noya-cli 0.0.15

Command-line tools for noyalib (noyafmt, noyavalidate)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

[graph]
all-features = true

[advisories]
# `unmaintained = "workspace"` was removed in cargo-deny v0.20
# (EmbarkStudios/cargo-deny#611) — the unmaintained-crate signal
# is now delivered via RustSec advisory entries themselves
# (`unmaintained: main` / `unsound`), so the dedicated knob is
# redundant. Severity flow stays the same: any RustSec advisory
# below `severity-threshold` (default `low`) fails the build
# unless listed in `ignore` below.
yanked = "warn"
# Bench-only competitor surface — these crates are never compiled
# into a release artefact. They appear in `crates/noyalib/Cargo.toml`
# under `[dev-dependencies]` purely so the comparison harness in
# `crates/noyalib/benches/comparison.rs` produces honest head-to-
# head numbers vs every still-maintained Rust YAML library. The
# unmaintained / unsound contenders (`serde_yml`, `libyml`) used
# to be benched too — they were retired in v0.0.6 so `cargo
# audit` and the OpenSSF Scorecard Vulnerabilities check stay
# clean without needing per-advisory exemptions.
ignore = [
    # proc-macro-error2 is unmaintained (author confirmed). It reaches
    # us only at build time via validator_derive -> validator (the
    # `validate` feature); it never ships in a release artefact, so the
    # advisory is informational for us. No maintained drop-in exists yet
    # (validator has not migrated off it). Revisit when validator cuts a
    # release that drops proc-macro-error2.
    "RUSTSEC-2026-0173",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Unicode-3.0",
    # `is_ci` (used by miette/fancy via supports-color) is ISC-licensed.
    # ISC is permissive, OSI- and FSF-approved, and widely accepted.
    "ISC",
    # `memchr` is dual-licensed Unlicense OR MIT — transitive via memmap2.
    "Unlicense",
    # A handful of transitive deps ship under BSD clauses (2 or 3).
    "BSD-2-Clause",
    "BSD-3-Clause",
    # `adler2` and a few compression helpers are 0BSD.
    "0BSD",
    # `borrow-or-share` (transitive via jsonschema → referencing →
    # fluent-uri) is MIT-0 — OSI-approved permissive, no attribution
    # requirement.
    "MIT-0",
    # `foldhash` (transitive via hashbrown → referencing 0.46 and
    # hashlink → yaml-rust2 dev-deps) ships under Zlib — OSI- and
    # FSF-approved permissive license, no attribution requirement.
    "Zlib",
]
confidence-threshold = 0.8

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []