# osv-scanner triage for the lockfiles CI scans (pubspec.lock files and the four
# Cargo.lock files, see the "Supply Chain" job in .github/workflows/ci.yml).
#
# The RUSTSEC ids mirror the ignores in rust/deny.toml, where each reason is
# written out in full; change both together. An id goes here only when no
# compatible bump fixes it and one sentence says why it cannot reach a user.

[[IgnoredVulns]]
id = "GHSA-h668-6x6g-f8r5"
reason = "tract-onnx 0.19 path traversal through an ONNX external_data location, via deep_filter: hollow_dfn loads only the DeepFilterNet3 model embedded in the binary (&'static bytes), which has no external data. Fixed in tract 0.21.17+, which deep_filter v0.5.6 cannot take."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0217"
reason = "tract-nnef tensor parse overflow, via deep_filter: only our embedded model is ever parsed. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0186"
reason = "memmap2 0.5 advise_range/flush_range, via tract-onnx: those functions are never called. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2023-0071"
reason = "rsa Marvin timing attack, via blind-rsa-signatures: no private-key operation runs on a user's machine. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0253"
reason = "lru 0.7 pop() panic safety, via reed-solomon-erasure: no key or value Drop can panic. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0384"
reason = "instant unmaintained, via reed-solomon-erasure: std::time on native targets. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0436"
reason = "paste unmaintained: build-time proc macro. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0173"
reason = "proc-macro-error2 unmaintained: build-time only, under libcrux. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0319"
reason = "anymap2 unmaintained: a build-dependency of tract-linalg's build script. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0330"
reason = "libcrux-kem 0.0.9 hybrid KEM panics on short input, via hpke-rs-libcrux: locked only as hpke-rs's optional libcrux backend, which openmls_rust_crypto never enables, so it is never compiled (cargo deny's feature-resolved graph has no such crate, hence no rust/deny.toml mirror). The fix needs hpke-rs 0.8, which openmls_rust_crypto 0.6 cannot take."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0331"
reason = "libcrux-kem 0.0.9 hybrid KEM panics on short input, via hpke-rs-libcrux: locked only as hpke-rs's optional libcrux backend, which openmls_rust_crypto never enables, so it is never compiled (cargo deny's feature-resolved graph has no such crate, hence no rust/deny.toml mirror). The fix needs hpke-rs 0.8, which openmls_rust_crypto 0.6 cannot take."

[[PackageOverrides]]
name = "webpki-roots"
version = "0.26.11"
ecosystem = "crates.io"
vulnerability.ignore = true
reason = "RUSTSEC-2026-0381: a shim with no certificates of its own that re-exports webpki-roots 1.x, locked at 1.0.10 (patched). Scoped to this version so a 1.x below 1.0.10 still fails. See rust/deny.toml."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0387"
reason = "crypto-bigint 0.5.5 timing branches via elliptic-curve 0.13 (openmls, hpke-rs): no patched 0.5 release; P-256 secrets are scalar-multiplied by p256's own arithmetic on the device. 0.7 is patched. See rust/deny.toml."