deny.toml

[advisories]
unmaintained = "workspace"
yanked = "deny"
ignore = [
    # Pre-existing advisories — tracked for upgrade in separate PRs
    # serde_yml unsound/unmaintained — direct dep, upgrade tracked separately
    "RUSTSEC-2025-0068",
    # tokio-tar PAX header parsing — sandbox containers only
    "RUSTSEC-2025-0111",
    # rustls-webpki CRL distributionPoint matching — 0.102.8 pinned by libsql transitive dep
    "RUSTSEC-2026-0049",
    # rustls-webpki URI name constraint bypass — 0.102.8 pinned by libsql transitive dep;
    # patched in >=0.103.12 but libsql 0.6.0 requires rustls 0.22 which pins 0.102.x
    "RUSTSEC-2026-0098",
    # rustls-webpki wildcard name constraint bypass — same 0.102.8 pin from libsql
    "RUSTSEC-2026-0099",
    # rand unsoundness with custom logger calling rand::rng() during reseed — we don't use this pattern;
    # revisit/remove by 2026-06-30, or when transitive deps (tower, nanoid, phf_generator) release rand ≥0.9.3 compat
    "RUSTSEC-2026-0097",
]

[licenses]
version = 2
allow = [
    "MIT",
    # MIT-0 (MIT No Attribution) is strictly more permissive than MIT —
    # required by `jsonschema` (used for workspace document schema validation).
    "MIT-0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "OpenSSL",
    "Zlib",
    "MPL-2.0",
    "0BSD",
    "BSL-1.0",
    "CC0-1.0",
    "Unlicense",
    "CDLA-Permissive-2.0",
]
unused-allowed-license = "allow"

[bans]
multiple-versions = "warn"
wildcards = "deny"
# monty (Pydantic's embedded Python) is git-only (not on crates.io),
# so it inherently lacks a version constraint. Allow path-dep wildcards.
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
    # Monty (Pydantic's embedded Python interpreter) — not yet on crates.io.
    # Pulls in ruff_* crates from astral-sh/ruff at a pinned revision.
    "https://github.com/pydantic/monty.git",
    "https://github.com/astral-sh/ruff.git",
]