llmtrace/deny.toml at main · techlab-innov/llmtrace · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# =============================================================================
# cargo-deny configuration — https://embarkstudios.github.io/cargo-deny/
# =============================================================================

[graph]
targets = []
all-features = true

# =============================================================================
# Advisories — check for known vulnerabilities
# =============================================================================
[advisories]
# Use default cargo-deny advisory handling; ignore only advisories with no fix.
ignore = [
    # rsa has no fixed upgrade (via sqlx-mysql)
    "RUSTSEC-2023-0071",
    # Unmaintained transitive crates (no fixed upgrade available).
    "RUSTSEC-2025-0119", # number_prefix
    "RUSTSEC-2024-0436", # paste
    # rand 0.8 unsoundness — only triggers when a custom log::Log implementation
    # calls rand::rng() and a TryRng method on ThreadRng from inside the logger,
    # AND the ThreadRng reseeds (every 64 KB) while called from the logger.
    # We verified our codebase has zero `impl log::Log` implementations
    # (grep -rln "log::Log\|impl Log\|set_logger" crates/ returns empty), so
    # the precondition cannot be met. The fix (rand 0.9) is a major bump with
    # breaking API changes — Dependabot PR #197 captured the migration but
    # the API surface needs source edits we don't currently need.
    "RUSTSEC-2026-0097", # rand 0.8 — n/a, no custom logger; see #197
]

# =============================================================================
# Licenses — allowlist of acceptable licenses
# =============================================================================
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "CDLA-Permissive-2.0",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "BSL-1.0",
    "OpenSSL",
    "MPL-2.0",
]
confidence-threshold = 0.8

[licenses.private]
ignore = false

# =============================================================================
# Bans — deny specific problematic crates
# =============================================================================
[bans]
multiple-versions = "warn"
wildcards = "allow"

# =============================================================================
# Sources — only allow crates from crates.io
# =============================================================================
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []