whatsapp-rust 0.7.0

Rust client for WhatsApp Web
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

# cargo-deny configuration. Run locally with `cargo deny --all-features check`;
# CI runs the same command in .github/workflows/supply-chain.yml.

[graph]
# --all-features so the voip/webrtc tree and the optional transports are part
# of the audited graph; they are the largest third-party surface here.
all-features = true
# Scope is what consumers actually link: the default-members graph minus
# dev-dependencies. Bench/e2e tooling (divan, proptest, the mock server) never
# reaches a downstream build, so its licenses are not ours to vet.
exclude-dev = true

[advisories]
version = 2
# Only `unmaintained` notices are listed below, and only where no upgrade
# exists. A real vulnerability advisory must be resolved by a version bump,
# never by an entry here.
ignore = [
    { id = "RUSTSEC-2026-0150", reason = "audiopus_sys, reached through the optional `voip-libopus` feature via opus 0.3. Upstream is dormant with no fork on crates.io; the crate is a thin libopus FFI shim that we build but do not drive directly." },
    { id = "RUSTSEC-2025-0141", reason = "bincode 1.3.3, pulled in by webrtc-dtls 0.12 for its session-resumption state. Development stopped deliberately with 1.3.3 declared complete; drops out when webrtc-dtls moves off it." },
]

[licenses]
version = 2
# Permissive licenses only. Anything else fails and needs a deliberate
# decision rather than a quiet addition to this list.
allow = [
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MIT",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
    "0BSD",
    # webpki-roots. Not code — the Mozilla CA root store, redistributed under a
    # permissive data license.
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[licenses.private]
# Workspace members marked `publish = false` (e2e-tests, bench-integration,
# the metrics plugin, voip-cli) carry no license field by design. They are
# outside the default-members graph today; this keeps them out if that changes.
ignore = true

[bans]
multiple-versions = "deny"
wildcards = "deny"
# Workspace-internal path deps are versioned in lockstep; a wildcard there is
# not the supply-chain risk this check is aimed at.
allow-wildcard-paths = true

skip = [
    # DELIBERATE: the VoIP runtime links both majors at once. webrtc-dtls 0.12
    # and webrtc-sctp/webrtc-data 0.17 disagree on which webrtc-util they take,
    # and the DTLS-over-SCTP path needs both halves, so the root manifest
    # aliases the older one as `webrtc-util-011`. Not a duplicate to collapse.
    { name = "webrtc-util", version = "=0.11.0" },

    # RustCrypto mid-migration. The workspace is on the 0.11/1.x line
    # (sha2 0.11, hmac 0.13, aes-gcm 0.11...); parts of the webrtc and
    # curve25519 trees still pin the 0.10/0.5 generation. Collapses on its own
    # once those crates finish upgrading.
    { name = "aead", version = "=0.5.2" },
    { name = "aes", version = "=0.8.4" },
    { name = "aes-gcm", version = "=0.10.3" },
    { name = "block-buffer", version = "=0.10.4" },
    { name = "block-padding", version = "=0.3.3" },
    { name = "cbc", version = "=0.1.2" },
    { name = "cipher", version = "=0.4.4" },
    { name = "crypto-common", version = "=0.1.7" },
    { name = "ctr", version = "=0.9.2" },
    { name = "digest", version = "=0.10.7" },
    { name = "ghash", version = "=0.5.1" },
    { name = "hkdf", version = "=0.12.4" },
    { name = "hmac", version = "=0.12.1" },
    { name = "inout", version = "=0.1.4" },
    { name = "polyval", version = "=0.6.2" },
    { name = "sha1", version = "=0.10.7" },
    { name = "sha2", version = "=0.10.9" },
    { name = "universal-hash", version = "=0.5.1" },

    # rand 0.8/0.9/0.10 split, and getrandom 0.2/0.3 behind it. The workspace
    # pins rand 0.10; curve25519-dalek and several webrtc crates are still on
    # 0.9 or 0.8.
    { name = "getrandom", version = "=0.2.17" },
    { name = "getrandom", version = "=0.3.4" },
    { name = "rand", version = "=0.8.7" },
    { name = "rand", version = "=0.9.5" },
    { name = "rand_chacha", version = "=0.3.1" },
    { name = "rand_core", version = "=0.6.4" },
    { name = "rand_core", version = "=0.9.5" },

    # curve25519-dalek 4.x and its x25519 wrapper still live under the webrtc
    # tree; wacore-libsignal is on 5.x/3.x. fiat-crypto follows dalek.
    { name = "curve25519-dalek", version = "=4.1.3" },
    { name = "fiat-crypto", version = "=0.2.9" },
    { name = "x25519-dalek", version = "=2.0.1" },

    # Proc-macro-side duplicates. They cost build time only — proc macros run
    # at compile time and never link into the produced binary.
    { name = "darling", version = "=0.21.3" },
    { name = "darling_core", version = "=0.21.3" },
    { name = "darling_macro", version = "=0.21.3" },
    { name = "syn", version = "=2.0.119" },
    { name = "thiserror", version = "=1.0.69" },
    { name = "thiserror-impl", version = "=1.0.69" },
    { name = "winnow", version = "=0.7.15" },

    # Assorted transitive lag: no workspace crate depends on any of these
    # directly, so the version is whatever our deps agreed on.
    { name = "bitflags", version = "=1.3.2" },
    { name = "cpufeatures", version = "=0.2.17" },
    { name = "foldhash", version = "=0.1.5" },
    { name = "hashbrown", version = "=0.15.5" },
    { name = "hashbrown", version = "=0.16.1" },
    { name = "r-efi", version = "=5.3.0" },
    { name = "windows-sys", version = "=0.52.0" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# crates.io only. Nothing in this workspace is vendored from a git remote, and
# a new git source should be an explicit decision rather than a silent one.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]