deny.toml

# cargo-deny configuration.
#
# Enforces three things at CI time:
#   1. No security advisories (`cargo deny check advisories`)
#   2. Only permissive OSS licenses in the dependency tree
#      (`cargo deny check licenses`)
#   3. Only crates.io and our own git repos as sources
#      (`cargo deny check sources`)
#
# Run locally: `cargo deny check`
#
# Kept deliberately close to the Origin workspace's policy so a dependency
# accepted in one repo is not silently rejected in the other. Lite is
# Apache-2.0 rather than BUSL-1.1, which is the only intentional divergence in
# the allow list.

[graph]
all-features = true
# Exclude dev-dependencies from the crate graph (the `check` CLI flag
# `--exclude-dev` was removed in cargo-deny 0.20; it is config-only now).
exclude-dev = true

[advisories]
version = 2
yanked = "deny"
ignore = [
    # Unmaintained transitive crates with no safe upgrade available. Each
    # mirrors an entry in the Origin workspace's deny.toml and is revisited on
    # the same schedule; none has a known security impact on Lite.
    "RUSTSEC-2024-0436", # paste; review-by: 2027-01-31
    "RUSTSEC-2023-0089", # atomic-polyfill; review-by: 2027-01-31
    "RUSTSEC-2021-0153", # encoding; review-by: 2027-01-31
]

[licenses]
version = 2
confidence-threshold = 0.8
allow = [
    # Permissive licenses commonly used by Rust ecosystem deps.
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "0BSD",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "CC0-1.0",
    "MPL-2.0",
    "MIT-0",
    "CDLA-Permissive-2.0",
    "BSL-1.0",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]