Repository navigation
Expand file tree
/
Copy pathdeny.toml
More file actions
111 lines (101 loc) · 4.9 KB
/
Copy pathdeny.toml
File metadata and controls
111 lines (101 loc) · 4.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# cargo-deny configuration: `cargo deny check` runs in CI and in
# `rsconstruct build` (processor.clippy.deny). cargo-deny has no permissive
# default: without this file every license is rejected and every advisory
# class is an error.
[graph]
all-features = true
# Every RustSec advisory in the locked closure fails the build: a
# vulnerability needs `cargo update`, an unmaintained crate needs a
# maintained replacement. Nothing is ignored here; an ignore entry must
# carry the advisory id and the reason it cannot be fixed yet.
[advisories]
ignore = [
# google-apis-rs (google-people1, google-apis-common) is unmaintained and
# there is no maintained Rust client for the Google People API. rscontacts
# keeps it until its API layer is rewritten over reqwest. rscontacts only.
{ id = "RUSTSEC-2025-0066", reason = "no maintained replacement for google-people1; rewrite over reqwest pending" },
# ttf-parser has no maintained successor yet. It reaches the fleet only
# through upstream crates that pin it: eframe/winit's Wayland decorations
# (ab_glyph) in rsear and rsimagetag, and fontdb/usvg in rsslide. Drop
# this entry when those upstreams move off it.
{ id = "RUSTSEC-2026-0192", reason = "pinned by eframe (winit/sctk-adwaita/ab_glyph) and fontdb/usvg; no upstream release without it" },
# zvariant, zvariant_derive and zbus_names were merged into zbus 6 and
# are no longer maintained standalone. They reach the fleet only through
# eframe's accessibility stack (accesskit_unix/atspi on zbus 5) in rsear
# and rsimagetag; eframe 0.37 still uses them. Drop these entries when
# accesskit moves to zbus 6.
{ id = "RUSTSEC-2026-0370", reason = "zvariant via eframe/accesskit_unix (zbus 5); no upstream release on zbus 6 yet" },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names via eframe/accesskit_unix (zbus 5); no upstream release on zbus 6 yet" },
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive via eframe/accesskit_unix (zbus 5); no upstream release on zbus 6 yet" },
# rustybuzz, same situation: pulled in by krilla and usvg in rsslide.
{ id = "RUSTSEC-2026-0206", reason = "pinned by krilla and usvg; no upstream release without it" },
# bincode 1 is what syntect's dump-load feature deserialises its bundled
# syntaxes with; rspandoc, rssite and rsslide need those syntaxes. Drop
# when syntect moves.
{ id = "RUSTSEC-2025-0141", reason = "pinned by syntect's dump-load feature; no upstream release without it" },
# paste is a proc-macro rav1e (rssite's AVIF encoder, through image and
# ravif) expands at compile time; rav1e 0.8 has no release without it.
# rssite only. Drop when rav1e moves to pastey or drops it.
{ id = "RUSTSEC-2024-0436", reason = "paste, a compile-time macro of rav1e (rssite's AVIF encoder); no rav1e release without it" },
# clap 2 (with ansi_term and atty) is a build dependency of bindgen 0.59,
# which fluidlite-sys pins. Build-time only, rsear only. Drop when
# fluidlite-sys moves to a current bindgen.
{ id = "RUSTSEC-2021-0139", reason = "ansi_term via clap 2 via bindgen 0.59, a build dependency pinned by fluidlite-sys" },
{ id = "RUSTSEC-2024-0375", reason = "atty via clap 2 via bindgen 0.59, a build dependency pinned by fluidlite-sys" },
]
# Only these licenses may appear in the dependency graph. All are
# permissive; a crate offering a choice (`MIT OR Apache-2.0`) passes when any
# alternative is listed, which is why r-efi's LGPL option needs no entry.
[licenses]
allow = [
"0BSD",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"BSL-1.0",
"CC0-1.0",
"CDLA-Permissive-2.0",
"ISC",
"MIT",
"MIT-0",
"MPL-2.0",
# Font licences: egui embeds its default fonts (epaint_default_fonts),
# which carry OFL-1.1 and Ubuntu-font-1.0 alongside MIT OR Apache-2.0.
"OFL-1.1",
"Ubuntu-font-1.0",
"Unicode-3.0",
"Unlicense",
"Zlib",
]
confidence-threshold = 0.8
# fluidlite and fluidlite-sys (rsear's synthesiser) are LGPL-2.1: a
# deliberate, crate-scoped exception rather than a fleet-wide allowance of
# LGPL. Their manifests use the deprecated bare "LGPL-2.1" identifier, hence
# the clarifications.
[[licenses.clarify]]
name = "fluidlite"
expression = "LGPL-2.1-only"
license-files = []
[[licenses.clarify]]
name = "fluidlite-sys"
expression = "LGPL-2.1-only"
license-files = []
[[licenses.exceptions]]
name = "fluidlite"
allow = ["LGPL-2.1-only"]
[[licenses.exceptions]]
name = "fluidlite-sys"
allow = ["LGPL-2.1-only"]
# libfuzzer-sys (NCSA, a permissive BSD-style licence) is a dependency of
# rav1e, rssite's AVIF encoder, only under cfg(fuzzing): it is never built,
# but cargo-deny reads every cfg. Scoped to the crate, like fluidlite's.
[[licenses.exceptions]]
name = "libfuzzer-sys"
allow = ["NCSA"]
[bans]
multiple-versions = "warn"
wildcards = "deny"
[sources]
unknown-registry = "deny"
unknown-git = "deny"