rivet/deny.toml at main · pulseengine/rivet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/

[advisories]
# Vulnerabilities are denied by default in cargo-deny >=0.16.
# Yanked crates produce warnings by default.
ignore = [
    # `instant` is unmaintained (RUSTSEC-2024-0384) but pulled in transitively
    # by notify 7.0.0 → notify-types. No fix available upstream yet.
    "RUSTSEC-2024-0384",
    # wasmtime 42.0.1 advisories — all behind the optional `wasm` feature gate.
    # Tracked: upgrade to wasmtime >=43 when available with component-model fixes.
    "RUSTSEC-2026-0085",
    "RUSTSEC-2026-0086",
    "RUSTSEC-2026-0087",
    "RUSTSEC-2026-0088",
    "RUSTSEC-2026-0089",
    "RUSTSEC-2026-0091",
    "RUSTSEC-2026-0092",
    "RUSTSEC-2026-0093",
    "RUSTSEC-2026-0094",
    "RUSTSEC-2026-0095",
    "RUSTSEC-2026-0096",
    # thin-vec 0.2.14 Double-Free / UAF in IntoIter::drop / ThinVec::clear.
    # Pulled in transitively by salsa 0.26.0. No rivet call site directly
    # constructs or iterates thin_vec::ThinVec. Upstream: wait for salsa to
    # bump its thin-vec dependency, or upstream fix in thin-vec >= 0.2.15.
    # TODO: remove when salsa >= 0.27 lands or thin-vec fix is released.
    "RUSTSEC-2026-0103",
]

[licenses]
# Confidence threshold for license detection
confidence-threshold = 0.8
# List of allowed licenses (anything not listed is denied)
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "0BSD",
    "BSL-1.0",
    "CC0-1.0",
]

[bans]
# Lint level for multiple versions of the same crate
multiple-versions = "warn"
# Lint level for wildcard dependencies
wildcards = "allow"
# Deny specific crates known to be problematic
deny = [
    # Use rustls instead of openssl for TLS
    # { name = "openssl-sys" },
]

[sources]
# Lint level for crates not from crates.io
unknown-registry = "deny"
unknown-git = "warn"
# Allow crates from these registries
allow-registry = ["https://github.com/rust-lang/crates.io-index"]