deny.toml

[advisories]
version = 2
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "deny"
# NOTE: Advisory IDs must stay in sync with .cargo/audit.toml. Yank exceptions
# live only here because cargo-audit cannot ignore an exact yanked package.
ignore = [
    { crate = "spin@0.9.8", reason = "Yanked upstream; transitive through Typst and wasmi, whose latest stable releases still require spin 0.9. Remove when wasmi upgrades." },
    { id = "RUSTSEC-2024-0320", reason = "Transitive through syntect in the current Typst stack; no direct dependency or safe local replacement in this PR." },
    { id = "RUSTSEC-2024-0436", reason = "Transitive through V8, hayagriva, and biblatex; no direct dependency or safe local replacement in this PR." },
    { id = "RUSTSEC-2025-0141", reason = "Transitive through deno_core and syntect; no direct dependency or safe local replacement in this PR." },
    { id = "RUSTSEC-2026-0186", reason = "memmap2 unsound: transitive through gix-ref/gix-protocol/gix; no upstream memmap2 fix available in the gix ecosystem yet." },
    { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained: transitive through the current Typst stack; no direct dependency or actionable local patch path in this PR." },
    { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic attribute check: transitive through the Typst stack (citationberg/hayagriva at 0.38.4, syntect/plist at 0.39.4); the fix requires quick-xml >=0.41, a breaking bump those upstreams have not shipped yet." },
    { id = "RUSTSEC-2026-0195", reason = "quick-xml NsReader memory-exhaustion DoS: same transitive paths and fix version as RUSTSEC-2026-0194." },
    { id = "RUSTSEC-2026-0206", reason = "rustybuzz unmaintained: transitive through krilla, typst-layout, typst-library, and usvg; not a vulnerability, expected to be addressed upstream." },
]

[licenses]
version = 2
confidence-threshold = 0.8
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
]

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"

# These duplicate families are currently pulled in by upstream stacks such as
# Typst, Deno/V8, rustls/ring, and platform crates. Treat them as audit
# findings instead of forcing brittle transitive pins in this publish-readiness
# PR.
skip = [
    { name = "getrandom" },
    { name = "icu_collections" },
    { name = "icu_properties" },
    { name = "icu_provider" },
    { name = "windows-sys" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]