Suppress audit caused by unused litep2p

autonomys · Jun 21, 2024 · 1dca8e0 · 1dca8e0
1 parent 15fcfee
commit 1dca8e0
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/rustsec-audit.yml b/.github/workflows/rustsec-audit.yml
@@ -20,6 +20,8 @@ jobs:
       - uses: rustsec/audit-check@dd51754d4e59da7395a4cd9b593f0ff2d61a9b95 #v1.4.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          # TODO: Remove once Substrate upgrades libp2p and we no longer have rustls 0.20.9 and curve25519-dalek 3.2.0
+          # TODO: Remove first two Substrate upgrades libp2p and we no longer have rustls 0.20.9 and curve25519-dalek 3.2.0
           #  in our dependencies: https://github.com/paritytech/polkadot-sdk/pull/1631
-          ignore: RUSTSEC-2024-0336,RUSTSEC-2024-0344
+          # TODO: Remove third once https://github.com/paritytech/polkadot-sdk/pull/4799 is used to remove old and
+          #  vulnerable ed25519-dalek (we are not using litep2p anyway)
+          ignore: RUSTSEC-2024-0336,RUSTSEC-2024-0344,RUSTSEC-2022-0093