deny.toml

[advisories]
# Pull advisories from the official RustSec database. cargo-deny and
# cargo-audit both read from this source by default; listing it explicitly
# documents the coverage and makes it easy to add mirrors/additional
# databases later without hunting for the implicit default.
db-urls = ["https://github.com/rustsec/advisory-db"]
ignore = [
    # Transitive dependency of soroban-sdk's wasmi_core; the advisory itself
    # states no safe upgrade is available, and we don't control this path.
    { id = "RUSTSEC-2024-0436", reason = "unmaintained `paste`, pulled in transitively by soroban-sdk -> wasmi_core; no safe upgrade available" },
]

[licenses]
# Deny all licenses unless they are in the allow list
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "CDLA-Permissive-2.0",
]

[bans]
# Workspace has many transitive dependency version overlaps (rand, syn,
# tower, etc. pulled in at different versions by different crates); this is
# normal for a workspace this size and not worth pinning down individually.
multiple-versions = "warn"
# Path dependencies between workspace crates (e.g. escrow -> oracle) are
# reported as "wildcard" since they carry no version requirement; that's
# expected for local workspace members, not a real supply-chain risk.
wildcards = "allow"

# List of explicitly allowed duplicate crates
allow = [
]

# Certain crates/versions that will be skipped when doing duplicate detection
skip = [
]