deny.toml

[advisories]
version = 2
yanked = "warn"
# Each entry is individually triaged — see ADR 0011. These are
# unmaintained/unsound *notices*, not exploitable vulnerabilities; cargo-deny
# still hard-fails on any new or actual-vulnerability advisory.
ignore = [
    # async-std discontinued. Dev-only: async-std → async-object-pool →
    # httpmock (a [dev-dependencies] HTTP-test mock). Never in the published
    # crate; no safe upgrade exists. Revisit if httpmock drops it.
    "RUSTSEC-2025-0052",
    # `paste` no longer maintained. Transitive proc-macro (no direct dep);
    # not a vulnerability; no drop-in upstream migration available yet.
    "RUSTSEC-2024-0436",
    # `lru` IterMut Stacked-Borrows unsoundness. Transitive via ratatui 0.29,
    # and only present under the optional `tui` feature (default lib build
    # excludes it). No semver-compatible fix within ratatui 0.29's `lru ^0.12`
    # constraint. Low practical impact (internal TUI cache). Tracked in
    # POST_PUBLISH_ISSUES — revisit when ratatui ships on patched lru.
    "RUSTSEC-2026-0002",
]

[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "MPL-2.0",
    "0BSD",
    # webpki-roots (0.26 + 1.0, via tokio-tungstenite rustls-tls-webpki-roots)
    # ships Mozilla's CA bundle under CDLA-Permissive-2.0 — a permissive,
    # publish-safe data license. See ADR 0011.
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.93

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "warn"
unknown-git = "warn"