deny.toml

# `cargo-deny` configuration.

feature-depth = 1

[advisories]
db-urls = ["https://github.com/rustsec/advisory-db"]
vulnerability = "deny"
unmaintained = "deny"
unsound = "deny"
yanked = "deny"
notice = "warn"
severity-threshold = "Medium"
ignore = [
  # `mach` crate is unmaintained; used by `wasmtime` (i.e., only by a dev dependency)
  "RUSTSEC-2020-0168",
  # Unaligned read in `atty`; requires a custom global allocator which we don't use.
  "RUSTSEC-2021-0145",
]

[licenses]
unlicensed = "deny"
allow = [
  # Permissive open-source licenses
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "Unicode-DFS-2016",
]
copyleft = "deny"
allow-osi-fsf-free = "neither"
default = "deny"
confidence-threshold = 0.8

[bans]
multiple-versions = "deny"
wildcards = "deny"
allow-wildcard-paths = true
skip = [
  # `syn` 1.x is still used by `walrus` proc macros
  { name = "syn", version = "^1.0" },
  # Relied upon by `walrus-macro`; since it's a proc macro dep, duplication is sort of fine
  { name = "heck", version = "^0.3" },
]
skip-tree = [
  # Relied upon by `tracing` (via `regex`); no fix is possible ATM
  { name = "regex-automata", version = "^0.1" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"