From 20f9d15b46b6e3857ced2ade6a19b1ac003dbce4 Mon Sep 17 00:00:00 2001 From: Chili Palmer Date: Sun, 9 Aug 2026 17:58:30 +0200 Subject: [PATCH] Temporarily ignore unavoidable OSV advisories. --- osv-scanner.toml | 87 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 osv-scanner.toml diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..d516294 --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,87 @@ +# Temporary exceptions for advisories without a deployable upgrade path. +# They expire together so the weekly audit forces a fresh upstream review. + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0413" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0416" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0412" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0418" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0417" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0414" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0429" +ignoreUntil = 2026-11-09 +reason = "glib 0.20 cannot be selected independently while current muda and wry releases require GTK3 0.18." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0415" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0420" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0419" +ignoreUntil = 2026-11-09 +reason = "Current muda and wry releases still depend on the unmaintained GTK3 stack on Linux." + +[[IgnoredVulns]] +id = "RUSTSEC-2025-0141" +ignoreUntil = 2026-11-09 +reason = "Current syntect still depends on bincode 1, for which no patched release is available." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0370" +ignoreUntil = 2026-11-09 +reason = "Current GTK3 macros and pagefind dependencies still require proc-macro-error 1." + +[[IgnoredVulns]] +id = "RUSTSEC-2023-0071" +ignoreUntil = 2026-11-09 +reason = "Current russh and ssh-key require this rsa release and no patched release is available." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0436" +ignoreUntil = 2026-11-09 +reason = "Current graphics and ML dependencies still require paste and no patched release is available." + +[[IgnoredVulns]] +id = "RUSTSEC-2026-0206" +ignoreUntil = 2026-11-09 +reason = "Current iced and cosmic-text releases still require rustybuzz and no patched release is available." + +[[IgnoredVulns]] +id = "RUSTSEC-2026-0192" +ignoreUntil = 2026-11-09 +reason = "Current iced and cosmic-text releases still require ttf-parser and no patched release is available." + +[[IgnoredVulns]] +id = "RUSTSEC-2024-0320" +ignoreUntil = 2026-11-09 +reason = "Current syntect and pagefind dependencies still require yaml-rust and no patched release is available."