deny.toml

[advisories]
ignore = [
    # bincode 1.x (transitive dep of syntect) — unmaintained but no security issue
    "RUSTSEC-2025-0141",
    # actix-http still pins h2 0.3; the low-severity fix is available only in h2 0.4.
    "RUSTSEC-2026-0258",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "ISC",
    "MPL-2.0",
    "Unicode-3.0",
    "CC0-1.0",
    "Unicode-DFS-2016",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "Zlib",
]
confidence-threshold = 0.8

[licenses.private]
ignore = true

[bans]
multiple-versions = "deny"
skip = [
    { name = "convert_case" },
    { name = "getrandom" },
    { name = "http" },
    # prost-build's current petgraph release requires these older hashing crates.
    # They are confined to IPC generation tooling, not the desktop runtime.
    { name = "hashbrown", version = "=0.15.5" },
    { name = "foldhash", version = "=0.1.5" },
    { name = "r-efi" },
    { name = "windows-sys" },
    { name = "windows-targets" },
    { name = "windows_aarch64_gnullvm" },
    { name = "windows_aarch64_msvc" },
    { name = "windows_i686_gnu" },
    { name = "windows_i686_gnullvm" },
    { name = "windows_i686_msvc" },
    { name = "windows_x86_64_gnu" },
    { name = "windows_x86_64_gnullvm" },
    { name = "windows_x86_64_msvc" },
    # gtk4-rs's glib-macros pins syn 3.x while the rest of the workspace uses syn 2.x.
    { name = "syn" },
    # gtk4-rs's `*-sys` crates (gdk4-sys, gtk4-sys, webkit6-sys, ...) pin an
    # older system-deps than glib-sys/gio-sys/cairo-sys-rs.
    { name = "system-deps" },
]