| 123456789101112 |
- # `cargo audit` policy (task 42). Mirrors the `deny.toml` triage.
- # RUSTSEC-2023-0071 (rsa Marvin timing): no patched release exists upstream
- # ("No safe upgrade is available"); this crate uses RSA for signature
- # verification only (JWK-selected `DecodingKey`), never RSA decryption, so
- # the padding-timing oracle does not apply. Re-evaluate when rsa ships a fix.
- # RUSTSEC-2026-0387 (crypto-bigint timing): patched only in crypto-bigint
- # >=0.7.6, which needs p256 0.14 via the still-unmerged jsonwebtoken bump
- # (Keats/jsonwebtoken#536); this is a real exposure on the ES256 signing path
- # (`src/jose/jwt_access.rs`), so drop the ignore as soon as jsonwebtoken
- # releases a p256 0.14 build rather than leaving it in place indefinitely.
- [advisories]
- ignore = ["RUSTSEC-2023-0071", "RUSTSEC-2026-0387"]
|
