nearcore/deny.toml at master · saketh-are/nearcore · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
[graph]
targets = [
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "x86_64-apple-darwin" },
]

[licenses]
version = 2
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception"]
confidence-threshold = 0.8
exceptions = []
private = { ignore = false, registries = [] }

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[bans]
multiple-versions = "deny"
deny = [
    # See: https://github.com/rust-random/rand/issues/645
    { name = "rand", version = "<0.6" },

    # See: https://github.com/near/nearcore/pull/3595
    { name = "keccak-hash", version = "<0.4.1" },
    { name = "primitive-types", version = "<0.10.1" },
    { name = "uint", version = "<0.8.2" },

    # https://github.com/near/nearcore/pull/8562
    { name = "borsh", version = "0.10, <0.10.2" },
]

skip = [
    # wasmer and wasmtime
    { name = "memoffset", version = "=0.6.5" },
    { name = "memoffset", version = "=0.8.0" },
    { name = "rustix", version = "^0.38" },
    { name = "linux-raw-sys", version = "^0.4" },
    { name = "finite-wasm", version = "^0.5" },

    # wasm-tools
    { name = "wasmparser", version = "=0.78.2" },
    { name = "wasmparser", version = "=0.99.0" },
    { name = "wasmparser", version = "=0.105.0" },
    { name = "wasmparser", version = "=0.228.0" },
    { name = "wasm-encoder", version = "=0.27.0" },
    { name = "wasmprinter", version = "=0.2.57" },

    # wasmer 0.17.x
    { name = "target-lexicon", version = "^0.12.0" },

    # many crates haven't updated to syn 2.0 yet.
    { name = "syn", version = "=1.0.103" },
    { name = "heck", version = "=0.4.0" },

    # ubiquituous dependencies that are prone to duplication due to frequent "breaking" releases.
    { name = "windows-sys", version = "<0.60" },
    { name = "windows_x86_64_msvc", version = "<0.60" },
    { name = "windows-targets", version = "<0.53" },
    { name = "windows-core", version = "<0.53" },

    # ed25519-dalek, bolero uses older versions of rand and rand_core
    { name = "rand", version = "<0.9" },
    { name = "rand_core", version = "<0.9" },
    { name = "rand_chacha", version = "<0.9" },
    { name = "getrandom", version = "^0.2" },

    # criterion, rocksdb depend on this older version of the crate.
    { name = "rustc-hash", version = "<2" },

    # Hashbrowns
    { name = "hashbrown", version = "0.12.0" },
    { name = "hashbrown", version = "0.13.2" },
    { name = "hashbrown", version = "0.14.5" },
    { name = "hashbrown", version = "0.15.2" },
    { name = "zerocopy", version = "^0.7" },

    # foldhash
    { name = "foldhash", version = "=0.2.0" },
    { name = "foldhash", version = "=0.1.3" },

    # Bolero requires a newer version and the rest of the ecosystem hasn't caught up yet.
    { name = "bitflags", version = "=1.3.2" },
    { name = "indexmap", version = "=1.9.2" },

    # Various packages haven’t upgraded to 0.base64 21 yet.
    { name = "base64", version = "=0.13.0" },
    { name = "ahash", version = "=0.7.8" },

    # Everything depends on this...
    { name = "lru", version = "=0.7.8" },

    # reed-solomon-erasure latest version
    { name = "parking_lot", version = "=0.11.2" },
    { name = "parking_lot_core", version = "=0.8.6" },
    { name = "spin", version = "=0.9.8" },

    # ecosystem migration to 2.0 is in early phases at the time of writing.
    { name = "thiserror", version = "<2.0" },
    { name = "thiserror-impl", version = "<2.0" },

    # indicatif brings in newer versions
    { name = "encode_unicode", version = "^0.3" },
    { name = "console", version = "^0.15" },
    { name = "unicode-width", version = "<0.2" },
    { name = "windows-link", version = "^0.1" },
    { name = "windows-sys", version = "^0.60" },

    # http ecosystem split.
    { name = "reqwest", version = "^0.11" },
    { name = "winreg", version = "^0.50" },
    { name = "socket2", version = "^0.5" },
    { name = "rustls-pemfile", version = "^1" },
    { name = "nix", version = "^0.24" },
    { name = "mio", version = "^0.8" },
    { name = "hyper-tls", version = "^0.5" },
    { name = "hyper", version = "^0.14" },
    { name = "http-body", version = "^0.4" },
    { name = "http", version = "^0.2" },
    { name = "h2", version = "^0.3" },
    { name = "base64", version = "^0.21" },

    # okApi uses mostly schemars 0.8 for now, though it's not necessary
    { name = "schemars", version = "^0.8" },
    { name = "schemars_derive", version = "^0.8" },

    # Bolero depends on outdated versions of these
    { name = "gimli", version = "=0.31.1" },
    { name = "object", version = "=0.36.5" },

    { name = "sync_wrapper", version = "=0.1.2" },
    { name = "bytesize", version = "=1.1.0" },
    { name = "num-bigint", version = "=0.3.3" },
    { name = "num-rational", version = "=0.3.2" },
    { name = "regex-syntax", version = "=0.6.28" },
]