oxidizer/deny.toml at main · microsoft/oxidizer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

[licenses]
allow = [
    # You can add new entries to the list only from "Permissive OSS licenses" on this Microsoft-internal page: https://docs.opensource.microsoft.com/legal/resources/oss-licenses-by-type/.
    "MIT",
    "Apache-2.0",
    "ISC",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "BSL-1.0",
    # CDLA-Permissive-2.0 covers the Mozilla CA certificate data bundled by
    # `webpki-root-certs` (pulled in transitively via `rustls-platform-verifier`).
    "CDLA-Permissive-2.0",
]

confidence-threshold = 0.8
unused-allowed-license = "allow"

[advisories]
ignore = [
    # bincode 1.3.3 is unmaintained but pulled in only as a transitive dev-dependency
    # of `gungraun` (used for Callgrind benchmarks in the `multitude` crate). The bincode
    # team considers 1.3.3 a complete release; there is no safe upgrade path. We accept
    # this for benchmark-only usage.
    "RUSTSEC-2025-0141",
    # proc-macro-error2 is unmaintained but pulled in only via build/dev tooling
    # (gungraun-macros, a dev/bench dep of `multitude`). No safe upgrade is available
    # upstream and no production code path depends on it. Tracked for removal once the
    # upstream migration lands: https://github.com/GnomedDev/proc-macro-error-2/issues/17
    "RUSTSEC-2026-0173",
    # quick-xml 0.39.4 has two DoS advisories on untrusted XML: RUSTSEC-2026-0194 (quadratic
    # run time when checking a start tag for duplicate attributes, CPU exhaustion) and
    # RUSTSEC-2026-0195 (unbounded namespace-declaration allocation in `NsReader`, memory
    # exhaustion). It is pulled in only transitively via the Azure SDK (`typespec` ->
    # `azure_core` / `typespec_client_core`, used by `fetch_azure`, `anyspawn_azure`,
    # `azure_storage_blob`, `azure_identity`). Both are fixed in quick-xml >=0.41.0, but
    # `typespec 1.0.0` pins `quick-xml = "^0.39.0"`, so there is no safe upgrade path until
    # the Azure SDK loosens that requirement. Azure SDK PR
    # https://github.com/Azure/azure-sdk-for-rust/pull/4691 updates the pin; remove these
    # ignores (and update the Azure SDK dependencies to quick-xml >=0.41.0) once it merges.
    # https://rustsec.org/advisories/RUSTSEC-2026-0194
    # https://rustsec.org/advisories/RUSTSEC-2026-0195
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]