v2.0: ignore tonic audit report (#3051)

* fix audit * add more comment
anza-xyz · Oct 2, 2024 · 4cc7b90 · 4cc7b90
1 parent 1715788
commit 4cc7b90
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/ci/do-audit.sh b/ci/do-audit.sh
@@ -33,6 +33,12 @@ cargo_audit_ignores=(
 
   # curve25519-dalek
   --ignore RUSTSEC-2024-0344
+
+  # tonic
+  # When using tonic::transport::Server there is a remote DoS attack that can cause
+  # the server to exit cleanly on accepting a tcp/tls stream.
+  # Ignoring because we do not use this functionality.
+  --ignore RUSTSEC-2024-0376
 )
 scripts/cargo-for-all-lock-files.sh audit "${cargo_audit_ignores[@]}" | $dep_tree_filter
 # we want the `cargo audit` exit code, not `$dep_tree_filter`'s