Clear the dependency audit (Closes #432)

deny.toml

@@ -124,22 +124,23 @@ ignore = [
   # device's public key, and a public key has nothing to leak. No `rsa` release
   # carries a fix yet. Re-read when webauthn-rs 0.6 ships stable.
   { id = "RUSTSEC-2023-0071", reason = "rsa Marvin timing leak of a private key; Kamosu only verifies passkey signatures with public keys, and holds no RSA private key" },
+
+  # The same path and the same reasoning, for elliptic-curve passkeys (#432):
+  # webauthn-rs -> crypto-glue -> elliptic-curve 0.13 -> crypto-bigint 0.5.
+  # Some of crypto-bigint's arithmetic can take longer for some numbers than
+  # others, which leaks those numbers when they are secret, a private key
+  # above all. Checking an ES256 signature works only on public numbers: the
+  # signature, the device's public key and the hash of what was signed. The
+  # passkey crates call no signing and hold no private key outside their own
+  # tests. The fix is crypto-bigint 0.7.6, and no 0.5 release takes it, so it
+  # waits for webauthn-rs to move to elliptic-curve 0.14. The test-only copy
+  # under p256 0.14 is on 0.7.6 already, and this id covers both, so re-read
+  # it whenever crypto-bigint appears anywhere new, and when webauthn-rs moves.
+  { id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5 timing leak of secret integers, via webauthn-rs -> crypto-glue -> elliptic-curve 0.13; Kamosu only verifies passkey signatures with public keys, and no 0.5 release carries the fix" },
 ]
 
 # The interface's tree has no file of its own for this, so what `npm audit`
 # reports and Kamosu lives with is written here too.
 #
-# GHSA-vfj7-8cjw-p6xm, `braces` (high): a deeply nested brace pattern overflows
-# the stack. It arrives as @tailwindcss/cli -> @parcel/watcher -> micromatch ->
-# braces. That is the file watcher of the Tailwind command-line tool, which
-# `just css` and the build run on a developer's machine. None of it is in the
-# built interface, so none of it is in the binary or the image. The patterns it
-# is given are the paths Kamosu's own stylesheet names. braces 3.0.3 is its
-# newest release and carries no fix. @parcel/watcher 2.6.0 no longer uses
-# micromatch, but @tailwindcss/cli pins 2.5.1 exactly, in 4.3.3, its newest.
-# npm's remedy is a downgrade of the Tailwind tool to 4.3.0, which is not a
-# fix. `just audit` goes on failing on this one line until Tailwind moves its
-# pin: read when it does.
-#
 # GHSA-pxg6-pf52-xh8x, `cookie` (low): SvelteKit's server-side cookie parser,
 # which Kamosu never runs. The justfile says why beside `npm audit`.

ui/npm-audit-exceptions.json

@@ -1,9 +1,4 @@
 {
 	"about": "npm advisories read and judged not to apply to Kamosu, each with its reason: deny.toml's ignore list for the interface's tree, read by tools/npm-audit.mjs when `just audit` runs. An id belongs here only when the advisory has been read and the real fix tried first, never to quiet a build. Re-read an entry whenever the package it names moves.",
-	"ignore": [
-		{
-			"id": "GHSA-vfj7-8cjw-p6xm",
-			"reason": "a nested brace pattern can overflow the stack, and no patched braces exists. It arrives as @tailwindcss/cli -> @parcel/watcher -> micromatch -> braces, and the CLI loads that watcher only for --watch, which Kamosu never passes: `just css` builds once. Even watching, the patterns are the @source lines in src/app.css, written here. Nothing that ships holds it, and nothing a stranger sends reaches it. npm's remedy is @tailwindcss/cli 4.3.0, a downgrade. Re-read when @tailwindcss/cli or @parcel/watcher moves, or braces publishes a fix."
-		}
-	]
+	"ignore": []
 }