deny.toml

# cargo-deny configuration (v2 schema)
# Derived from: loong-research/11-code-quality/synthesis/loong-code-quality-strategy-v2.md

[graph]
targets = [
    "x86_64-unknown-linux-gnu",
    "aarch64-unknown-linux-gnu",
    "x86_64-apple-darwin",
    "aarch64-apple-darwin",
]

[advisories]
ignore = [
    "RUSTSEC-2024-0388", # derivative unmaintained — transitive dep of starlark 0.13 used only for local bash rule parsing
    "RUSTSEC-2024-0436", # paste unmaintained — transitive dep of starlark 0.13 used only for local bash rule parsing
    "RUSTSEC-2025-0057", # fxhash unmaintained — transitive dep of scraper 0.24, no security impact
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "0BSD",
    "CC0-1.0",
    "ISC",
    "MPL-2.0",
    "Unicode-3.0",
    "Zlib",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[bans]
multiple-versions = "warn"
highlight = "all"
wildcards = "allow"
deny = [
    { crate = "openssl", reason = "use rustls for pure-Rust TLS" },
    { crate = "openssl-sys", reason = "use rustls for pure-Rust TLS" },
]
skip-tree = []
skip = [
    # starlark/lsp compatibility stack
    { name = "bitflags", version = "1.3.2" },
    { name = "derive_more", version = "1.0.0" },
    { name = "derive_more-impl", version = "1.0.0" },
    { name = "strsim", version = "0.10.0" },
    { name = "syn", version = "1.0.109" },
    { name = "thiserror", version = "1.0.69" },
    { name = "thiserror-impl", version = "1.0.69" },
    { name = "unicode-width", version = "0.1.14" },
    # aws/crypto split between 0.10 and 0.11 digest families
    { name = "block-buffer", version = "0.10.4" },
    { name = "cpufeatures", version = "0.2.17" },
    { name = "crypto-common", version = "0.1.7" },
    { name = "digest", version = "0.10.7" },
    { name = "hmac", version = "0.12.1" },
    { name = "sha2", version = "0.10.9" },
    # transport/runtime stacks pinned by major-version boundaries
    { name = "getrandom", version = "0.2.17" },
    { name = "getrandom", version = "0.3.4" },
    { name = "hashbrown", version = "0.14.5" },
    { name = "hashbrown", version = "0.15.5" },
    { name = "http", version = "0.2.12" },
    { name = "http-body", version = "0.4.6" },
    { name = "itertools", version = "0.10.5" },
    { name = "itertools", version = "0.13.0" },
    { name = "phf_shared", version = "0.11.3" },
    { name = "rand", version = "0.9.2" },
    { name = "rand_core", version = "0.9.5" },
    { name = "regex-syntax", version = "0.6.29" },
    { name = "string_cache", version = "0.8.9" },
    { name = "wasmparser", version = "0.245.1" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []