oximg 0.11.0

High-performance image compression: library, CLI, and self-hostable server (PoC).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

# cargo-deny policy gate. Runs in CI (`cargo deny check`).
# Guards three things: no copyleft (AGPL/GPL) sneaks in, no known-vulnerable
# crates, and dependency-tree hygiene. License *attribution* (the shipped
# THIRD-PARTY-LICENSES bundle) is cargo-about's job, not this file's.

[graph]
all-features = true

[advisories]
# RUSTSEC advisory-db. Default action for vulnerabilities is "deny".
# Add IDs here (with a reason) only to consciously accept a specific finding.
ignore = []

[licenses]
# Permissive allow-list. Anything outside this — notably AGPL/GPL/LGPL — fails
# the build. jpegli/libjxl is BSD-3-Clause, highway is Apache-2.0.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "BSL-1.0",
    "Unicode-3.0",
    "CC0-1.0",
    "Unlicense",
    # Permissive data license (Mozilla CA root store via webpki-roots).
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

# IJG is an uncommon license carried only by the mozjpeg (libjpeg-turbo)
# decode path. Scope it to those crates instead of allowing it globally, so a
# future IJG-licensed dependency still trips the gate for review.
[[licenses.exceptions]]
crate = "mozjpeg"
allow = ["IJG"]

[[licenses.exceptions]]
crate = "mozjpeg-sys"
allow = ["IJG"]

# MPL-2.0 is file-level copyleft: using the crate unmodified is compatible
# with Apache-2.0 distribution. Scoped so any new MPL dependency is reviewed.
[[licenses.exceptions]]
crate = "avif-parse"
allow = ["MPL-2.0"]

[bans]
# Duplicate versions bloat the binary and the audit surface. "warn" to start —
# tighten to "deny" once the tree is deduplicated.
multiple-versions = "warn"
wildcards = "warn"

[sources]
unknown-registry = "deny"
unknown-git = "deny"