deny.toml

# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/

# =============================================================================
# Dependency Graph Configuration
# =============================================================================
[graph]
all-features = true
no-default-features = false

[output]
feature-depth = 1

# =============================================================================
# Security Advisories
# =============================================================================
[advisories]
# Ignored advisories (use sparingly - document the reason)
ignore = [
  # paste is unmaintained but pulled in transitively via alloy (blockchain dependencies)
  # TODO: Monitor https://github.com/alloy-rs/alloy for migration to pastey or alternative
  { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained but a transitive dependency via alloy" },

  # rustls-pemfile is unmaintained, pulled in via nautilus-network and various TLS dependencies
  # Users are encouraged to migrate to rustls-pki-types directly but dependencies haven't updated yet
  # This is not a security vulnerability, just a maintenance status advisory
  # TODO: Monitor upstream TLS dependencies for migration
  { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained, transitive via nautilus-network (not a security vulnerability)" },

  # unic-* crates are unmaintained, pulled in via pyo3-stub-gen→rustpython-parser
  # This is dev-time only for generating .pyi stub files, not a runtime security risk
  # TODO: Monitor https://github.com/Jij-Inc/pyo3-stub-gen for migration away from rustpython-parser
  { id = "RUSTSEC-2025-0075", reason = "unic-char-range unmaintained, transitive via pyo3-stub-gen (dev tool only)" },
  { id = "RUSTSEC-2025-0080", reason = "unic-ucd-ident unmaintained, transitive via pyo3-stub-gen (dev tool only)" },
  { id = "RUSTSEC-2025-0081", reason = "unic-char-property unmaintained, transitive via pyo3-stub-gen (dev tool only)" },
  { id = "RUSTSEC-2025-0090", reason = "unic-emoji-char unmaintained, transitive via pyo3-stub-gen (dev tool only)" },
  { id = "RUSTSEC-2025-0098", reason = "unic-ucd-version unmaintained, transitive via pyo3-stub-gen (dev tool only)" },
  { id = "RUSTSEC-2025-0100", reason = "unic-common unmaintained, transitive via pyo3-stub-gen (dev tool only)" },

  # bincode is unmaintained, pulled in via hypersync-client (blockchain adapter)
  # The team considers 1.3.3 a complete version, not a security vulnerability
  # TODO: Monitor https://github.com/enviodev/hypersync-client-rust for migration to alternative serialization
  { id = "RUSTSEC-2025-0141", reason = "bincode unmaintained, transitive via hypersync-client (not a security vulnerability)" },

  # capnp unsound APIs in constant::Reader and StructSchema
  # Transitive via hypersync-client, fix requires upstream update to capnp >= 0.24.0
  # Low risk: only affects internal schema handling, not directly exposed
  # TODO: Monitor https://github.com/enviodev/hypersync-client-rust for capnp update
  { id = "RUSTSEC-2025-0143", reason = "capnp unsound APIs, transitive via hypersync-client, awaiting upstream fix" },

]

# =============================================================================
# License Configuration
# =============================================================================
[licenses]
# Licenses compatible with LGPL-3.0
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-2-Clause-Patent",
  "BSD-3-Clause",
  "BSL-1.0",
  "ISC",
  "MPL-2.0",
  "CC0-1.0",
  "CDLA-Permissive-2.0",
  "Zlib",
  "Unicode-DFS-2016",
  "Unicode-3.0",
  "0BSD",
  "LGPL-3.0",
  "LGPL-3.0-only",
  "LGPL-3.0-or-later",
  "OpenSSL",
  "Unlicense",
]

confidence-threshold = 0.8

# Clarify licenses for crates with missing/incorrect license metadata
[[licenses.clarify]]
name = "implied-vol"
version = "*"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0xb0803f0e }]

