ci: acknowledge transitive serde_cbor advisory

This commit is contained in:
ruv 2026-08-12 19:49:25 -04:00
parent 2ea37b7195
commit fa8845f848

View file

@ -28,6 +28,7 @@ ignore = [
# and revisit when the parent dep migrates.
"RUSTSEC-2021-0140", # rusttype — transitive via plotters; pure rendering, no untrusted input
"RUSTSEC-2021-0127", # serde_cbor — unmaintained transitive dependency of pgrx; no maintained version satisfies pgrx
"RUSTSEC-2022-0054", # wee_alloc — transitive via wasm-bindgen-cli internals
"RUSTSEC-2024-0370", # proc-macro-error — build-time only (proc-macro), no runtime exposure
"RUSTSEC-2024-0380", # pqcrypto-dilithium — replaced by pqcrypto-mldsa, awaiting parent migration