1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# cargo-deny configuration. Run locally with `cargo deny check`.
[]
= true
[]
= "deny"
# Empty. The four suppressions carried through 0.5.x are gone: RUSTSEC-2025-0141
# with `bincode` (0.6.0 replaced it with postcard and a hand-written legacy
# reader), and RUSTSEC-2026-0258, RUSTSEC-2025-0057 and RUSTSEC-2025-0134 with
# the memcached backend, which took `async-memcached` -> `toxiproxy_rust` ->
# `reqwest 0.11` out of the graph. Keep it empty: a permanently-ignored advisory
# trains people to ignore advisories.
= []
[]
= "warn"
= "deny"
= []
[]
# Every entry here is a licence actually present in the resolved graph. When a
# new dependency introduces one that is not listed, `cargo deny` fails and the
# licence gets reviewed before it is added -- that gate is the point of the
# list, so entries are not kept "just in case".
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-3-Clause",
"Unicode-3.0",
"Zlib",
# xxhash-rust, via redis 1.6. Boost Software License 1.0 -- OSI approved,
# FSF Free/Libre, permissive, compatible with this crate's MIT OR
# Apache-2.0. redis 0.32.7 had no xxhash-rust dependency.
"BSL-1.0",
]
[]
= "deny"
= "deny"