dependabot[bot]
53712be6ca
Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Douwe Osinga <douwe@squareup.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Douwe Osinga <douwe@squareup.com>
15 lines
511 B
TOML
15 lines
511 B
TOML
[advisories]
|
|
|
|
# Deny yanked crates to catch supply chain issues early.
|
|
yanked = "deny"
|
|
# Emulate cargo-audit which only checks vulnerabilities and yanked crates, not unmaintained/unsound.
|
|
unmaintained = "none"
|
|
unsound = "none"
|
|
|
|
# Ignore proc-macro-error unmaintained warning
|
|
# See: https://github.com/block/goose/issues/7008
|
|
ignore = [
|
|
"RUSTSEC-2024-0370", # proc-macro-error is unmaintained
|
|
"RUSTSEC-2023-0071", # rsa: Marvin Attack timing sidechannel (no safe upgrade available, via jsonwebtoken)
|
|
]
|