From f546e10a81c48c5c01c24b86bb6aa9fc5ef8c8e9 Mon Sep 17 00:00:00 2001
From: Daniel Norman <daniel@norman.life>
Date: Fri, 6 Nov 2026 11:40:42 +0530
Subject: [PATCH] explorer: Ignore crypto-bigint advisory

- Ignore RUSTSEC-2026-0387 in audit config
- Record that radicle uses Ed25519 only, so p256 is never used
---
 explorer/.cargo/audit.toml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/explorer/.cargo/audit.toml b/explorer/.cargo/audit.toml
index fcddadc0a..152ac5655 100644
--- a/explorer/.cargo/audit.toml
+++ b/explorer/.cargo/audit.toml
@@ -7,4 +7,9 @@ ignore = [
   # compiled for any target we build. postcard 1.x pins heapless ^0.7, so this
   # can only be resolved upstream.
   "RUSTSEC-2023-0089",
+  # crypto-bigint 0.5 reaches the lockfile through radicle-crypto ->
+  # ssh-agent-lib -> ssh-key -> p256. Radicle uses Ed25519 only, so the p256
+  # code path is never entered. The fix is in 0.7, but p256 pins crypto-bigint
+  # ^0.5, so a lockfile update cannot apply it.
+  "RUSTSEC-2026-0387",
 ]