1+ [graph ]
2+ # This configuration is tuned for the published `wgpu`/`naga` library crates and
3+ # their dependencies *only* -- the skip/ignore/allow entries below assume that
4+ # scope. The binaries, tests, examples, and tooling in this workspace pull in many
5+ # more dependencies that would produce false-positive advisory/ban/license noise.
6+ exclude-unpublished = true
7+ # Dev dependencies are not relevant to the published library crates, so we ignore them.
8+ exclude-dev = true
9+
110[bans ]
211multiple-versions = " deny"
3- skip-tree = [
4- { name = " rustc-hash" , version = " 1.1.0" },
5-
6- # introduced by Deno, to be investigated
7- { name = " petgraph" , version = " 0.6.5" },
8-
9- # Winit 0.30 uses an older objc2
10- { name = " objc2-foundation" , version = " 0.2" },
11-
12- # glutin and tracy-client-sys use windows-sys 0.52, pulling older windows-targets
13- { name = " windows-targets" , version = " 0.52" },
14- ]
12+ skip-tree = [{ name = " rustc-hash" , version = " 1.1.0" }]
1513skip = [
16- # the ecosystem is migrating from getrandom 0.3 to 0.4, so this captures many stragglers
17- { name = " getrandom" , version = " 0.3.4" },
18-
19- # Deno uses an old version
20- { name = " bincode" , version = " 1.3.3" },
21- { name = " which" , version = " 6.0.3" },
22-
23- # Winit uses an old version via calloop → rustix 0.38
24- { name = " linux-raw-sys" , version = " 0.4" },
25- { name = " rustix" , version = " 0.38" },
26- { name = " windows-sys" , version = " 0.59" },
27-
28- # Winit uses an old version via android-activity
29- { name = " thiserror" , version = " 1" },
30- { name = " thiserror-impl" , version = " 1" },
31-
32- # glutin uses an old version
33- { name = " windows-sys" , version = " 0.52" },
34-
35- # getrandom 0.3 uses an old version
36- { name = " r-efi" , version = " 5" },
37-
38- # winit uses this old version
39- { name = " redox_syscall" , version = " 0.4.1" },
40- # parking-lot uses this old version
41- { name = " redox_syscall" , version = " 0.5.18" },
42-
43- # deno uses an old version
44- { name = " bit-vec" , version = " 0.8.0" },
45- { name = " bit-set" , version = " 0.8.0" },
46-
47- # drm uses an older version via drm-sys, and a newer version via rustix
48- { name = " linux-raw-sys" , version = " 0.9.4" },
49-
50- # getrandom -> wasip3 -> wit-bindgen uses an old version but
51- # getrandom -> wasip2 -> wit-bindgen uses a newer version
52- { name = " wit-bindgen" , version = " 0.51.0" },
53-
54- # android-activity -> ndk -> jni-sys uses an old version but
55- # android-activity -> jni -> jni-sys uses a newer version
56- { name = " jni-sys" , version = " 0.3.1" },
57-
58- # v8 -> bindgen -> itertools uses an old version
59- { name = " itertools" , version = " 0.13" },
60-
61- # gpu-descriptor and petgraph use an old version
14+ # naga -> petgraph uses an old version
6215 { name = " hashbrown" , version = " 0.15.5" },
63-
6416 # Used by hashbrown 0.15.5
6517 { name = " foldhash" , version = " 0.1.5" },
18+
19+ # naga depends on hashbrown 0.16 directly, while naga -> indexmap pulls hashbrown 0.17
20+ { name = " hashbrown" , version = " 0.16.1" },
21+
22+ # wgpu-hal -> drm -> drm-sys uses an older version, while wgpu-hal -> drm -> rustix uses a newer one
23+ { name = " linux-raw-sys" , version = " 0.9.4" },
6624]
6725wildcards = " deny"
6826allow-wildcard-paths = true
6927
7028[advisories ]
7129ignore = [
7230 # `paste` crate is no longer maintained https://rustsec.org/advisories/RUSTSEC-2024-0436
73- # It's a dependency of `metal` (which is to be replaced with `objc2-metal`), and a
74- # transitive dependency of `deno`. https://github.com/gfx-rs/wgpu/issues/7873
31+ # It's a transitive dependency of `wgpu-core` via `macro_rules_attribute`.
32+ # https://github.com/gfx-rs/wgpu/issues/7873
7533 " RUSTSEC-2024-0436" ,
76- # `unic-*` crates are no longer maintained https://rustsec.org/advisories/RUSTSEC-2025-0100
77- # These are used via `deno`. https://github.com/gfx-rs/wgpu/issues/8393
78- " RUSTSEC-2025-0075" ,
79- " RUSTSEC-2025-0080" ,
80- " RUSTSEC-2025-0081" ,
81- " RUSTSEC-2025-0098" ,
82- " RUSTSEC-2025-0100" ,
8334 # `bincode` is no longer maintained https://rustsec.org/advisories/RUSTSEC-2025-0141
8435 # We only use it directly for tests and tools. It is also used indirectly via deno.
8536 " RUSTSEC-2025-0141" ,
@@ -88,27 +39,16 @@ ignore = [
8839[licenses ]
8940allow = [
9041 " Apache-2.0" ,
91- " Apache-2.0 WITH LLVM-exception" ,
9242 " BSD-2-Clause" ,
9343 " BSD-3-Clause" ,
9444 " ISC" ,
95- " MPL-2.0" ,
9645 " MIT" ,
97- " MIT-0" ,
9846 " Unicode-3.0" ,
9947 " Zlib" ,
10048]
10149private = { ignore = true }
10250
10351[sources ]
104- allow-git = [
105- # Waiting on releases; used in examples/tests only
106-
107- # Pending a release for https://github.com/rust-cli/env_logger/commit/143fa647ab33ed3acc9f160dfa3cb075cc62b5a3
108- " https://github.com/rust-cli/env_logger" ,
109- # Pending merge/release for https://github.com/LukasKalbertodt/libtest-mimic/pull/58
110- " https://github.com/cwfitzgerald/libtest-mimic" ,
111- ]
11252unknown-registry = " deny"
11353unknown-git = " deny"
11454required-git-spec = " rev"
0 commit comments