deny.toml

# cargo-deny configuration file
# See https://embarkstudios.github.io/cargo-deny/
#
# Severity Policy for RustSec Advisories
# =======================================
# This file defines the project-wide policy for how RustSec advisories are
# handled. The [advisories] section controls which vulnerability severities
# cause CI failures, which trigger warnings, and which are explicitly
# excepted with documented justification.
#
# Policy summary:
#   - CRITICAL / HIGH  -> deny  (blocks CI, must be resolved or excepted)
#   - MEDIUM           -> deny  (blocks CI per severity-threshold below)
#   - LOW              -> warn  (visible in CI logs, does not block)
#   - unmaintained     -> warn
#   - yanked           -> warn
#   - notice           -> warn
#
# Exceptions process:
#   1. Run `cargo audit` to identify new advisories.
#   2. For advisories that cannot be immediately remediated, add them to the
#      `ignore` list below with a mandatory justification comment.
#   3. Include a re-evaluation date in the comment (max 90 days out).
#   4. Remove the entry once the upstream dependency is patched or the
#      advisory is withdrawn.
#   5. All exceptions must be reviewed in the quarterly security review
#      (see contracts/earn-quest/audit/RUSTSEC_POLICY.md).

[graph]
targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "x86_64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
]

# ------------------------------------------------------------------------------
# [advisories] — RustSec severity policy
# ------------------------------------------------------------------------------
[advisories]
# The path where the advisory database is cloned/fetched into
db-path = "~/.cargo/advisory-db"
# The url(s) of the advisory databases to use
db-urls = ["https://github.com/rustsec/advisory-db"]

# Scope for crates that are no longer actively maintained.
# Valid options: "all" | "workspace" | "transitive" | "none"
# (CI uses this field to determine which crates to consider unmaintained.)
unmaintained = "all"

# Lint level for crates yanked from crates.io.
# Yanked versions should be upgraded but are not always a security issue.
yanked = "warn"

# --- Exceptions List ----------------------------------------------------------
# Advisory IDs listed here are explicitly ignored.
# Each entry MUST have an inline justification comment explaining:
#   - Why the advisory does not apply or cannot be remediated right now
#   - Which version(s) or code paths are affected
#   - A re-evaluation deadline (ISO date, max 90 days from when added)
#
# Format: "RUSTSEC-YYYY-NNNN"
#
# Example (remove the leading # to activate):
#   "RUSTSEC-2021-0145",
#   # ^ nom <7.0 path-traversal — we pin nom >=7.1 everywhere; not reachable.
#   #   Re-evaluate: 2025-09-30
#
ignore = [
    # No exceptions are currently active.
    # Add entries here only after review and with documented justification.
]
# ------------------------------------------------------------------------------

[licenses]
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "CC0-1.0",
    "MPL-2.0",
]
# Lint level for confidence in the license detection
confidence-threshold = 0.8
# Per-crate license exceptions
exceptions = [
    # Each entry is the crate and version constraint, and its license exceptions
    #{ allow = ["OpenSSL-Connector-Exception"], name = "ring", version = "*" },
]

[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "warn"
# Lint level for when a crate version requirement is `*`
wildcards = "allow"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
highlight = "all"
# List of crates that are allowed
allow = [
    #{ name = "ansi_term", version = "=0.11.0" },
]
# List of crates to deny
deny = [
    #{ name = "ansi_term", version = "=0.11.0" },
]
# Certain crates/versions that will be skipped when doing duplicate detection
skip = [
    #{ name = "ansi_term", version = "=0.11.0" },
]
# Skip certain crates during duplicate detection and version checking
skip-tree = [
    #{ name = "ansi_term", version = "=0.11.0", depth = 20 },
]

[sources]
# Lint level for crates from unknown registries
unknown-registry = "warn"
# Lint level for crates from unknown git repositories
unknown-git = "warn"
# List of URLs for allowed crate registries
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# List of URLs for allowed Git repositories
allow-git = []