deny.toml

# cargo-deny configuration — supply-chain gate (advisories, licenses, bans, sources).
# Run locally with `cargo deny check`; CI runs the same in the `supply-chain` job.

[graph]
# Scan the feature-expanded graph, not just default features. The `live` feature
# pulls the native exchange facade (tokio/reqwest/rustls) and the webpki-roots
# exception below exists only for that tree — without this the checks never saw
# it at all, and the exception sat unevaluated.
all-features = true

[advisories]
version = 2
yanked = "deny"
# No advisories are currently suppressed. RUSTSEC-2024-0436 (paste,
# unmaintained) used to be ignored here for ratatui's sake; ratatui 0.30 dropped
# the dependency, cargo-deny now reports the entry as unmatched, and a
# suppression that matches nothing only hides the next real one. Any new entry
# must be added to osv-scanner.toml in the same commit.

[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "MPL-2.0",
]
confidence-threshold = 0.93

# Scoped license exceptions for individual permissive / public-domain crates:
#   - webpki-roots (CDLA-Permissive-2.0): the Mozilla CA certificate bundle as
#     data, pulled in transitively by the exchange's rustls TLS stack.
exceptions = [
    { allow = ["CDLA-Permissive-2.0"], crate = "webpki-roots" },
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
# Internal workspace crates may be referenced by `path`, which reads as a wildcard
# requirement but is not an unpinned external dependency.
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"

# The exchange is consumed as a git dependency until its first crates.io release;
# it lives under the project's own GitHub org.
[sources.allow-org]
github = ["wickra-lib"]