.deny.toml

[graph]
# This configuration is tuned for the published `wgpu`/`naga` library crates and
# their dependencies *only* -- the skip/ignore/allow entries below assume that
# scope. The binaries, tests, examples, and tooling in this workspace pull in many
# more dependencies that would produce false-positive advisory/ban/license noise.
exclude-unpublished = true
# Dev dependencies are not relevant to the published library crates, so we ignore them.
exclude-dev = true

[bans]
multiple-versions = "deny"
skip-tree = [{ name = "rustc-hash", version = "1.1.0" }]
skip = [
    # naga -> petgraph uses an old version
    { name = "hashbrown", version = "0.15.5" },
    # Used by hashbrown 0.15.5
    { name = "foldhash", version = "0.1.5" },

    # naga depends on hashbrown 0.16 directly, while naga -> indexmap pulls hashbrown 0.17
    { name = "hashbrown", version = "0.16.1" },

    # wgpu-hal -> drm -> drm-sys uses an older version, while wgpu-hal -> drm -> rustix uses a newer one
    { name = "linux-raw-sys", version = "0.9.4" },
]
wildcards = "deny"
allow-wildcard-paths = true

[advisories]
ignore = [
    # `paste` crate is no longer maintained https://rustsec.org/advisories/RUSTSEC-2024-0436
    # It's a transitive dependency of `wgpu-core` via `macro_rules_attribute`.
    # https://github.com/gfx-rs/wgpu/issues/7873
    "RUSTSEC-2024-0436",
    # `bincode` is no longer maintained https://rustsec.org/advisories/RUSTSEC-2025-0141
    # We only use it directly for tests and tools. It is also used indirectly via deno.
    "RUSTSEC-2025-0141",
]

[licenses]
allow = [
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MIT",
    "Unicode-3.0",
    "Zlib",
]
private = { ignore = true }

[sources]
unknown-registry = "deny"
unknown-git = "deny"
required-git-spec = "rev"

[sources.allow-org]
github = []