1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# cargo-deny configuration — run via `cargo deny check` (CI: ci.yaml deny job,
# full sweep: monthly supply-chain workflow).
#
# Policy summary:
# - licenses: permissive set only (deny unknown)
# - advisories: RustSec vulnerabilities/yanked crates block the build
# - bans: duplicate versions are reported but tolerated (warn) — the tree is
# large and some dupes come from mandatory build tooling
# - sources: crates.io plus our own gherkin fork (see [patch.crates-io])
[]
= true
[]
= 2
= [
"MIT",
"MIT-0",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"Zlib",
"MPL-2.0",
"CDLA-Permissive-2.0",
"BSL-1.0",
"CC0-1.0",
"0BSD",
# libbz2-rs-sys (pure-Rust bzip2, transitive via sevenz-rust2): BSD-style
# bzip2 license
"bzip2-1.0.6",
]
= 0.8
[]
= "warn"
# `deny` would fight `.workspace = true` inheritance (cargo-deny sees those as
# wildcard specs), so stay at warn: third-party wildcard deps still surface.
= "warn"
= "all"
[]
= 2
= "deny"
= [
# RUSTSEC-2024-0370: proc-macro-error is unmaintained. Build-time only:
# pulled via rstest-bdd-macros (dev-dependency proc-macro), never ships in
# the binary. No safe upgrade exists — rstest-bdd 0.6.0-beta3 is still the
# latest release and depends on it. Remove this entry when rstest-bdd
# drops the dependency.
{ = "RUSTSEC-2024-0370", = "unmaintained dev-only proc-macro via rstest-bdd-macros; awaiting upstream fix" },
]
[]
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]
= [
# zh-CN Gherkin keyword fork, wired via [patch.crates-io] in Cargo.toml
"https://github.com/StrayDragon/gherkin.git",
]