[advisories]
ignore = [
    # paste unmaintained — transitive via azure_core 0.21.0 (latest available).
    # No direct security impact; no upgrade path exists.
    # keep warning "RUSTSEC-2024-0436",

    # rand 0.7.3 unsound — transitive via http-types → azure_core 0.21.0.
    # Only exploitable with a custom logger using rand::rng(); not applicable here.
    "RUSTSEC-2026-0097",

    # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
    # Not affected: This application uses HS256 for internal JWT signing and only performs
    # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
    "RUSTSEC-2023-0071",

    # rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12.
    # aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available.
    # Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure.
    #   RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed).
    #   RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance).
    #   RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance).
    "RUSTSEC-2026-0104",
    "RUSTSEC-2026-0098",
    "RUSTSEC-2026-0099",

    # instant unmaintained — transitive via azure_core 0.21.0 (latest available).
    # No direct security impact; no upgrade path exists.
    "RUSTSEC-2024-0384",

    # quick-xml 0.31.0 — transitive via azure_core 0.21.0 (unofficial SDK,
    # now archived). Our direct dep is already on 0.41.0; the 0.31 copy is
    # only reachable through the azure_storage_blobs chain, which parses
    # XML responses received from Azure Storage over TLS. Neither CVE is
    # exploitable without attacker-controlled XML, so the vector requires
    # MitM of the TLS channel to Azure (or a compromised storage
    # endpoint). Real fix is migrating to the official azure_core 1.0 /
    # azure_storage_blob 1.0 SDK — tracked separately.
    #   RUSTSEC-2026-0195: unbounded ns-declaration allocation → mem-DoS
    #   RUSTSEC-2026-0194: quadratic dup-attribute check → CPU-DoS
    "RUSTSEC-2026-0195",
    "RUSTSEC-2026-0194",
]