hyper-api-rust/deny.toml at main · tableau/hyper-api-rust · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# cargo-deny configuration for hyper-api-rust.
#
# Enforces license policy, RustSec advisories, and banned/duplicate crates on
# every PR via the `cargo-deny` CI job. Pairs with `.cargo/audit.toml`, which
# mirrors the advisory ignore list.

[graph]
# Check the dependency graph for every workspace crate's default features.
all-features = false
no-default-features = false

[output]
feature-depth = 1

# -------------------------------------------------------------------------
# Licenses
# -------------------------------------------------------------------------

[licenses]
# We distribute under a dual MIT OR Apache-2.0 license. The allowlist below
# lists every SPDX identifier we accept from dependencies. Copyleft licenses
# (GPL, LGPL, AGPL, SSPL) are deliberately absent.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    # `webpki-roots` publishes the Mozilla Root Store under CDLA-Permissive-2.0
    # (Community Data License Agreement Permissive 2.0). Permissive data license
    # compatible with our dual MIT/Apache-2.0 distribution:
    # https://spdx.org/licenses/CDLA-Permissive-2.0.html
    "CDLA-Permissive-2.0",
    "ISC",
    "MPL-2.0",
    "Unicode-3.0",
    "Zlib",
]
confidence-threshold = 0.8

# -------------------------------------------------------------------------
# Advisories
# -------------------------------------------------------------------------

[advisories]
# Use the upstream RustSec advisory database.
db-urls = ["https://github.com/rustsec/advisory-db"]
# Allow yanked crates to surface as warnings rather than failures during
# development — publishing gates catch them separately.
yanked = "warn"
# Specific advisories we have reviewed and chosen to waive. Keep this list
# short — each entry needs a comment explaining the mitigation.
ignore = [
    # `paste` is unmaintained, pulled transitively by `parquet` (hyperapi-mcp).
    # Macro-only crate — no runtime risk. Drops out when parquet migrates.
    { id = "RUSTSEC-2024-0436", reason = "paste is macro-only, no runtime risk; pulled by parquet only" },
    # `rsa` Marvin Attack: no patch available. The `rsa` crate is used by
    # `jsonwebtoken` inside `hyperapi-salesforce` for signing client JWTs for
    # Salesforce OAuth — this is *outbound* signing where timing sidechannels
    # are not observable to a remote attacker, so the Marvin Attack threat
    # model does not apply. Re-evaluate when `rsa` publishes the constant-time
    # implementation.
    { id = "RUSTSEC-2023-0071", reason = "rsa used only for outbound JWT signing where Marvin Attack threat model does not apply" },
    # `ttf-parser` is unmaintained (RUSTSEC-2026-0192, informational — author has
    # stepped away; no patched version exists, the advisory flags all versions).
    # Pulled transitively via `plotters` (chart rendering in hyperdb-mcp); we never
    # call it directly. Not a vulnerability — no runtime risk. Plotters has no
    # maintained-font backend yet (both `ttf` and `ab_glyph` paths end at
    # ttf-parser); tracking upstream at plotters-rs/plotters#736. Re-evaluate when
    # plotters migrates its font stack (e.g. to skrifa).
    { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained, no patch exists; transitive via plotters chart rendering, no direct use, no runtime risk" },
]

# Forward-looking note (no waiver yet — RustSec hasn't issued an ID):
# CVE-2026-43868 / GHSA-2f9f-gq7v-9h6m affects the `thrift` Rust crate
# (≤ 0.22.0). The latest published version on crates.io is 0.17.0 — Apache
# Thrift has not released a fixed Rust crate (the project's "0.23.0 fix"
# is in C++/Java/Python only). We pull `thrift` transitively via `parquet`
# in hyperdb-mcp (parquet metadata parsing only — used against operator-
# supplied local files via `load_file`/`query_file`/`export`). When
# RustSec assigns a `RUSTSEC-2026-NNNN` ID, add it to the ignore list
# above with rationale: "thrift transitively via parquet; no fix
# available on crates.io; operator-controlled inputs only."

# -------------------------------------------------------------------------
# Banned / duplicate crates
# -------------------------------------------------------------------------

[bans]
# Multiple versions of the same crate bloat binaries and increase audit
# surface. Start permissive (warn) — we'll tighten as the workspace stabilizes.
multiple-versions = "warn"
# Downgraded to `warn` until the publishing story is settled for internal
# helper crates (`hyper-types`, `hyper-protocol`, `hyper-client`). The
# published crates (`hyperapi`, `hyperapi-salesforce`, `sea-query-hyper`)
# currently depend on them via `path` without a `version` field — this is
# fine for local development but `cargo publish` will reject it until the
# helpers are either inlined into `hyperapi` or published themselves. Track
# separately; the Microsoft Rust Guidelines adoption does not block on it.
wildcards = "warn"
allow-wildcard-paths = true
# Explicit allow / deny lists. Empty by default; add entries as needed with
# a comment explaining why.
deny = []
allow = []
skip = []
skip-tree = []

# -------------------------------------------------------------------------
# Sources
# -------------------------------------------------------------------------

[sources]
unknown-registry = "deny"
unknown-git      = "deny"
allow-registry   = ["https://github.com/rust-lang/crates.io-index"]
allow-git        = []