1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# cargo-deny configuration for clickup-cli.
# See https://embarkstudios.github.io/cargo-deny/ for the full schema.
#
# Checked in CI via .github/workflows/deny.yml on every push/PR touching
# Cargo.toml / Cargo.lock / this file. Complements Dependabot: Dependabot
# proposes upgrades; cargo-deny enforces policy (licenses, advisories,
# source registry allowlist, banned crates).
[]
= false
= false
[]
= 1
# ---- advisories ----------------------------------------------------------
# Rust Security Advisory Database. Equivalent to cargo-audit, with more
# policy knobs. Fails the build on any unmaintained or vulnerable crate
# unless explicitly allowlisted below.
[]
= 2
= []
# Stay current — crates flagged 'unmaintained' are treated as warnings, not
# errors, because the ecosystem has many stable-but-quiet crates.
= "workspace"
# ---- licenses ------------------------------------------------------------
# Allowlist-only. Any dep pulling in a license outside this set fails the
# build until explicitly reviewed. Keep the list conservative.
[]
= 2
= [
"Apache-2.0",
"MIT",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"Zlib",
"MPL-2.0",
"CC0-1.0",
"CDLA-Permissive-2.0", # webpki-root-certs ships bundled CA root data under this license
]
= 0.93
# Some crates dual-license or use SPDX expressions the detector can't
# normalize. Allowlist them explicitly if/when they come up.
= []
# ---- bans ----------------------------------------------------------------
[]
= "warn"
= "deny"
= "all"
# Duplicate-version exceptions for common transitive-dep churn go here.
= []
= []
# ---- sources -------------------------------------------------------------
# crates.io only. No git deps, no alternative registries. If this ever
# fails, that's a policy question worth stopping the build over.
[]
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]
= []