# cargo-deny configuration: security advisories plus license hygiene.
# The allow list covers the known permissive set of the dependency tree;
# the first CI run may surface transitive licenses that need an explicit,
# justified addition here. Do not widen the list silently.
[advisories]
version = 2
yanked = "deny"
ignore = [
# RUSTSEC-2024-0436: `paste` is unmaintained. It arrives transitively via
# thiserror v1 (thiserror-impl). Not fixable on our side without a
# dependency bump of thiserror to 2.x; revisit on the next dependency
# refresh. paste generates no code that handles untrusted input.
"RUSTSEC-2024-0436",
]
[licenses]
version = 2
allow = [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"MIT",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"Zlib",
"CDLA-Permissive-2.0",
]
[bans]
multiple-versions = "warn"