solidb/deny.toml at main · solisoft/solidb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# cargo-deny configuration — see the `audit` job in .github/workflows/ci.yml.
#
# The dependency tree is ~640 crates. Before this file nothing in CI reported a
# RUSTSEC advisory, a licence change in a transitive dependency, or a crate
# pulled from an unexpected source.

[graph]
# Match the clippy job: lint the tree we actually ship, including the optional
# `fuse` feature.
all-features = true

[advisories]
version = 2
# Each entry is an accepted risk with a reason. Anything fixable by a version
# bump should be bumped instead of listed here — rand (RUSTSEC-2026-0097) and
# anyhow (RUSTSEC-2026-0190) were fixed that way rather than ignored.
ignore = [
    # quick-xml 0.38.4, two DoS advisories against parsing untrusted XML.
    # Pinned by phonenumber 0.3.10, which is already the latest release; the
    # fix needs quick-xml >=0.41 upstream. Not reachable from user input:
    # phonenumber only parses its own bundled metadata. Re-check when
    # phonenumber releases against quick-xml 0.41.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",

    # atomic-polyfill, unmaintained, no upgrade path. Build-dependency only
    # (via phonenumber's build script); absent from the normal dependency tree.
    "RUSTSEC-2023-0089",

    # bincode 1.3.3, unmaintained. This is a *direct* dependency used for
    # internal storage serialisation, so it is real technical debt rather than
    # a transitive annoyance — but it is an unmaintained notice, not a
    # vulnerability. Migrating to bincode 2.x is a storage-format change and
    # needs its own plan.
    "RUSTSEC-2025-0141",

    # paste 1.0.15, unmaintained proc-macro, no upgrade path. Compile-time
    # only, via ratatui / tui-textarea / sanitizer.
    "RUSTSEC-2024-0436",
]

[licenses]
version = 2
# Every licence below was observed in the current tree. Deliberately an
# allow-list: a new licence appearing in a transitive dependency should fail
# the build and be reviewed, not be silently accepted.
allow = [
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "0BSD",
    "CC0-1.0",
    "Unlicense",
    "BSL-1.0",
    "Unicode-3.0",
    # Data licence on webpki-root-certs, which ships the Mozilla CA bundle.
    "CDLA-Permissive-2.0",
    # Weak copyleft, file-level. 11 crates in the tree; linking is unaffected,
    # but modifications to those files must be published.
    "MPL-2.0",
]
confidence-threshold = 0.8

[bans]
# Duplicate versions are normal in a tree this size and are not worth failing
# the build over; surfacing them is enough.
multiple-versions = "warn"
wildcards = "deny"
# solidb-client is an in-repo path dependency (clients/rust-client) and has no
# version requirement by design; that is not the unpinned-crates-io-dependency
# risk `wildcards` exists to catch.
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"