crates/gunnar-front/osv-scanner.toml
# OSV-Scanner triage for the Cargo.lock beside this file (read by the OpenSSF Scorecard's
# Vulnerabilities check). Every id here is also triaged in the root deny.toml with its date;
# xtask/tests/osv_triage.rs keeps the two lists equal. ignoreUntil forces the next look.
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa (Marvin timing sidechannel), no fixed release: it enters through russh/ssh-key (and age's ssh-rsa recipients, nornir-auth-saml); Gunnar's SSH server host key is ed25519-only (gunnar-core mint_ed25519), so no network-facing path does an RSA private-key operation. Triaged 2026-08-31 (deny.toml), re-checked 2026-10-30 (OSSF-NEXT)."
[[IgnoredVulns]]
id = "RUSTSEC-2024-0320"
ignoreUntil = 2027-01-31
reason = "yaml-rust is unmaintained (no vulnerability): only through syntect (gunnar-ui-server's syntax highlighting, two-face, typst), which reads the build's own bundled syntax definitions, never YAML from a user or the network. No fix in syntect 5. Triaged 2026-10-30 (OSSF-NEXT); re-check at every syntect bump."
[[IgnoredVulns]]
id = "RUSTSEC-2024-0436"
ignoreUntil = 2027-01-31
reason = "paste is unmaintained (no vulnerability): a compile-time proc-macro of biblatex/hayagriva (typst-library, via nornir-docbook's renderer); links into no binary. Triaged 2026-10-30 (OSSF-NEXT); re-check at every typst bump."
[[IgnoredVulns]]
id = "RUSTSEC-2024-0449"
ignoreUntil = 2027-01-31
reason = "unsafe-libyaml is unmaintained (no vulnerability): only through serde_yaml in hayagriva/typst-library (bibliography files); nornir-docbook renders Markdown to typst with no bibliography, so no user YAML reaches it. Triaged 2026-10-30 (OSSF-NEXT); re-check at every typst bump."
[[IgnoredVulns]]
id = "RUSTSEC-2025-0141"
ignoreUntil = 2027-01-31
reason = "bincode 1 is unmaintained (no vulnerability): only through syntect, which decodes the build's own bundled syntax and theme dumps. No fix in syntect 5. Triaged 2026-10-30 (OSSF-NEXT); re-check at every syntect bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0192"
ignoreUntil = 2027-01-31
reason = "ttf-parser is unmaintained (no vulnerability): typst/krilla/usvg's font parser in nornir-docbook's renderer, which loads only the fonts bundled into the build. No maintained release. Triaged 2026-10-30 (OSSF-NEXT); re-check at every typst bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0194"
ignoreUntil = 2027-01-31
reason = "quick-xml 0.38 (quadratic duplicate-attribute check), fixed only in 0.41: it enters through citationberg 0.7.0 (newest, quick-xml ^0.38), typst's CSL style reader; nornir-docbook renders Markdown to typst with no bibliography, so no user XML reaches it (plist already takes 0.42). Triaged 2026-10-30 (OSSF-NEXT); re-check at every typst/citationberg bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0195"
ignoreUntil = 2027-01-31
reason = "quick-xml 0.38 (unbounded NsReader namespace allocation), fixed only in 0.41: through citationberg 0.7.0 (newest), typst's CSL style reader; nornir-docbook renders Markdown with no bibliography, so no user XML reaches it. Triaged 2026-10-30 (OSSF-NEXT); re-check at every typst/citationberg bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0206"
ignoreUntil = 2027-01-31
reason = "rustybuzz is unmaintained (no vulnerability): typst/krilla/usvg's text shaper in nornir-docbook's renderer, over the build's bundled fonts only. No maintained release. Triaged 2026-10-30 (OSSF-NEXT); re-check at every typst bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0387"
ignoreUntil = 2027-01-31
reason = "crypto-bigint 0.5 (timing variability), fixed only in 0.7.6: the 0.5 line enters through elliptic-curve 0.13 of ssh-key 0.6.7, which only monetize-shop-pairing (a sibling) takes; Gunnar's own SSH stack is on ssh-key 0.7 / crypto-bigint 0.7.10. The fix is monetize-shop-pairing moving to ssh-key 0.7. Triaged 2026-10-30 (OSSF-NEXT)."