1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Dependency policy for VOLE-Document.
#
# The exact core must remain auditable and small. Every dependency is pinned
# exactly in Cargo.toml and locked in Cargo.lock; deviating from this policy is
# a deliberate, reviewed decision.
[]
= true
[]
= "deny"
# Vulnerabilities are denied by default in cargo-deny's advisories check.
[]
= 0.9
# Only licenses actually encountered in the dependency graph. Adding a new
# dependency with a different license requires a reviewed change here.
= [
"MIT",
"Apache-2.0",
# `unicode-ident` (a proc-macro dependency of `syn`) is released under the
# standard Unicode License v3 in addition to MIT/Apache-2.0. Permissive.
"Unicode-3.0",
# `preflate-rs` (Phase 6, feature `deflate-replay`) depends on `cabac`,
# which is LGPL-3.0-or-later. This is a deliberate, documented exception:
# it is the only copyleft dependency in the graph and it is reachable only
# through the optional `deflate-replay` feature. See ADR-0014 and the
# README licensing note for the static-linking consequences.
"LGPL-3.0-or-later",
]
[]
= "warn"
= "deny"
[]
= "deny"
= "deny"