chore: move specific CI audit rules into global .cargo/audit.toml

2026-05-04 14:22:26 +02:00
parent b6eec61677
commit 46e823ffda
4 changed files with 18 additions and 6 deletions
@@ -0,0 +1,15 @@
+[advisories]
+ignore = [
+    # paste unmaintained — transitive via azure_core 0.21.0 (latest available).
+    # No direct security impact; no upgrade path exists.
+    # keep warning "RUSTSEC-2024-0436",
+
+    # rand 0.7.3 unsound — transitive via http-types → azure_core 0.21.0.
+    # Only exploitable with a custom logger using rand::rng(); not applicable here.
+    "RUSTSEC-2026-0097",
+
+    # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
+    # Not affected: This application uses HS256 for internal JWT signing and only performs
+    # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
+    "RUSTSEC-2023-0071",
+]