deny.toml

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

[licenses]
allow = [
    # You can add new entries to the list only from "Permissive OSS licenses" on this Microsoft-internal page: https://docs.opensource.microsoft.com/legal/resources/oss-licenses-by-type/.
    "MIT",
    "Apache-2.0",
    "ISC",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "BSL-1.0",
    # CDLA-Permissive-2.0 covers the Mozilla CA certificate data bundled by
    # `webpki-root-certs` (pulled in transitively via `rustls-platform-verifier`).
    "CDLA-Permissive-2.0",
]

confidence-threshold = 0.8
unused-allowed-license = "allow"

[advisories]
ignore = [
    # bincode 1.3.3 is unmaintained but pulled in only as a transitive dev-dependency
    # of `gungraun` (used for Callgrind benchmarks in the `multitude` crate). The bincode
    # team considers 1.3.3 a complete release; there is no safe upgrade path. We accept
    # this for benchmark-only usage.
    "RUSTSEC-2025-0141",
    # proc-macro-error2 is unmaintained but pulled in only via build/dev tooling
    # (gungraun-macros, a dev/bench dep of `multitude`). No safe upgrade is available
    # upstream and no production code path depends on it. Tracked for removal once the
    # upstream migration lands: https://github.com/GnomedDev/proc-macro-error-2/issues/17
    "RUSTSEC-2026-0173",
]