1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# cargo-deny configuration.
# https://embarkstudios.github.io/cargo-deny/
#
# Waiver discipline (inherited from the monorepo): every ignore entry
# carries the advisory ID, the chain that reaches this graph, and a
# dated sunset condition. Prune entries the same day a dep bump removes
# the matching crate from the graph.
[]
= ["https://github.com/rustsec/advisory-db"]
= "deny"
= [
# ── via genai → rtb-chat ─────────────────────────────────────────
# `paste` (1.0.15) unmaintained. genai declares `paste = "1.0"`
# directly (added in genai 0.6; 0.5 avoided it) and keeps it on
# `main` (0.7.0-beta) with no upstream issue to drop it. Benign
# ecosystem-wide flag — a compile-time proc-macro helper, no runtime
# surface, no known vulnerability; Azure SDK, ratatui, tauri, iceberg
# all waive it. The `pastey` fork isn't usable here (genai is the
# direct dependent). Sunset: re-audit quarterly (last: 2026-07-23);
# drop when genai moves off paste.
"RUSTSEC-2024-0436",
]
[]
= [
"MIT",
"MIT-0",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-DFS-2016",
"Unicode-3.0",
"Zlib",
"CC0-1.0",
"MPL-2.0",
"0BSD",
# Community Data License — used by webpki-root-certs (via
# rustls-platform-verifier ← reqwest) for the root-cert store.
# Same allowance the monorepo carries for webpki-roots.
"CDLA-Permissive-2.0",
]
= 0.8
[]
= "warn"
= "deny"
# The enforceable "framework-free" statement (extraction playbook §2.2):
# this crate must never depend back on the tool, and never regress onto
# the workspace-banned crates.
= [
{ = "rust-tool-base" },
{ = "rtb-cli-bin" },
# anyhow is banned from library code (thiserror + miette are the
# error surface). No wrappers needed: this crate has no cucumber
# dev-dep and genai does not pull anyhow — nothing in the resolved
# graph carries it today.
{ = "anyhow" },
{ = "openssl-sys" },
{ = "native-tls" },
]
[]
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]