add CardIO to the whitelist.

Versions 3.2.x and 3.3.x don't have versions tagged and must rely on commit hashes.