# Configuration for `cargo audit`. Run via `just audit`.
#
# Two advisories are explicitly ignored — both are transitive
# dependencies with no available fix, and we re-evaluate them when
# upstream publishes a release that addresses them.

[advisories]
ignore = [
  # RUSTSEC-2023-0071 — rsa 0.9.x Marvin timing sidechannel
  # (medium 5.9). Comes in via kunobi-auth (ssh-key, openidconnect)
  # and surrealdb (jsonwebtoken). The upstream `rsa` crate has no
  # fixed release available; the audit report itself reads
  # "Solution: No fixed upgrade is available!". Re-evaluate when
  # `rsa >= 0.10` ships with a constant-time implementation.
  "RUSTSEC-2023-0071",

  # RUSTSEC-2023-0089 — atomic-polyfill unmaintained (warning,
  # not a CVE). Transitive via surrealdb → geo → rstar → heapless
  # 0.7. surrealdb is several upgrade hops away from heapless 0.8
  # (which drops this dep). Low risk; re-evaluate on surrealdb
  # major upgrades.
  "RUSTSEC-2023-0089",
]
