deny.toml

[graph]
all-features = true

[advisories]
ignore = [
    # atty 0.2.14
    # Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0145
    # On windows, `atty` dereferences a potentially unaligned pointer.
    "RUSTSEC-2021-0145",

    # ed25519-dalek 1.0.1
    # Advisory: https://rustsec.org/advisories/RUSTSEC-2022-0093
    # Versions of `ed25519-dalek` prior to v2.0 model private and public keys as
    # separate types which can be assembled into a `Keypair`, and also provide APIs
    # for serializing and deserializing 64-byte private/public keypairs.
    "RUSTSEC-2022-0093",

    # borsh 0.9.3
    # Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0033
    # Affected versions of borsh cause undefined behavior when zero-sized-types (ZST)
    # are parsed and the Copy/Clone traits are not implemented/derived.
    # For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy
    # (this can be achieved through a singleton), then accessing/writing to deserialized
    # data will cause a segmentation fault.
    # borsh 0.10.3
    # Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0033
    # Affected versions of borsh cause undefined behavior when zero-sized-types (ZST)
    # are parsed and the Copy/Clone traits are not implemented/derived.
    # For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy
    # (this can be achieved through a singleton), then accessing/writing to deserialized
    # data will cause a segmentation fault.
    "RUSTSEC-2023-0033",

    # curve25519-dalek 3.2.1
    # Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0344
    # Timing variability of any kind is problematic when working with  potentially secret values such as
    # elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a
    # problem was recently discovered in `curve25519-dalek`.
    "RUSTSEC-2024-0344",

    # proc-macro-error 1.0.4
    # proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.
    "RUSTSEC-2024-0370",

    # atty 0.2.14
    # The maintainer of `atty` has [published](https://github.com/softprops/atty/commit/5bfdbe9e48c6ca6a4909e8d5b04f5e843a257e93) an official notice that the crate is no longer under development, and that users should instead rely on the functionality in the standard library's [`IsTerminal`](https://doc.rust-lang.org/std/io/trait.IsTerminal.html) trait.
    "RUSTSEC-2024-0375",
]