| 1 | # cargo-deny configuration for CodeWhale |
| 2 | # https://embarkstudios.github.io/cargo-deny/ |
| 3 | |
| 4 | [graph] |
| 5 | # Scan all workspace members with all features |
| 6 | all-features = true |
| 7 | |
| 8 | [advisories] |
| 9 | # Deny unmaintained and unsound crates |
| 10 | unmaintained = "all" |
| 11 | unsound = "all" |
| 12 | # Scoped maintenance exception; consumer and retirement criteria are documented |
| 13 | # in docs/dependency-maintenance.md. No vulnerability/unsoundness ignore is added. |
| 14 | ignore = [ |
| 15 | "RUSTSEC-2025-0141", # bincode 1.3.3: syntect's embedded syntax/theme dumps |
| 16 | ] |
| 17 | |
| 18 | [bans] |
| 19 | # Duplicate-version ratchet (Epic #5249, issue #5248): keep the gate in |
| 20 | # warn/dry-run until Hunter approves enforcement. Each entry below is a |
| 21 | # duplicate that survives the 0.9.5 shrink and is blocked on an upstream |
| 22 | # crate that has not yet released a compatible version. Adding a new |
| 23 | # duplicate without extending this list will surface as a new `cargo deny` |
| 24 | # warning, so the ratchet is warm but not yet blocking CI. |
| 25 | # Surviving duplicates after the 708 -> 679 shrink (see PR body): |
| 26 | # - reqwest 0.12 vs 0.13 — blocked on oauth2 5.0.0 which still depends on reqwest 0.12 |
| 27 | # - sha2 0.10 vs 0.11 — blocked on oauth2 (0.10) vs schemaui 0.12 (0.11) |
| 28 | # - thiserror 1 vs 2 — blocked on portable-pty 0.9 via filedescriptor 0.8 (v1) vs workspace v2 |
| 29 | # - toml 0.8 vs 1.1 + toml_edit 0.22 vs 0.25 + winnow 0.7 vs 1.0 — blocked on rust-i18n 4.2 (0.8 stack) vs workspace 1.1 |
| 30 | # - strum 0.27 vs 0.28 — ratatui-widgets 0.3.0 (via ratatui 0.30.0) pins 0.27 |
| 31 | # while ratatui-core 0.1.2 uses 0.28; unifies once widgets moves forward |
| 32 | multiple-versions = "warn" |
| 33 | wildcards = "deny" |
| 34 | # Explicitly allow the surviving duplicates so `cargo deny` does not warn |
| 35 | # on them again, but will warn on any *new* duplicate crate. |
| 36 | skip = [ |
| 37 | { name = "reqwest", version = "0.12.28" }, |
| 38 | { name = "sha2", version = "0.10.9" }, |
| 39 | { name = "thiserror", version = "1.0.69" }, |
| 40 | { name = "thiserror-impl", version = "1.0.69" }, |
| 41 | { name = "toml", version = "0.8.23" }, |
| 42 | { name = "toml_datetime", version = "0.6.11" }, |
| 43 | { name = "toml_edit", version = "0.22.27" }, |
| 44 | { name = "winnow", version = "0.7.14" }, |
| 45 | { name = "serde_spanned", version = "0.6.9" }, |
| 46 | { name = "core-foundation", version = "0.9.4" }, |
| 47 | { name = "fancy-regex", version = "0.16.2" }, |
| 48 | { name = "itertools", version = "0.13.0" }, |
| 49 | { name = "security-framework", version = "2.11.1" }, |
| 50 | { name = "strum", version = "0.28.0" }, |
| 51 | { name = "strum_macros", version = "0.28.0" }, |
| 52 | { name = "windows-sys" }, |
| 53 | { name = "windows-targets" }, |
| 54 | { name = "windows_aarch64_gnullvm" }, |
| 55 | { name = "windows_aarch64_msvc" }, |
| 56 | { name = "windows_i686_gnu" }, |
| 57 | { name = "windows_i686_msvc" }, |
| 58 | { name = "windows_x86_64_gnu" }, |
| 59 | { name = "windows_x86_64_gnullvm" }, |
| 60 | { name = "windows_x86_64_msvc" }, |
| 61 | ] |
| 62 | # For crates where the version is not the discriminator, use skip-tree to |
| 63 | # allow the duplicate tree regardless of version. |
| 64 | skip-tree = [ |
| 65 | { name = "portable-pty" }, |
| 66 | { name = "rust-i18n" }, |
| 67 | { name = "oauth2" }, |
| 68 | ] |
| 69 | |
| 70 | [sources] |
| 71 | # Deny unknown registries and git sources |
| 72 | unknown-registry = "deny" |
| 73 | unknown-git = "deny" |
| 74 | # Allow only crates.io |
| 75 | allow-registry = ["https://github.com/rust-lang/crates.io-index"] |
| 76 | # Allow git sources used by the project (add as needed) |
| 77 | allow-git = [] |
| 78 | |
| 79 | [licenses] |
| 80 | # Confidence threshold for license inference from text |
| 81 | confidence-threshold = 0.93 |
| 82 | # Allowed licenses (MIT for CodeWhale, plus common transitive deps) |
| 83 | allow = [ |
| 84 | "MIT", |
| 85 | "MIT-0", |
| 86 | "Apache-2.0", |
| 87 | "Apache-2.0 WITH LLVM-exception", |
| 88 | "ISC", |
| 89 | "Unicode-3.0", |
| 90 | "Unicode-DFS-2016", |
| 91 | "Zlib", |
| 92 | "BSD-2-Clause", |
| 93 | "BSD-3-Clause", |
| 94 | "0BSD", |
| 95 | "MPL-2.0", |
| 96 | "CC0-1.0", |
| 97 | "BSL-1.0", |
| 98 | "CDLA-Permissive-2.0", |
| 99 | ] |
| 100 | # License exceptions for specific crates if needed |
| 101 | exceptions = [] |
| 102 |