# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

[advisories]
ignore = [
  # rsa
  # Marvin Attack: potential key recovery through timing sidechannels
  # Issues: https://github.com/apache/iceberg-rust/issues/221
  "RUSTSEC-2023-0071",
  # `derivative` is unmaintained; consider using an alternative
  #
  # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
  "RUSTSEC-2024-0388",
  # `paste` is unmaintained; consider using an alternative
  #
  # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
  "RUSTSEC-2024-0436",
  # `rustls-pemfile` is unmaintained
  #
  # Introduced by object_store, see https://github.com/apache/arrow-rs-object-store/issues/564
  "RUSTSEC-2025-0134",
  # `rand` unsoundness with custom logger using `rand::rng()`
  #
  # Direct dependency upgraded to 0.9.3+. Transitive rand 0.8.5 remains
  # from reqsign/sqllogictest/rustc-hash — no 0.8.x patch exists.
  "RUSTSEC-2026-0097",
]
