deny.toml

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
vulnerability = "deny"
unmaintained = "deny"
yanked = "deny"
notice = "deny"
ignore = [
    "RUSTSEC-2021-0145" # from criterion, used only for benchmarking
]

[licenses]
unlicensed = "deny"
copyleft = "deny"
allow = [
    "MIT",
    "Unicode-DFS-2016",
    "Apache-2.0",
    "Zlib",
    "ISC",
    "BSD-3-Clause"
]
default = "deny"

[bans]
multiple-versions = "deny"
wildcards = "deny"
highlight = "all"
# Certain crates/versions that will be skipped when doing duplicate detection.
skip = [
    # Bypass problems with wildcard dependencies for dev-dependncies.
    # Proper fix requires https://github.com/EmbarkStudios/cargo-deny/issues/448
    { name = "taffy" },

    # This dependency won't actually end up in the final binary anyway as it a sub-dependency
    # of num-cpus and atty only when targetting the hermit unikernel OS
    # (https://github.com/hermitcore/rusty-hermit)
    { name = "hermit-abi" },

    # Long-term we'll want to re-ban this. However it's going to take a while for the ecosystem to
    # transition over to syn 2 and we don't want to block Taffy releases in the meantime.
    { name = "syn" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []