# cargo-deny policy for monetize (lane OX-CVE, 2026-10-28): the same "0 known advisory" check
# gunnar's `cargo xtask cve` runs, `cargo deny --no-default-features check advisories`, on this
# repository's root Cargo.lock.
#
# Every `ignore` below is a triaged, dated decision with no fixed release to move to — NOT a
# blanket mute. A new advisory, or a fix arriving for one of these, fails the check by name
# (cargo-deny warns "advisory was not encountered" for an ignore that has gone stale: remove it).
[advisories]
version = 2
yanked = "deny"
ignore = [
# RUSTSEC-2026-0387 — crypto-bigint timing variability. Crate: crypto-bigint 0.5.5, fixed
# only in 0.7.6+. It enters through RustCrypto's elliptic-curve 0.13 line (p256/p384/p521
# 0.13 via ssh-key 0.6, nornir-auth-webauthn and znippy-common), which has no release on
# crypto-bigint 0.7. monetize VERIFIES with those curves (passkey assertions, SSH and
# sshsig signatures: public keys and public signatures, no secret integer); its only P-256
# signing is the soft authenticator in monetize-ui-server's tests, with a fixed test key.
# Re-check when ssh-key 0.7 / elliptic-curve 0.14 reach this tree.
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.5 via elliptic-curve 0.13 (p256/p384/p521 for ssh-key 0.6, webauthn, znippy-common): no 0.5 fix. monetize only verifies with these curves (public data); P-256 signing is test-only. Triaged 2026-10-28; re-check at ssh-key 0.7." },
# RUSTSEC-2024-0436 — paste is unmaintained (not a vulnerability). Crate: paste 1.0.15,
# no maintained release. A compile-time proc-macro of leptos (either_of, reactive_graph)
# for monetize-ui-web; links into no binary. Re-check at every leptos bump.
{ id = "RUSTSEC-2024-0436", reason = "paste 1.0.15 is unmaintained (no vulnerability): a compile-time proc-macro of leptos 0.8 (monetize-ui-web). Links into no binary. No maintained release. Triaged 2026-10-28; re-check at every leptos bump." },
# RUSTSEC-2026-0173 — proc-macro-error2 is unmaintained (not a vulnerability). Crate:
# proc-macro-error2 2.0.1, no maintained release. A compile-time proc-macro of syn_derive
# -> rstml -> leptos_macro / leptos_hot_reload (monetize-ui-web); links into no binary.
{ id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 2.0.1 is unmaintained (no vulnerability): a compile-time proc-macro under leptos_macro (rstml, syn_derive) for monetize-ui-web. Links into no binary. No maintained release. Triaged 2026-10-28; re-check at every leptos bump." },
# The two below are not in the root lock; they are in the DETACHED workspaces' locks
# (xtask, crates/monetize-fast, crates/monetize-build-thing, crates/monetize-admin), which
# cargo-deny checks with this same file when run in their directories.
#
# RUSTSEC-2023-0071 — Marvin timing side channel in rsa. No fixed version exists. rsa
# enters through russh's default `rsa` feature (nornir-git: the xtask tooling, the fast
# test, the build thing's git fetch) and ssh-key. monetize mints and signs with ed25519
# keys only; the side channel needs an attacker timing RSA private-key operations, and
# none of these paths performs one where anyone but the trusted far end could observe it
# (the same triage as gunnar's deny.toml, 2026-08-31).
{ id = "RUSTSEC-2023-0071", reason = "rsa has no fix: only via russh's default rsa feature (nornir-git: xtask, monetize-fast, the build thing) and ssh-key, in the detached workspaces. monetize's keys are ed25519; no RSA private-key op on an attacker-observable path. Triaged 2026-10-28 (as gunnar 2026-08-31)." },
# RUSTSEC-2026-0374 — basic-toml is unmaintained (not a vulnerability), no maintained
# release. Only in crates/monetize-admin's lock: a compile-time dependency of i18n-config
# 0.4.8 (the newest), read by the i18n proc-macros `age` 0.11.5 needs unconditionally. It
# parses the build's own i18n.toml and links into no binary (as gunnar's deny.toml).
{ id = "RUSTSEC-2026-0374", reason = "basic-toml 0.1.10 is unmaintained (no vulnerability): only a compile-time dependency of i18n-config 0.4.8 (newest) under age 0.11.5's i18n proc-macros (monetize-admin). Links into no binary. No maintained release. Triaged 2026-10-28; re-check at every age bump." },
]
[sources]
unknown-registry = "deny"
unknown-git = "allow"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]