1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# WyattAu dependency governance — cargo-deny configuration.
# Copy to the repo root. Policies: see engineering-standards README §7.
[]
= true
[]
= 2
= "deny"
= [
# tokio-tar PAX extended-header confusion (file smuggling, not memory
# unsafety). Dev-only: via testcontainers <- testcontainers-modules
# (integration-test containers); archives originate from trusted
# registries, not hostile input. tokio-tar is archived upstream and the
# fix (astral-tokio-tar) requires a testcontainers-side migration; no
# in-range upgrade exists. (Precedent: webhookkit.)
# TODO: drop when testcontainers switches off tokio-tar.
"RUSTSEC-2025-0111",
# bincode unmaintained (dev-only: iai-callgrind still depends on 1.3.3
# for runner IPC; no in-range upgrade exists).
# TODO: drop when iai-callgrind migrates off bincode 1.x.
"RUSTSEC-2025-0141",
# proc-macro-error2 unmaintained (dev-only: via iai-callgrind-macros;
# author confirms no further maintenance, no released successor
# dependency yet). (Precedent: cas-kit.)
# TODO: drop when iai-callgrind migrates off proc-macro-error2.
"RUSTSEC-2026-0173",
# rustls-pemfile unmaintained (not a vulnerability; latest release is a
# thin wrapper over rustls-pki-types' PEM parsing, which is the intended
# successor). Dev-only: via bollard <- testcontainers (integration-test
# containers), absent from every runtime graph. Fix belongs upstream in
# bollard; no in-range upgrade exists. (Precedent: webhookkit.)
# TODO: drop when bollard drops rustls-pemfile.
"RUSTSEC-2025-0134",
]
[]
= 2
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Zlib",
"CDLA-Permissive-2.0",
]
= 0.93
[]
= "warn"
= "deny"
= "all"