# cargo-audit configuration — accepted advisories (#310).
#
# Every ID listed here is suppressed on EVERY `cargo audit` run, including the
# daily blocking gate in .forgejo/workflows/audit.yml. So a green audit means
# "no advisory outside this list", not "no advisory at all". See
# docs/adr/0018-suppression-advisories-non-atteignables.md.
#
# Two rules govern the list:
#
#   1. An advisory may only be listed if its crate is absent from the
#      dependency graph of EVERY shipped target (Windows and Linux), or if no
#      fix has been published at all. A reachable advisory with an available
#      fix gets fixed, never suppressed.
#
#   2. Entries are keyed by advisory ID, never by crate. A new advisory filed
#      against a crate already listed here re-reds the gate on purpose — each
#      one is reviewed on its own merits. Widening an entry to a whole crate
#      would defeat the gate.
#
# check-rust.yml carries a guard that re-proves rule 1 on every PR touching
# src-tauri/ or this file. ADDING AN ENTRY HERE REQUIRES ADDING ITS CRATE TO
# THAT GUARD'S CRATE LIST — otherwise the new entry gets no anti-rot coverage.
#
# To re-verify an entry (or before removing one), run from the repo root:
#
#   cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-unknown-linux-gnu
#   cargo tree --manifest-path src-tauri/Cargo.toml -i <crate> --target x86_64-pc-windows-msvc
#
# Empty output on both targets means the entry is still justified. Any output
# means it is not: drop the entry and fix the advisory for real.

[advisories]
ignore = [
    # quick-xml 0.38.4 — RUSTSEC-2026-0194 (quadratic run time when checking a
    # start tag for duplicate attribute names) and RUSTSEC-2026-0195 (unbounded
    # namespace-declaration allocation enabling memory-exhaustion DoS), 7.5
    # high each.
    #
    # Not compiled on either shipped target. quick-xml is pulled by `plist`,
    # which tauri only depends on for Apple bundling: both per-target trees are
    # empty, and it appears solely under x86_64-apple-darwin, which we do not
    # ship.
    #
    # An override is not an option either — both advisories are patched only in
    # >= 0.41.0 while plist requires ^0.38, a semver-incompatible boundary that
    # `[patch.crates-io]` cannot cross.
    #
    # Removal trigger: plist (or tauri) shipping quick-xml >= 0.41.0 — see #312.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",

    # rsa 0.9.10 — RUSTSEC-2023-0071 (Marvin attack: potential key recovery
    # through timing side channels), 5.9 medium.
    #
    # Qualifies under both halves of rule 1. It has no fix at all — the
    # advisory's patched list is empty, which is why suppression is the only
    # option available. And it is unreachable: its sole parent in the lockfile
    # is sqlx-mysql, an artifact of sqlx's multi-backend graph, while this
    # project talks to SQLite through tauri-plugin-sql. `cargo tree -i rsa
    # --target all` returns nothing at all.
    #
    # Removal trigger: a fixed rsa release, or sqlx dropping the crate from the
    # graph.
    "RUSTSEC-2023-0071",
]