kingchenc
eb50ae4e90
rust-numpy 0.29 lifted its pyo3 ^0.28 pin, so the resolver can now select pyo3 0.29. Bump both (kept as a pair) and drop the temporary not-affected exceptions for RUSTSEC-2026-0176 and RUSTSEC-2026-0177 from deny.toml and osv-scanner.toml — pyo3 0.29 fixes both advisories. No public API change; the Python test suite passes unchanged (957 tests).
14 lines
853 B
TOML
14 lines
853 B
TOML
# OSV-Scanner suppressions (VEX record). Consumed by the OpenSSF Scorecard
|
|
# Vulnerabilities check, which runs OSV-Scanner over this repository. Each entry
|
|
# is an advisory assessed as not affecting Wickra; this mirrors the cargo-deny
|
|
# `ignore` list in deny.toml at the OSV layer. See the "Vulnerability
|
|
# exploitability (VEX)" section of SECURITY.md.
|
|
|
|
# jackson-core 3.x async-parser DoS — tools.jackson.core:jackson-core 3.x is not
|
|
# a dependency of this project. No manifest, Maven plugin, or the GitHub
|
|
# dependency-graph SBOM references jackson 3.x; the only jackson present is
|
|
# com.fasterxml.jackson.core:jackson-databind 2.17.1 (examples only). Not affected.
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-72hv-8253-57qq"
|
|
reason = "tools.jackson.core:jackson-core 3.x is not a dependency of this project; only jackson-databind 2.17.1 is present. Not affected."
|