1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# cargo-deny configuration: https://embarkstudios.github.io/cargo-deny/
#
# Run locally with:
# cargo install cargo-deny --locked
# cargo deny check
#
# CI runs the same check via EmbarkStudios/cargo-deny-action on every push
# and pull request (.github/workflows/ci.yml).
[]
= false
= false
[]
= 2
# A yanked version is a signal to upgrade, not necessarily a vulnerability;
# kept as a warning so it doesn't block CI on its own. A RUSTSEC advisory
# matching a dependency is still a hard failure by default — that default is
# intentionally left alone here.
= "warn"
= []
[]
= 2
= 0.8
# The full set of licenses actually present in this crate's dependency graph
# today (verified via `cargo metadata`): MIT, Apache-2.0, MIT/Apache-2.0
# dual-license variants, Unicode-3.0 (pulled in as part of unicode-ident's
# combined expression), Unlicense/MIT (aho-corasick, memchr), and Zlib
# (foldhash). Anything outside this list fails the check rather than being
# silently accepted.
= ["MIT", "Apache-2.0", "Unicode-3.0", "Unlicense", "Zlib"]
[]
# Duplicate versions of a crate in the graph are noise more often than a
# real problem for a small, mostly-leaf dependency tree; warn rather than
# fail so a transitive bump doesn't block an unrelated PR.
= "warn"
# Every dependency in Cargo.toml is exact-pinned (`=x.y.z`); a wildcard
# version requirement should never appear here.
= "deny"
[]
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]