1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# cargo-deny configuration. See https://embarkstudios.github.io/cargo-deny/
# Checked in CI (`cargo deny check`) as a supply-chain gate.
[]
# Fail on any dependency with a known RustSec advisory or that has been yanked.
= "deny"
# Only fail on "unmaintained" advisories for our own crates; deep transitive
# deps (e.g. ttf-parser via resvg/usvg) often have no upgrade path we control.
= "workspace"
[]
# Permissive/weak-copyleft licenses present in the dependency tree. cargo-deny
# evaluates SPDX expressions, so an "A OR B" dep passes if either is allowed.
= [
"MIT",
"MIT-0",
"Apache-2.0",
"BSD-2-Clause",
"BSD-3-Clause",
# ISC: permissive, OSI-approved, MIT-equivalent. Pulled in via `libloading`
# (pdfium-render's runtime `dlopen`, ADR 0015).
"ISC",
"Zlib",
"0BSD",
"Unlicense",
"CC0-1.0",
"BSL-1.0",
"MPL-2.0",
"WTFPL",
"NCSA",
"Unicode-DFS-2016",
"Unicode-3.0",
"bzip2-1.0.6",
# CDLA-Permissive-2.0: a permissive, OSI-friendly data license, used by
# `webpki-roots`. It reaches the tree only through libduckdb-sys's
# non-optional *build* dependency on `reqwest` (ADR 0016) — a download path
# that is `#[cfg(not(feature = "bundled"))]`, i.e. dead code in our `bundled`
# build (DuckDB is compiled from the vendored `duckdb.tar.gz`, never fetched).
# It is compiled at build time only and is not linked into the binary.
"CDLA-Permissive-2.0",
]
= 0.8
[]
# Duplicate versions are noisy in the Rust ecosystem; warn, don't fail.
= "warn"
[]
= "deny"
= "deny"