dioxus/deny.toml at main · Adafede/dioxus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
[graph]
all-features = true

# ── Advisories ────────────────────────────────────────────────────────────────
[advisories]
# `db-path` and `db-urls` are deliberately absent: both are cargo-deny's own
# defaults ($CARGO_HOME/advisory-dbs and the RustSec advisory-db), verified by
# deleting them and deleting ~/.cargo/advisory-dbs -- cargo-deny recreated the
# same directory and checked the same advisories. A setting that equals its
# default is a line to keep in sync for nothing.
#
# `ignore` is empty and stated, because `ignore = []` is not the default: the
# default inherits cargo-audit's ignores, and an empty list here says that no
# advisory is accepted without a written reason.
ignore = []

# ── Licenses ──────────────────────────────────────────────────────────────────
# All project crates are AGPL-3.0-only. Dependencies must carry a license
# compatible with the GNU Affero General Public License v3 or later.
[licenses]
confidence-threshold = 1.0
allow = [
  # Permissive — fully compatible with AGPL-3.0
  "MIT",
  "Apache-2.0",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Zlib",
  "CC0-1.0",
  "Unicode-3.0",
  "CDLA-Permissive-2.0",
  "GPL-3.0-only",
  "BSL-1.0",
]

[licenses.private]
# All workspace crates are unpublished first-party applications/libraries
# (`publish = false`) and use AGPL-3.0-only intentionally. Keep third-party
# dependency licensing strict while excluding these private crates from the
# dependency-license gate.
ignore = true

# ── Dependency bans ───────────────────────────────────────────────────────────
[bans]
# Deny wildcard version requirements — they are unpinnable and unsafe.
wildcards = "deny"
# Report a duplicated crate with the tree that pulls it in, not as a bare name:
# the whole use of the skip list below is that someone can check it against the
# graph, and a bare name cannot be checked against anything.
highlight = "all"

# Duplicates: deny by default; carve out intentional exceptions below.
multiple-versions = "deny"

# Only the crates that are *actually* duplicated in the current lockfile.
#
# Every entry here was verified by deleting this list and reading what
# `cargo deny check bans` reported: 16 crates, 2 versions each, no third. An
# entry for a crate that is not duplicated is an `unnecessary-skip` warning, so
# this list is the set and not a habit — cargo-deny says so out loud when it is
# wrong, which is why the warnings are fixed rather than ignored.
#
# `cargo deny check bans` is not in `./mk ci`, only `cargo deny check
# advisories bans licenses sources` is — and that runs the same `bans` check, so
# a stale entry here fails the gate.
skip = [
  # lotus-search (smellfish-rs) moved to gloo-timers 0.4; dioxus-web still uses 0.3.
  # Drop once dioxus-web moves.
  { name = "gloo-timers" },
  # ── dioxus's optional feature sets ────────────────────────────────────────
  # `dioxus` turns on optional subsystems that pin their own older majors.
  # Unfixable here: it is upstream's feature set, not a version this workspace
  # chooses. Every one of these is reachable only because
  # `cargo tree --all-features` is what the graph is built from.
  { name = "const-serialize" },  # manganis 0.7 vs 0.8-alpha
  { name = "const-serialize-macro" },  # the proc macro half of the above
  { name = "miniz_oxide" },  # png 0.18 (tiny-skia) vs 0.9 (flate2)
  { name = "rand" },  # rand 0.9 (tungstenite) vs 0.10
  { name = "rand_core" },  # rand's own split, same two majors
  { name = "getrandom" },  # rand_core 0.3's backend vs 0.4's
  { name = "syn" },  # darling/enumset vs const-serialize
  { name = "winnow" },  # manganis-macro 0.7 vs 1.0
  { name = "rustc-hash" },  # sledgehammer_utils (dioxus) vs 2.x

  # ── Windows and JNI ───────────────────────────────────────────────────────
  # Not compiled for either of this repository's targets (wasm32 and the host
  # for tests), and present only because `--all-features` pulls in dioxus's
  # desktop and mobile subsystems. They will disappear with the versions above.
  { name = "windows-sys" },
  { name = "jni" },
  { name = "jni-sys" },
  { name = "r-efi" },  # getrandom's no_std EFI backend, both majors

  # ── The git dependencies ──────────────────────────────────────────────────
  # `mascot-rs` and `lotus-explore-rs` are tracked on a branch, not a rev, so
  # they move under us; these two majors are a consequence of that and would be
  # fixed by pinning a rev, which is the decision deferred until the git
  # dependencies stop being actively developed upstream.
  { name = "thiserror" },  # 1.x (upstream) vs 2.x (this workspace)
  { name = "thiserror-impl" },  # the derive half of the above
  { name = "geometric-traits" },  # same git rev under two source spellings
  { name = "wasm-streams" },  # 0.5 (reqwest 0.13, upstream) vs 0.4 (dioxus-web)
]

# ── Source policy ─────────────────────────────────────────────────────────────
# Only allow crates from crates.io. Deny all unknown registries and git deps.
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
  "https://github.com/earth-metabolome-initiative/geometric-traits",
  "https://github.com/earth-metabolome-initiative/mascot-rs.git",
  "https://github.com/earth-metabolome-initiative/mass-spectrometry-traits",
  "https://github.com/earth-metabolome-initiative/smiles-rs",
  "https://github.com/lotusnprod/lotus-explore-rs",
]