deny.toml

[graph]
targets = [
    "x86_64-unknown-linux-gnu",
]
all-features = true
no-default-features = false

[output]
feature-depth = 1

[advisories]
ignore = ["RUSTSEC-2023-0071"]
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MPL-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "CC0-1.0",
    "OpenSSL",
    "Zlib"
]
confidence-threshold = 0.8

[licenses.private]
ignore = false
registries = []

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "deny"
# Lint level for when a crate version requirement is `*`
wildcards = "allow"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
# * lowest-version - The path to the lowest versioned duplicate is highlighted
# * simplest-path - The path to the version with the fewest edges is highlighted
# * all - Both lowest-version and simplest-path are used
highlight = "all"
# The default lint level for `default` features for crates that are members of
# the workspace that is being checked. This can be overridden by allowing/denying
# `default` on a crate-by-crate basis if desired.
workspace-default-features = "allow"
# The default lint level for `default` features for external crates that are not
# members of the workspace. This can be overridden by allowing/denying `default`
# on a crate-by-crate basis if desired.
external-default-features = "allow"
# List of crates that are allowed. Use with care!
allow = []
deny = []

# Certain crates/versions that will be skipped when doing duplicate detection.
skip = [
    "typed-builder@0.10.0",
    "webpki-roots@0.25.4",
    "syn@1.0",
    # Required by rdkafka-sys
    "toml_edit@0.19",
    # Needs updating. See if we can get rid of our fork
    "sqlparser@0.35.0",
    # dozer-sql-expression. Can't update because of sqlparser dep
    "bigdecimal",
    "sourcemap@6",
    # deno
    "libloading@0.7",
    # deno pins reqwest 0.11.20, which should be fixed once reqwest 0.12 is released
    "idna@0.3"
]
# Similarly to `skip` allows you to skip certain crates during duplicate
# detection. Unlike skip, it also includes the entire tree of transitive
# dependencies starting at the specified crate, up to a certain depth, which is
# by default infinite.
skip-tree = [
    # mongodb uses a couple old versions of crates
    "mongodb@2.8.2",
    # dozer-tracing is updated in a separate PR
    "dozer-tracing",
    # snowflake source. Let's get rid of this dependency
    "genawaiter@0.99",
    # Uses old version of proc macro crates through num_enum. Let's send a PR to update"
    "rdkafka",
    # Used by sourcemap. Let's send a PR to update
    "base64-simd@0.7",
]

# This section is considered when running `cargo deny check sources`.
# More documentation about the 'sources' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources]
# Lint level for what to happen when a crate from a crate registry that is not
# in the allow list is encountered
unknown-registry = "deny"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
unknown-git = "deny"
# List of URLs for allowed crate registries. Defaults to the crates.io index
# if not specified. If it is specified but empty, no registries are allowed.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# List of URLs for allowed Git repositories
allow-git = ["https://github.com/MaterializeInc/rust-postgres"]

[sources.allow-org]
# 1 or more github.com organizations to allow git sources for
github = ["getdozer"]
# 1 or more gitlab.com organizations to allow git sources for
gitlab = []
# 1 or more bitbucket.org organizations to allow git sources for
bitbucket = []