xtask/osv-scanner.toml
# OSV-Scanner triage for the Cargo.lock beside this file (read by the OpenSSF Scorecard's
# Vulnerabilities check). Every id here is also triaged in the root deny.toml with its date;
# xtask/tests/osv_triage.rs keeps the two lists equal. ignoreUntil forces the next look.
[[IgnoredVulns]]
id = "GHSA-q54r-jf2p-rfr2"
ignoreUntil = 2027-01-31
reason = "gix 0.88.0 (fixed in 0.90): only under nornir-git 0.2.1 from crates.io in the tooling workspaces xtask and monetize-fast, never in a monetize binary (the build thing follows edda's nornir-git on gix 0.90 since GIX-090). The advisory lets an untrusted .git/config switch off the protectHFS/protectNTFS path checks, which guard case-insensitive macOS/Windows checkouts; the tooling clones monetize's own repositories from git.gunnar.rs onto Linux filesystems. Gone with the next nornir-git publish and a lock follow (GIX-090 / SSH-PUBLISH). Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
ignoreUntil = 2027-01-31
reason = "rsa (Marvin timing side channel) has no fixed release: it enters through russh/ssh-key (nornir-git in xtask, monetize-fast, the build thing) and ssh-key's rsa support; monetize mints and signs with ed25519 keys only, so no attacker-observable path does an RSA private-key operation. Triaged 2026-10-28 (as Gunnar 2026-08-31), re-checked 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-4p9f-7p9m-5vfg"
ignoreUntil = 2027-01-31
reason = "russh's CLIENT allocates without bound on a server's EXT_INFO (fixed in russh 0.65): the client is nornir-git's, in the tooling workspaces only (xtask, monetize-fast, the build thing), and it dials only the forge's own git servers (git.gunnar.rs and dwarf's mirror); the worst case is a memory exhaustion of a tooling process by our own server. No monetize binary links russh. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-4wc5-f2rc-q74m"
ignoreUntil = 2027-01-31
reason = "russh 0.63.3 (fixed in 0.64.1) only under nornir-git 0.2.1 (xtask, monetize-fast): the advisory is the agent-protocol server; nornir-git runs only the agent client. Gone with the nornir-git 0.2.3 publish (SSH-PUBLISH) and a lock follow. Triaged 2026-10-31 (MON-OSSF, as Gunnar 2026-10-30)."
[[IgnoredVulns]]
id = "GHSA-9wfm-jcj8-jfv9"
ignoreUntil = 2027-01-31
reason = "russh's agent SERVER allocates without bound on repeated confirm constraints (fixed in russh 0.65): nornir-git runs only the agent client; no russh agent server runs in monetize or its tooling. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-fw5c-8223-6h42"
ignoreUntil = 2027-01-31
reason = "russh: a peer's zero maximum packet size stalls channel writes (fixed in russh 0.65): only nornir-git's client in the tooling workspaces, which talks to the forge's own git servers; the worst case is a hung tooling push. No monetize binary links russh. Re-check when nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."
[[IgnoredVulns]]
id = "GHSA-j7h2-66j4-ghjf"
ignoreUntil = 2027-01-31
reason = "russh 0.63.3 (fixed in 0.64.0) only under nornir-git 0.2.1 from crates.io (xtask, monetize-fast), which uses russh::client and the agent client only; the advisory is a server-side publickey check. Gone with the nornir-git 0.2.3 publish (SSH-PUBLISH) and a lock follow. Triaged 2026-10-31 (MON-OSSF, as Gunnar 2026-10-30)."
[[IgnoredVulns]]
id = "GHSA-vp5q-ff62-jwqv"
ignoreUntil = 2027-01-31
reason = "russh's agent SERVER never calls Agent::confirm (fixed in russh 0.65): russh is only under nornir-git (xtask, monetize-fast, the build thing), which runs the agent CLIENT against the developer's own ssh-agent; no russh agent server runs anywhere in monetize. Re-check when edda's nornir-git moves to russh 0.65. Triaged 2026-10-31 (MON-OSSF)."