deny.toml

# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/

[advisories]
# Check for security vulnerabilities from the RustSec advisory database
db-urls = ["https://github.com/rustsec/advisory-db"]
# Deny crates with known vulnerabilities
# RUSTSEC-2025-0134: rustls-pemfile is unmaintained, but this is a transitive
# dependency of reqwest v0.11 which we cannot upgrade without a larger refactor.
# Not a security vulnerability — the crate still functions correctly.
# RUSTSEC-2026-0097: rand 0.8.5 / 0.9.2 are unsound only when used with a
# custom global logger that calls `rand::rng()` during init. Transitive only
# (tungstenite 0.21 and quinn-proto). ClickGraph does not install a custom
# logger that triggers this pattern, so the unsound path cannot be reached.
ignore = ["RUSTSEC-2025-0134", "RUSTSEC-2026-0097"]

[licenses]
# Allow common permissive and copyleft-compatible licenses
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "OpenSSL",
    # CDLA-Permissive-2.0: used by webpki-roots v1.0.6 (the bundled root-CA
    # trust store pulled in via reqwest+rustls under the `databricks`
    # feature). OSI-approved permissive license intended for data
    # distribution; appropriate for a static cert bundle.
    "CDLA-Permissive-2.0",
]
# Confidence threshold for license detection (0.0 - 1.0)
confidence-threshold = 0.8

[bans]
# Deny multiple versions of the same crate (use warn to start)
multiple-versions = "warn"
# Deny wildcard dependencies
wildcards = "deny"

[sources]
# Only allow crates from crates.io
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]