Repository navigation
Expand file tree
/
Copy pathdeny.toml
More file actions
93 lines (89 loc) · 3.67 KB
/
Copy pathdeny.toml
File metadata and controls
93 lines (89 loc) · 3.67 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
A82A
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
[advisories]
ignore = [
"RUSTSEC-2024-0014",
# heapless depends on atomic-polyfill 1.0.3, which is unmaintained.
"RUSTSEC-2023-0089",
# DOS in time parsing, N/A
"RUSTSEC-2026-0009",
# Deprecation notice of paste crate
"RUSTSEC-2024-0436",
# Bitmaps unmaintained
"RUSTSEC-2026-0247",
# imbl-sized-chunks < 0.2.0 double-frees when an element's Drop panics
# mid-removal. Reached via nickel-lang-core -> nickel-lang-vector, which
# stores nickel values whose Drop impls only decrement a refcount. Fixed
# in 0.2.0, but nickel master still pins "0.1"; drop this ignore once a
# nickel rev carrying the 0.2 bump is pinned in Cargo.toml.
"RUSTSEC-2026-0292",
# serde_yaml 0.9 (deprecated) -> unsafe-libyaml, unmaintained; reached via
# nickel-lang-core. Drop once nickel moves off serde_yaml.
"RUSTSEC-2024-0449",
]
[licenses]
unused-allowed-license = "deny"
allow = [
"0BSD",
"Apache-2.0 WITH LLVM-exception",
"Apache-2.0",
"BSD-2-Clause",
"BSD-3-Clause",
"CDLA-Permissive-2.0",
"ISC",
"MIT",
"MPL-2.0",
"Unicode-3.0",
"Zlib",
"bzip2-1.0.6",
]
# LGPL exceptions, documented in docs/internal/licensing.md:
# - hakoniwa: LGPL-3.0-only WITH LGPL-3.0-linking-exception — the linking
# exception permits static linking; Linux-only footprint (sandbox/minimald).
# - malachite family: LGPL-3.0-only, statically linked, pulled in via the
# nickel-lang-core git dependency; stance is document-and-accept (complete
# corresponding source is public and relinkable, satisfying LGPL-3.0 §4).
exceptions = [
{ allow = ["LGPL-3.0-only WITH LGPL-3.0-linking-exception"], crate = "hakoniwa" },
{ allow = ["LGPL-3.0-only"], crate = "malachite" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-base" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-float" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-nz" },
{ allow = ["LGPL-3.0-only"], crate = "malachite-q" },
]
[licenses.private]
ignore = true
ignore-sources = ["https://buf.build/gen/cargo//"]
[bans]
skip = [
# nickel-lang-core -> pretty
# https://github.com/Marwes/pretty.rs/blob/bd138e503ee3f679b26c838c9f148fbdaf6d2b7c/Cargo.toml#L17
{ name = "arrayvec", version = "0.5.2" },
# nickel-lang-core -> codespan
{ name = "codespan-reporting", version = "0.12.0" },
# # oci-spec -> derive_builder
# https://github.com/colin-kiegel/rust-derive-builder/pull/349
{ name = "darling", version = "0.20.11" },
{ name = "darling_core", version = "0.20.11" },
{ name = "darling_macro", version = "0.20.11" },
{ name = "darling_macro", version = "0.20.11" },
# google-cloud-auth -> rustls -> ring
# https://github.com/briansmith/ring/issues/2341
{ name = "getrandom", version = "0.2.16" },
# nickel-lang-core -> saphyr-parser -> hashlink
# https://github.com/djc/hashlink/pull/38
{ name = "hashbrown", version = "0.15.5" },
# nickel-lang-core -> ouroboros -> ouroboros_macro
# https://github.com/someguynamedjosh/ouroboros/pull/127
{ name = "heck", version = "0.4.1" },
# nickel-lang-core -> malachite -> malachite-base
# https://github.com/tweag/nickel/pull/2367
{ name = "itertools", version = "0.11.0" },
# smoltcp -> heapless 0.9, beside postcard's 0.7
{ name = "heapless", version = "0.9.3" },
]
deny = [
# bitmaps is pinned below 3.2.0 in Cargo.lock because 3.2.x is affected by
# RUSTSEC-2025-0167 (unsound, no patched release). Remove together with
# the RUSTSEC-2026-0292 ignore once nickel moves to imbl-sized-chunks 0.2,
# which drops bitmaps.
{ crate = "bitmaps:>=3.2.0", reason = "RUSTSEC-2025-0167: keep bitmaps pinned below 3.2.0" },
]