deny.toml

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# >>> anvil-managed: anvil-deny-advisories
[advisories]
yanked = "deny"
# Scope of unmaintained-crate checks: "all" surfaces transitive
# dependencies too; tighten to "workspace" if the noise is high.
unmaintained = "all"
# <<< anvil-managed: anvil-deny-advisories

# Advisories we have consciously accepted. Each entry needs a reason and,
# where the fix is out of our hands, the upstream we are waiting on.
ignore = []

# >>> anvil-managed: anvil-deny-bans
[bans]
multiple-versions = "warn"
wildcards = "deny"
allow-wildcard-paths = true
# <<< anvil-managed: anvil-deny-bans

# >>> anvil-managed: anvil-deny-sources
[sources]
unknown-registry = "deny"
unknown-git = "deny"
# <<< anvil-managed: anvil-deny-sources

# >>> anvil-managed: anvil-deny-licenses
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
]
confidence-threshold = 0.93
# <<< anvil-managed: anvil-deny-licenses

# Repository-specific allowances belong outside the generated defaults.
# Scope them to the dependencies that require them, not every future crate.
exceptions = [
    # Public-domain-equivalent license carried by `vu128`, the variable-length
    # integer codec behind `cargo-aprz`'s binary crates.io tables. It is the
    # crate's only license, so it cannot resolve to one of the entries above.
    { crate = "vu128", allow = ["0BSD"] },
    # Data-only license carried by `webpki-root-certs` (the Mozilla root
    # certificate set), pulled in transitively by `reqwest`'s rustls backend.
    { crate = "webpki-root-certs", allow = ["CDLA-Permissive-2.0"] },
]