osv-scanner.toml
# OSV-Scanner triage for the Cargo.lock beside this file (read by the OpenSSF Scorecard's
# Vulnerabilities check). Every id here is also triaged in the root deny.toml with its date;
# xtask/tests/osv_triage.rs keeps the two lists equal. ignoreUntil forces the next look.
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa (Marvin timing sidechannel), no fixed release: it enters through russh/ssh-key (and age's ssh-rsa recipients, nornir-auth-saml); Gunnar's SSH server host key is ed25519-only (gunnar-core mint_ed25519), so no network-facing path does an RSA private-key operation. Triaged 2026-08-31 (deny.toml), re-checked 2026-10-30 (OSSF-NEXT)."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0173"
ignoreUntil = 2027-01-31
reason = "proc-macro-error2 is unmaintained (no vulnerability): a compile-time proc-macro of i18n-embed-fl, which age 0.11.5 needs unconditionally (gunnar-crypt); links into no binary. No maintained release. Triaged 2026-10-06; re-check at every age bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0370"
ignoreUntil = 2027-01-31
reason = "zvariant is unmaintained (no vulnerability): zbus 5's D-Bus types, only in gunnar-cli's optional skidbladnir (installer) feature, which talks to the local system bus and never to the network. No maintained release of zbus 5; the fix is upstream. Triaged 2026-10-30 (OSSF-NEXT); re-check at every skidbladnir bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0371"
ignoreUntil = 2027-01-31
reason = "zbus_names is unmaintained (no vulnerability): zbus 5's D-Bus names, only in gunnar-cli's optional skidbladnir (installer) feature, local system bus only. No maintained release; the fix is upstream. Triaged 2026-10-30 (OSSF-NEXT); re-check at every skidbladnir bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0372"
ignoreUntil = 2027-01-31
reason = "zvariant_derive is unmaintained (no vulnerability): a compile-time proc-macro of zbus 5, only in gunnar-cli's optional skidbladnir (installer) feature; links into no binary. Triaged 2026-10-30 (OSSF-NEXT); re-check at every skidbladnir bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0374"
ignoreUntil = 2027-01-31
reason = "basic-toml is unmaintained (no vulnerability): only a compile-time dependency of i18n-config 0.4.8 (newest), read by the proc-macros age 0.11.5 needs (gunnar-crypt); parses the build's own i18n.toml, links into no binary. Triaged 2026-10-28; re-check at every age bump."