# dydx-proto uses "LicenseRef-dYdX-Custom" but is effectively MIT licensed.
# The dYdX custom license is a permissive license compatible with MIT terms.
# See: https://github.com/dydxprotocol/v4-chain/blob/main/LICENSE
[[licenses.clarify]]
name = "dydx-proto"
version = "*"
expression = "MIT"
license-files = []

[licenses.private]
# Ignore workspace crates that aren't published
# Note: All workspace crates in this project are LGPL-3.0 (project license)
# If adding workspace crates with different licenses, set this to false
ignore = true
registries = []

# =============================================================================
# Banned/Duplicate Crates
# =============================================================================
[bans]
# Deny multiple versions of the same crate to catch new duplicates we introduce.
# Known transitive duplicates from upstream are allowlisted in `skip` below.
# Review this list periodically when upgrading dependencies.
multiple-versions = "deny"

# Deny wildcard version requirements (*)
# Prevents uncontrolled version drift and supply-chain attacks
wildcards = "deny"

highlight = "all"

workspace-default-features = "allow"
external-default-features = "allow"

# Explicitly allowed crates (use with care)
allow = []

# Explicitly denied crates
deny = []

# Skip certain crates during duplicate detection.
# These are transitive duplicates from upstream crates outside our control.
# Last reviewed: 2025-11-29
skip = [
  # Crypto ecosystem - version-locked together, pulled by various blockchain crates
  { crate = "block-buffer" },
  { crate = "digest" },
  { crate = "sha2" },

  # RNG ecosystem - version-locked together, pulled by crypto and blockchain crates
  { crate = "getrandom" },
  { crate = "rand" },
  { crate = "rand_chacha" },
  { crate = "rand_core" },

  # Proc-macro helpers - transitive via derive macros in various crates
  { crate = "darling" },
  { crate = "darling_core" },
  { crate = "darling_macro" },
  { crate = "derive_more" },
  { crate = "derive_more-impl" },

  # Case conversion - version fragmentation via derive_more
  { crate = "convert_case" },

  # Common utility crates with version fragmentation across ecosystem
  { crate = "base64" },
  { crate = "hashbrown" },
  { crate = "itertools" },
  { crate = "foldhash" },
  { crate = "rustc-hash" },
  { crate = "ordered-float" },
  { crate = "petgraph" },
  { crate = "socket2" },

  # Perfect hash function crates - transitive
  { crate = "phf" },
  { crate = "phf_shared" },

  # Error handling - thiserror 1.x vs 2.x transition in progress
  { crate = "thiserror" },
  { crate = "thiserror-impl" },

  # CPU feature detection - cpufeatures 0.2 vs 0.3 (const-hex vs chacha20/rand)
  { crate = "cpufeatures" },

  # HTTP client - reqwest 0.12 vs 0.13 transition (databento, hypersync, object_store on 0.12)
  { crate = "reqwest" },
  { crate = "wasm-streams" },

  # Cap'n Proto - hypersync-client uses 0.23.x, nautilus-serialization uses 0.25.0
  { crate = "capnp" },

  # TOML parser - cbindgen requires 0.9.x, pyo3-stub-gen requires 1.0.x
  { crate = "toml" },
  { crate = "toml_datetime" },

  # TLS roots - version fragmentation in TLS ecosystem
  { crate = "webpki-roots" },

  # Windows platform crates - notoriously fragmented across Windows SDK versions
  { crate = "windows-sys" },
  { crate = "windows-targets" },
  { crate = "windows_aarch64_gnullvm" },
  { crate = "windows_aarch64_msvc" },
  { crate = "windows_i686_gnu" },
  { crate = "windows_i686_gnullvm" },
  { crate = "windows_i686_msvc" },
  { crate = "windows_x86_64_gnu" },
  { crate = "windows_x86_64_gnullvm" },
  { crate = "windows_x86_64_msvc" },
]

skip-tree = []

# =============================================================================
# Dependency Sources
# =============================================================================
[sources]
# Only allow dependencies from crates.io
unknown-registry = "deny"
unknown-git = "deny"

allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []