mercury/deny.toml at main · vaporif/mercury · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
[advisories]
ignore = [
  # time DoS via stack exhaustion — pinned by tendermint-rs 0.40, waiting on upstream
  "RUSTSEC-2026-0009",
  # rustls-pemfile unmaintained — transitive via tendermint-rpc -> reqwest 0.11, waiting on upstream
  "RUSTSEC-2025-0134",
  # paste unmaintained — transitive dependency, waiting on upstream to switch to pastey
  "RUSTSEC-2024-0436",
  # number_prefix unmaintained — transitive via indicatif -> sp1-sdk, waiting on upstream
  "RUSTSEC-2025-0119",
  # instant unmaintained — transitive via backoff -> sp1-sdk, waiting on upstream
  "RUSTSEC-2024-0384",
  # ansi_term unmaintained — transitive via tracing-forest -> sp1-core-machine, waiting on upstream
  "RUSTSEC-2021-0139",
  # backoff unmaintained — transitive via sp1-sdk, waiting on upstream
  "RUSTSEC-2025-0012",
  # bincode unmaintained — transitive via sp1-core-executor, waiting on upstream
  "RUSTSEC-2025-0141",
  # derivative unmaintained — transitive via ark-ff -> sp1-recursion-core, waiting on upstream
  "RUSTSEC-2024-0388",
  # rustls-webpki CRL distribution point logic error — pinned by tendermint-rpc 0.40 -> rustls 0.22, waiting on upstream
  "RUSTSEC-2026-0049",
  # rustls-webpki URI name constraints ignored — pinned by rustls 0.21/0.22 (reqwest 0.11, tungstenite 0.21), waiting on upstream
  "RUSTSEC-2026-0098",
  # rustls-webpki wildcard DNS name constraints bypass — pinned by rustls 0.21/0.22 (reqwest 0.11, tungstenite 0.21), waiting on upstream
  "RUSTSEC-2026-0099",
  # rustls-webpki reachable panic in CRL parsing — residual on 0.101.7/0.102.8 pinned by rustls 0.21/0.22 (reqwest 0.11, tungstenite 0.21); 0.103 line bumped to 0.103.13
  "RUSTSEC-2026-0104",
]

[licenses]
allow = [
  "Apache-2.0",
  "MIT",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-3.0",
  "Unicode-DFS-2016",
  "CC0-1.0",
  "Unlicense",
  "0BSD",
  "CDLA-Permissive-2.0",
  "Zlib",
  "BlueOak-1.0.0",
  "OpenSSL",
  "MPL-2.0",
]
confidence-threshold = 0.8

# upstream solidity-ibc-eureka crates don't set license in Cargo.toml
# but the repo is Apache-2.0 licensed
[[licenses.clarify]]
crate = "ethereum-apis"
expression = "Apache-2.0"
license-files = []

[[licenses.clarify]]
crate = "ethereum-light-client"
expression = "Apache-2.0"
license-files = []

[[licenses.clarify]]
crate = "ethereum-trie-db"
expression = "Apache-2.0"
license-files = []

[[licenses.clarify]]
crate = "ethereum-types"
expression = "Apache-2.0"
license-files = []

# halo2 doesn't set license in Cargo.toml but the repo is MIT/Apache-2.0
[[licenses.clarify]]
crate = "halo2"
expression = "MIT OR Apache-2.0"
license-files = []

[bans]
multiple-versions = "warn"
wildcards = "allow"

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
  "https://github.com/cosmos/solidity-ibc-eureka",
  "https://github.com/cosmos/ibc-proto-rs",
]