deny.toml

# Configuration for cargo-deny
# https://embarkstudios.github.io/cargo-deny/

[advisories]
# Ignore unmaintained advisories for dependencies we can't easily replace
ignore = [
    "RUSTSEC-2024-0436",  # paste - unmaintained (used by rustpython-parser)
    "RUSTSEC-2025-0075",  # unic-char-range - unmaintained
    "RUSTSEC-2025-0080",  # unic-common - unmaintained
    "RUSTSEC-2025-0081",  # unic-char-property - unmaintained
    "RUSTSEC-2025-0090",  # unic-emoji-char - unmaintained
    "RUSTSEC-2025-0098",  # unic-ucd-version - unmaintained
    "RUSTSEC-2025-0100",  # unic-ucd-ident - unmaintained
]
# Warn about yanked crates but don't fail
yanked = "warn"

[licenses]
# Allow these licenses
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",          # Used by ICU crates for Unicode data
    "CC0-1.0",
    "0BSD",
    "MIT-0",                # MIT No Attribution (used by borrow-or-share via tower-lsp-server)
    "Zlib",
    "MPL-2.0",
    "LGPL-3.0-only",        # Used by malachite (via rustpython-parser)
]

# Confidence threshold for license detection
confidence-threshold = 0.8

[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "warn"
# Allow wildcard dependencies
wildcards = "allow"
# Deny these specific crates (empty for now)
deny = []

[sources]
# Ensure all dependencies come from trusted sources
unknown-registry = "deny"
unknown-git = "deny"

[sources.allow-org]
github = []