Cargo.toml

[workspace]
members = ["crates/kekse", "crates/keksbruch", "crates/rfc_6265"]
# Resolver v3 (Rust 1.84+) makes future `cargo update` runs MSRV-aware, which
# protects the sealed `msrv` CI leg from a dependency raising its floor.
resolver = "3"

[workspace.package]
version = "0.2.1"
authors = ["Stefan Grönke"]
homepage = "https://github.com/gronke/kekse"
repository = "https://github.com/gronke/kekse"
license = "MIT"
edition = "2024"
# MSRV. The floor is the `time` crate (used to parse and format `Expires`
# dates), which requires Rust 1.88 / edition 2024; CI's `msrv` leg builds the
# workspace at exactly this version. At 1.88 the optional `axum` feature
# (axum-core 0.5, which needs 1.78) is comfortably within the guarantee, so every
# feature builds on MSRV.
rust-version = "1.88.0"

# Shared dependency versions for the workspace's crates.
[workspace.dependencies]
# The RFC 6265 §4.1.1 cookie-value set is defined on top of this primitive.
percent-encoding = "2"
# RFC 7230 token grammar for cookie-names (via `http`'s `HeaderName`), borrowed
# rather than re-implemented as a homemade table.
http = "1"
# `Expires` dates: parse the RFC 6265 §5.1.1 cookie-date (lenient) and the
# RFC 7231 IMF-fixdate (strict), and format the canonical IMF-fixdate on write.
# This is what pulls kekse's MSRV to 1.88 (see `rust-version` above).
time = { version = "0.3", features = ["std", "parsing", "formatting", "macros"] }
# Fail-soft parse logs a skipped pair at debug level.
tracing = "0.1"
# `FromRequestParts` for the optional `axum` extractor — the light core `axum`
# (0.8) builds on and re-exports, not the whole framework.
axum-core = "0.5"
# Dev-only: the integration tests drive kekse through real axum request /
# response types. `oneshot` is in-memory, so tokio needs only a basic runtime.
axum = { version = "0.8", features = ["macros"] }
tower = "0.5"
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
# Dev-only: keksbruch's generative layer feeding random/mutated wire through the
# universal invariants, and kekse's store send-matching invariants (tests/store.rs).
# Dev-dependencies never reach kekse's consumers, so the dependency-light guarantee
# is untouched, and the MSRV CI leg (a `-p kekse` build) never compiles it.
proptest = "1"
# Dev-only, kekse: criterion micro-benchmarks for the codec hot paths
# (crates/kekse/benches). Default features off: no plotters/rayon trees for
# HTML charts we never render; `cargo_bench_support` wires the `cargo bench`
# runner. Like proptest, never compiled on the MSRV leg.
criterion = { version = "0.8", default-features = false, features = ["cargo_bench_support"] }
# keksbruch differential harness (behind its `differential` feature): the
# JSONL sidecar protocol (serde) and the cross-parser comparators. All optional
# because the matrix is opt-in tooling — its dependency tree stays out of the
# default `cargo test` and out of the MSRV CI leg (which builds only `-p kekse`).
serde = { version = "1", features = ["derive"] }
serde_json = "1"
base64 = "0.22"
cookie = { version = "0.18", features = ["percent-encode"] }
biscotti = "0.4"
# axum's standard cookie extractor (itself a thin layer over the `cookie` crate),
# fed through a real `HeaderValue` so the matrix shows the HTTP-layer boundary.
axum-extra = { version = "0.10", features = ["cookie"] }
# cookie_store: a client-side RFC 6265 cookie jar (on top of the `cookie` crate) — a
# Rust "store" view of Set-Cookie that validates domain-match against a request URL,
# like a browser. `url` supplies that request URL (cookie_store does not re-export it).
cookie_store = "0.22"
url = "2"
# Render the matrix's CSV companion with a real CSV writer (quoting, escaping).
csv = "1.3"
# Entity-encode untrusted cell content (`&`/`<`/`>`) for the matrix's HTML report,
# so a corrupted cookie's `<script>`/markup renders as text and never as live HTML.
html-escape = "0.2"
# Splice the matrix's precompiled table/list fragments into its single prose template.
# default-features off drops the builtin filter/function deps (chrono, rand, …) we never
# use — the template is plain `{{ }}` substitution.
tera = { version = "1", default-features = false }
# Convert the matrix template's prose (and the legend pipe table) to HTML for the report.
# default-features off drops the bundled `getopts` CLI, keeping just the `html` renderer.
pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
# Programmatic, escape-by-default HTML for the matrix tables/lists: every untrusted
# (corrupted-cookie) cell is entity-encoded by construction, not by a remembered call.
maud = "0.27"