installtest/osv-scanner.toml
# OSV-Scanner triage for the Cargo.lock beside this file (read by the OpenSSF Scorecard's
# Vulnerabilities check). Every id here is also triaged in the root deny.toml with its date;
# xtask/tests/osv_triage.rs keeps the two lists equal. ignoreUntil forces the next look.
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa (Marvin timing sidechannel), no fixed release: it enters through russh/ssh-key (and age's ssh-rsa recipients, nornir-auth-saml); Gunnar's SSH server host key is ed25519-only (gunnar-core mint_ed25519), so no network-facing path does an RSA private-key operation. Triaged 2026-08-31 (deny.toml), re-checked 2026-10-30 (OSSF-NEXT)."