deny.toml

# cargo-deny configuration for Lighthouse
# See https://embarkstudios.github.io/cargo-deny/

[bans]
# Allow multiple versions by default. Change this to "warn" to see all multiple versions.
multiple-versions = "allow"
deny = [
    { crate = "ethers", reason = "legacy Ethereum crate, use alloy instead" },
    { crate = "ethereum-types", reason = "legacy Ethereum crate, use alloy-primitives instead" },
    { crate = "protobuf", reason = "use quick-protobuf instead" },
    { crate = "derivative", reason = "use educe or derive_more instead" },
    { crate = "ark-ff", reason = "present in Cargo.lock but not needed by Lighthouse" },
    { crate = "openssl", reason = "non-Rust dependency, use rustls instead" },
    { crate = "strum", deny-multiple-versions = true, reason = "takes a long time to compile" },
    { crate = "reqwest", deny-multiple-versions = true, reason = "takes a long time to compile" },
    { crate = "aes", deny-multiple-versions = true, reason = "takes a long time to compile" },
    { crate = "sha2", deny-multiple-versions = true, reason = "takes a long time to compile" },
    { crate = "pbkdf2", deny-multiple-versions = true, reason = "takes a long time to compile" },
    { crate = "scrypt", deny-multiple-versions = true, reason = "takes a long time to compile" },
    # syn 1 and 2 coexist in the proc-macro ecosystem (for example via
    # data-encoding-macro-internal -> multibase -> multiaddr). Upstream lockfiles
    # also currently carry both, so forbidding duplicate syn versions is not
    # realistic without broader dependency changes.
    { crate = "uuid", deny-multiple-versions = true, reason = "dependency hygiene" },
]

[sources]
unknown-registry = "deny"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]

[sources.allow-org]
github = ["sigp"]