# Rust dependencies with an open RUSTSEC/OSV advisory that are risk-accepted:
# one justified, <=90-day-expiring line per advisory.
#
# Format:  RUSTSEC-YYYY-NNNN expires=YYYY-MM-DD # justification (>=12 chars)
#
# `scripts/check_cargo_advisories.sh` (the pre-commit hook) enforces:
#   * every line here must have a matching `[advisories].ignore` entry in
#     `.config/deny.toml` (and vice versa) -- the two files may never drift apart;
#   * an expired line fails the gate even if still listed in .config/deny.toml --
#     remove the acceptance or renew it with a fresh expiry;
#   * a line accepted for more than 90 days out fails the gate -- this is a
#     periodic-review ledger, not a permanent waiver.
#
# Currently empty: `cargo deny check advisories` is clean against the present
# Cargo.lock (see the W0.12 gate-proof report). Add a line here -- AND the
# matching `[advisories].ignore` entry in .config/deny.toml -- only when a real
# advisory has no released fix and the risk is genuinely accepted.
