wehub-resource-sync
55 lines
2.2 KiB
TOML
55 lines
2.2 KiB
TOML
# cargo-deny configuration (https://embarkstudios.github.io/cargo-deny/)
|
|
# Checked in CI: full `cargo deny check` on push/PR (rust.yml) and a daily
|
|
# advisories-only check (security.yml) so new RustSec advisories against the
|
|
# committed Cargo.lock surface without requiring a push.
|
|
|
|
[graph]
|
|
# Include all features and the default target list (all targets), so the
|
|
# windows/macos dependency trees shipped in releases are covered too.
|
|
all-features = true
|
|
|
|
[advisories]
|
|
# Vulnerabilities and unsound advisories are errors by default (v2 semantics).
|
|
# Deny yanked crates so a withdrawn dependency pinned in Cargo.lock is caught.
|
|
yanked = "deny"
|
|
ignore = [
|
|
# quick-xml < 0.41.0 unbounded-allocation DoS when parsing untrusted XML.
|
|
# Only reachable via wayland-scanner (a build-time proc-macro) parsing the
|
|
# trusted, crate-bundled Wayland protocol XML files to generate code; it
|
|
# never parses attacker-controlled input at runtime. No upgrade path yet:
|
|
# wayland-scanner 0.31.8 pins quick-xml ^0.38.3. Revisit when wayland-scanner
|
|
# relaxes the requirement so quick-xml can move to >=0.41.0.
|
|
"RUSTSEC-2026-0194",
|
|
"RUSTSEC-2026-0195",
|
|
]
|
|
|
|
[licenses]
|
|
# Workspace license is Apache-2.0. Allow-list derived from the locked
|
|
# dependency tree; extend only after reviewing the new license.
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception", # wasi
|
|
"MIT",
|
|
"BSD-2-Clause", # satisfies libbpf-rs "LGPL-2.1-only OR BSD-2-Clause"
|
|
"BSD-3-Clause",
|
|
"ISC", # ring (Apache-2.0 AND ISC), untrusted
|
|
"Zlib", # foldhash, zlib-rs
|
|
"0BSD", # adler2
|
|
"BSL-1.0", # ryu
|
|
"Unicode-3.0", # unicode-ident
|
|
"MIT-0", # ppmd-rust (via zip, build-dep)
|
|
"bzip2-1.0.6", # libbz2-rs-sys (via zip, build-dep)
|
|
]
|
|
confidence-threshold = 0.8
|
|
|
|
[bans]
|
|
# Duplicate versions are common in this tree (e.g. windows-sys); keep as a
|
|
# warning rather than blocking PRs on transitive version skew.
|
|
multiple-versions = "warn"
|
|
wildcards = "deny"
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|