# cargo-audit configuration.
#
# Mirrors the `[advisories].ignore` list in `deny.toml`. Keep these in sync:
# `cargo audit` and `cargo deny check advisories` consult different config
# files but should accept the same set of advisories.
#
# When you add or remove an entry here, do the same in `deny.toml` and add a
# comment explaining the blocker (upstream issue, expected fix version, etc).

[advisories]
ignore = [
    # rsa 0.9.x: Marvin Attack (RUSTSEC-2023-0071). No fixed upstream release.
    # Transitive via sigstore (openidconnect) and oci-client (jsonwebtoken).
    "RUSTSEC-2023-0071",

    # rustls-webpki 0.101.7 via aws-smithy-http-client -> hyper-rustls 0.24 ->
    # rustls 0.21. Waiting on AWS SDK to bump its rustls stack.
    "RUSTSEC-2026-0098",
    "RUSTSEC-2026-0099",
    "RUSTSEC-2026-0104",

    # wasmtime 41.0.4, pinned by extism 1.21. Waiting on an extism release
    # that picks up wasmtime >=42.0.2 / >=43.0.1 / >=44.0.1.
    "RUSTSEC-2026-0085",
    "RUSTSEC-2026-0086",
    "RUSTSEC-2026-0087",
    "RUSTSEC-2026-0088",
    "RUSTSEC-2026-0089",
    "RUSTSEC-2026-0091",
    "RUSTSEC-2026-0092",
    "RUSTSEC-2026-0093",
    "RUSTSEC-2026-0094",
    "RUSTSEC-2026-0095",
    "RUSTSEC-2026-0096",
    "RUSTSEC-2026-0114",
]
