mirror of
https://github.com/zhom/donutbrowser.git
synced 2026-10-19 22:17:28 +02:00
51 lines
2.2 KiB
TOML
51 lines
2.2 KiB
TOML
# Advisories the scan may pass over, and why. This list is NOT a way to quiet a
|
|
# real finding: every entry here is a transitive crate this repository cannot
|
|
# move on its own, and every one carries a date at which it has to be looked at
|
|
# again. Anything actionable must be fixed, not listed.
|
|
#
|
|
# `ignoreUntil` is a deadline, not a dismissal: once it passes the advisory
|
|
# fails the scan again, which is the point. Re-check with
|
|
# docker run --rm -v "$PWD":/src -w /src ghcr.io/google/osv-scanner-action:v2.6.0 \
|
|
# --format=table -r --lockfile=pnpm-lock.yaml --lockfile=src-tauri/Cargo.lock ./
|
|
|
|
# Fixed in glib 0.20, which the GTK stack under Tauri does not use yet. Pulled
|
|
# in on Linux targets only, through tauri -> gtk -> glib, so it moves when Tauri
|
|
# moves and not before.
|
|
[[IgnoredVulns]]
|
|
id = "RUSTSEC-2024-0429"
|
|
reason = "Transitive through Tauri's GTK stack; no version of Tauri ships glib 0.20 yet."
|
|
ignoreUntil = 2026-12-31
|
|
|
|
# The rest are RUSTSEC unmaintained notices, not exploitable defects. None has a
|
|
# fixed version to move to, and all are transitive.
|
|
|
|
# paste <- utoipa-axum, and <- rav1e/pulp in the image decoding stack.
|
|
[[IgnoredVulns]]
|
|
id = "RUSTSEC-2024-0436"
|
|
reason = "Unmaintained crate, no fix published; transitive through utoipa-axum and the image codecs."
|
|
ignoreUntil = 2026-12-31
|
|
|
|
# proc-macro-error <- Linux-only build dependencies under Tauri.
|
|
[[IgnoredVulns]]
|
|
id = "RUSTSEC-2024-0370"
|
|
reason = "Unmaintained crate, no fix published; transitive build dependency on Linux targets."
|
|
ignoreUntil = 2026-12-31
|
|
|
|
# zvariant, zbus_names and zvariant_derive moved into zbus 6. zbus 5 comes in
|
|
# through tauri-plugin-opener, tauri-plugin-single-instance, tauri-plugin-notification
|
|
# (notify-rust) and secret-service, and none of them has a release on zbus 6 yet.
|
|
[[IgnoredVulns]]
|
|
id = "RUSTSEC-2026-0370"
|
|
reason = "zvariant merged into zbus 6; every crate that pulls in zbus still requires zbus 5."
|
|
ignoreUntil = 2026-12-31
|
|
|
|
[[IgnoredVulns]]
|
|
id = "RUSTSEC-2026-0371"
|
|
reason = "zbus_names merged into zbus 6; every crate that pulls in zbus still requires zbus 5."
|
|
ignoreUntil = 2026-12-31
|
|
|
|
[[IgnoredVulns]]
|
|
id = "RUSTSEC-2026-0372"
|
|
reason = "zvariant_derive merged into zbus 6; every crate that pulls in zbus still requires zbus 5."
|
|
ignoreUntil = 2026-12-31
|