deny.toml

# cargo-deny configuration (v0.19+)
# https://embarkstudios.github.io/cargo-deny/

[graph]
targets = []
all-features = false

[advisories]
ignore = [
    # instant is unmaintained but deeply transitive; no replacement yet
    "RUSTSEC-2024-0384",
    # protobuf recursion crash - we don't use protobuf for untrusted input parsing
    "RUSTSEC-2024-0437",
    # rand unsound with custom logger - we don't use custom loggers with rand
    "RUSTSEC-2025-0015",
    # rustls-pemfile unmaintained
    "RUSTSEC-2025-0019",
    # dashmap unsound IterMut invalidating pointer
    "RUSTSEC-2024-0430",
    # dashmap v6 IterMut stacked borrows
    "RUSTSEC-2026-0002",
    # rand unsound with custom logger (v2)
    "RUSTSEC-2026-0097",
    # rustls-pemfile unmaintained (v2)
    "RUSTSEC-2025-0134",
    # (RUSTSEC-2026-0009 time<0.3.47 RFC 2822 DoS — DROPPED S37-D: time bumped to
    #  0.3.47 (the fix; MSRV is 1.88, which admits it). Advisory no longer applies.)
    # yaml-rust 0.4 unmaintained. Transitive via foundations 4.5.0 (HELD-BY-UPSTREAM:
    # quiche 0.29.1 -> qlog 0.18 -> foundations ^4, so foundations cannot move to 5.x
    # without a quiche/qlog bump — quiche 0.29.1 is latest) -> serde_yaml 0.8 ->
    # yaml-rust. foundations is Cloudflare-maintained and ships in tokio-quiche; its
    # YAML surface parses only their telemetry config, never ExpressGateway-supplied
    # input. Revisit once quiche/qlog adopt foundations 5.x (which drops serde_yaml).
    "RUSTSEC-2024-0320",
    # proc-macro-error2 unmaintained (RUSTSEC-2026-0173, published 2026-06; first appeared
    # mid-S37 as a NEW advisory). BUILD-TIME proc-macro only (getset derive), never in the
    # runtime binary. Transitive via the SAME foundations 4.5.0 held-by-upstream chain:
    # foundations -> cf-rustracing-jaeger -> local-ip-address -> neli -> getset (proc-macro)
    # -> proc-macro-error2. Unmaintained advisory, not a vulnerability; no reachable runtime
    # surface. Revisit once quiche/qlog adopt foundations 5.x (same trigger as RUSTSEC-2024-0320).
    "RUSTSEC-2026-0173",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "BSL-1.0",
    "CC0-1.0",
    "GPL-3.0-only",
    "GPL-3.0-or-later",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[[licenses.clarify]]
name = "ring"
expression = "ISC AND MIT AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 },
]

[bans]
multiple-versions = "warn"
wildcards = "allow"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []