# cargo-deny configuration (https://embarkstudios.github.io/cargo-deny/)
# Checked in CI: full `cargo deny check` on push/PR (rust.yml) and a daily
# advisories-only check (security.yml) so new RustSec advisories against the
# committed Cargo.lock surface without requiring a push.

[graph]
# Include all features and the default target list (all targets), so the
# windows/macos dependency trees shipped in releases are covered too.
all-features = true

[advisories]
# Vulnerabilities and unsound advisories are errors by default (v2 semantics).
# Deny yanked crates so a withdrawn dependency pinned in Cargo.lock is caught.
yanked = "deny"
ignore = [
    # quick-xml < 0.41.0 unbounded-allocation DoS when parsing untrusted XML.
    # Only reachable via wayland-scanner (a build-time proc-macro) parsing the
    # trusted, crate-bundled Wayland protocol XML files to generate code; it
    # never parses attacker-controlled input at runtime. No upgrade path yet:
    # wayland-scanner 0.31.8 pins quick-xml ^0.38.3. Revisit when wayland-scanner
    # relaxes the requirement so quick-xml can move to >=0.41.0.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]

[licenses]
# Workspace license is Apache-2.0. Allow-list derived from the locked
# dependency tree; extend only after reviewing the new license.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception", # wasi
    "MIT",
    "BSD-2-Clause",                   # satisfies libbpf-rs "LGPL-2.1-only OR BSD-2-Clause"
    "BSD-3-Clause",
    "ISC",                            # ring (Apache-2.0 AND ISC), untrusted
    "Zlib",                           # foldhash, zlib-rs
    "0BSD",                           # adler2
    "BSL-1.0",                        # ryu
    "Unicode-3.0",                    # unicode-ident
    "MIT-0",                          # ppmd-rust (via zip, build-dep)
    "bzip2-1.0.6",                    # libbz2-rs-sys (via zip, build-dep)
]
confidence-threshold = 0.8

[bans]
# Duplicate versions are common in this tree (e.g. windows-sys); keep as a
# warning rather than blocking PRs on transitive version skew.
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]