From fa8845f84873276eb7bbf3fd8b24f8d96b8b5436 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Wed, 12 Aug 2026 19:49:25 -0400
Subject: [PATCH] ci: acknowledge transitive serde_cbor advisory

---
 .cargo/audit.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 4e41b13671..b4c9e74276 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -28,6 +28,7 @@ ignore = [
     # and revisit when the parent dep migrates.
 
     "RUSTSEC-2021-0140",  # rusttype — transitive via plotters; pure rendering, no untrusted input
+    "RUSTSEC-2021-0127",  # serde_cbor — unmaintained transitive dependency of pgrx; no maintained version satisfies pgrx
     "RUSTSEC-2022-0054",  # wee_alloc — transitive via wasm-bindgen-cli internals
     "RUSTSEC-2024-0370",  # proc-macro-error — build-time only (proc-macro), no runtime exposure
     "RUSTSEC-2024-0380",  # pqcrypto-dilithium — replaced by pqcrypto-mldsa, awaiting parent migration