osv-scanner.toml
# OSV-Scanner triage for the Cargo.lock beside this file (read by the OpenSSF Scorecard's
# Vulnerabilities check). Every id here is also triaged in the root deny.toml with its date;
# xtask/tests/osv_triage.rs keeps the two lists equal. ignoreUntil forces the next look.
[[IgnoredVulns]]
id = "RUSTSEC-2026-0387"
ignoreUntil = 2027-01-31
reason = "crypto-bigint 0.5.5 via elliptic-curve 0.13 (p256/p384/p521 for ssh-key 0.6, nornir-auth-webauthn, znippy-common): no 0.5 fix. monetize only verifies with these curves (public keys, public signatures); its one P-256 signing is a fixed test key in monetize-ui-server's tests. Triaged 2026-10-28 (deny.toml), re-checked 2026-10-31 (MON-OSSF); re-check at ssh-key 0.7."
[[IgnoredVulns]]
id = "RUSTSEC-2024-0436"
ignoreUntil = 2027-01-31
reason = "paste 1.0.15 is unmaintained (no vulnerability): a compile-time proc-macro of leptos 0.8 (monetize-ui-web); links into no binary. No maintained release. Triaged 2026-10-28, re-checked 2026-10-31 (MON-OSSF); re-check at every leptos bump."
[[IgnoredVulns]]
id = "RUSTSEC-2026-0173"
ignoreUntil = 2027-01-31
reason = "proc-macro-error2 2.0.1 is unmaintained (no vulnerability): a compile-time proc-macro under leptos_macro (monetize-ui-web) and the i18n macros age needs (monetize-admin); links into no binary. No maintained release. Triaged 2026-10-28, re-checked 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa (Marvin timing side channel) has no fixed release: it enters through russh/ssh-key (nornir-git in xtask, monetize-fast, the build thing) and ssh-key's rsa support; monetize mints and signs with ed25519 keys only, so no attacker-observable path does an RSA private-key operation. Triaged 2026-10-28 (as Gunnar 2026-08-31), re-checked 2026-10-31 (MON-OSSF)."