Repository navigation
Expand file tree
/
Copy pathdeny.toml
More file actions
93 lines (89 loc) · 3.67 KB
/
Copy pathdeny.toml
File metadata and controls
93 lines (89 loc) · 3.67 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
[advisories]
ignore = [
"RUSTSEC-2024-0014",
# heapless depends on atomic-polyfill 1.0.3, which is unmaintained.
"RUSTSEC-2023-0089",
# DOS in time parsing, N/A
"RUSTSEC-2026-0009",
# Deprecation notice of paste crate
"RUSTSEC-2024-0436",
# Bitmaps unmaintained
"RUSTSEC-2026-0247",
# imbl-sized-chunks < 0.2.0 double-frees when an element's Drop panics
# mid-removal. Reached via nickel-lang-core -> nickel-lang-vector, which
# stores nickel values whose Drop impls only decrement a refcount. Fixed
# in 0.2.0, but nickel master still pins "0.1"; drop this ignore once a
# nickel rev carrying the 0.2 bump is pinned in Cargo.toml.
"RUSTSEC-2026-0292",
# serde_yaml 0.9 (deprecated) -> unsafe-libyaml, unmaintained; reached via
# nickel-lang-core. Drop once nickel moves off serde_yaml.
"RUSTSEC-2024-0449",
]
[licenses]
unused-allowed-license = "deny"
allow = [
"0BSD",
"Apache-2.0 WITH LLVM-exception",
"Apache-2.0",
"BSD-2-Clause",
"BSD-3-Clause",
"CDLA-Permissive-2.0",
"ISC",
"MIT",
"MPL-2.0",
"Unicode-3.0",
"Zlib",
"bzip2-1.0.6",
]
# LGPL exceptions, documented in docs/internal/licensing.md:
# - hakoniwa: LGPL-3.0-only WITH LGPL-3.0-linking-exception — the linking
# exception permits static linking; Linux-only footprint (sandbox/minimald).
# - malachite family: LGPL-3.0-only, statically linked, pulled in via the
# nickel-lang-core git dependency; stance is document-and-accept (complete
# corresponding source is public and relinkable, satisfying LGPL-3.0 §4).
exceptions = [
{ allow = ["LGPL-3.0-only WITH LGPL-3.0-linking-exception"], crate = "hakoniwa" },
{ allow = ["LGPL-3.0-only"], crate = "malachite" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-base" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-float" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-nz" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-q" },
]
[licenses.private]
ignore = true
ignore-sources = ["https://buf.build/gen/cargo//"]
[bans]
skip = [
# nickel-lang-core -> pretty
# https://github.com/Marwes/pretty.rs/blob/bd138e503ee3f679b26c838c9f148fbdaf6d2b7c/Cargo.toml#L17
{ name = "arrayvec", version = "0.5.2" },
# nickel-lang-core -> codespan
{ name = "codespan-reporting", version = "0.12.0" },
# # oci-spec -> derive_builder
# https://github.com/colin-kiegel/rust-derive-builder/pull/349
{ name = "darling", version = "0.20.11" },
{ name = "darling_core", version = "0.20.11" },
{ name = "darling_macro", version = "0.20.11" },
{ name = "darling_macro", version = "0.20.11" },
# google-cloud-auth -> rustls -> ring
# https://github.com/briansmith/ring/issues/2341
{ name = "getrandom", version = "0.2.16" },
# nickel-lang-core -> saphyr-parser -> hashlink
# https://github.com/djc/hashlink/pull/38
{ name = "hashbrown", version = "0.15.5" },
# nickel-lang-core -> ouroboros -> ouroboros_macro
# https://github.com/someguynamedjosh/ouroboros/pull/127
{ name = "heck", version = "0.4.1" },
# nickel-lang-core -> malachite -> malachite-base
# https://github.com/tweag/nickel/pull/2367
{ name = "itertools", version = "0.11.0" },
# smoltcp -> heapless 0.9, beside postcard's 0.7
{ name = "heapless", version = "0.9.3" },
]
deny = [
# bitmaps is pinned below 3.2.0 in Cargo.lock because 3.2.x is affected by
# RUSTSEC-2025-0167 (unsound, no patched release). Remove together with
# the RUSTSEC-2026-0292 ignore once nickel moves to imbl-sized-chunks 0.2,
# which drops bitmaps.
{ crate = "bitmaps:>=3.2.0", reason = "RUSTSEC-2025-0167: keep bitmaps pinned below 3.2.0" },
]