-channel on RSA *decryption*. Pulled only by the |
| 12 |
# signature-*verification* crates (apple-codesign, authenticode, yara-x); we |
| 13 |
# never decrypt with rsa, so the decryption-oracle attack does not apply. |
| 14 |
"RUSTSEC-2023-0071", |
| 15 |
|
| 16 |
# The rustls-webpki 0.101 trio (RUSTSEC-2026-0098/0099/0104) and the git2 UB |
| 17 |
# pair (RUSTSEC-2026-0183/0184) were dropped on 2026-07-21: the EOL rustls |
| 18 |
# 0.21 stack left s3-storage in d7a50c5a and git2 has since been bumped, so |
| 19 |
# neither advisory is reachable. cargo-deny flags unreachable ignores as |
| 20 |
# `advisory-not-detected`; that is the signal to prune this list. |
| 21 |
|
| 22 |
# Unmaintained-crate warnings, all transitive (no direct dep, no code change |
| 23 |
# available to us). Tracked for when upstreams migrate off them. |
| 24 |
"RUSTSEC-2025-0141", # bincode (unmaintained) — via transitive tooling |
| 25 |
"RUSTSEC-2020-0095", # difference (unmaintained) — via a dev/test dep |
| 26 |
"RUSTSEC-2024-0436", # paste (unmaintained) — via proc-macro deps |
| 27 |
"RUSTSEC-2025-0134", # rustls-pemfile (unmaintained) — via AWS SDK TLS |
| 28 |
"RUSTSEC-2026-0173", # proc-macro-error2 (unmaintained) — via a macro dep |
| 29 |
] |
| 30 |
|