deny.toml

# cargo-deny config. Scoped weekly via .github/workflows/security.yml.
# Not run on PR — that was the cargo-audit theater this replaces. Real
# regressions open a GitHub issue.

[graph]
all-features = true

[advisories]
version = 2
yanked = "deny"
ignore = [
  # sqlx unconditionally resolves sqlx-mysql in its proc-macro crate
  # (sqlx-macros-core) even when only the postgres feature is enabled. We
  # don't use MySQL and rsa is never compiled into the binary. No fix is
  # available upstream. Migrated from .cargo/audit.toml.
  { id = "RUSTSEC-2023-0071", reason = "sqlx-macros-core pulls in sqlx-mysql/rsa transitively; postgres-only build, no fix upstream" },
]

[licenses]
version = 2
# Permissive licenses allowed across the workspace + transitive deps.
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-3.0",
  "Unicode-DFS-2016",
  "Zlib",
  "MPL-2.0",
  "CC0-1.0",
  "0BSD",
  "BSL-1.0",
]
confidence-threshold = 0.8
unused-allowed-license = "allow"
# Weak-copyleft / corporate-unfriendly licenses are denied by omission from
# `allow`. Per-crate exceptions (e.g. ring's BoringSSL bits) go in `exceptions`.
exceptions = []

[bans]
multiple-versions = "allow"
wildcards = "allow"
# Populate when concrete bans are decided (e.g. ban openssl<0.10, tokio<1).
deny = []
skip = []
skip-tree = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []