| 1 |
[package] |
| 2 |
name = "custom-pages" |
| 3 |
version = "0.1.0" |
| 4 |
edition = "2024" |
| 5 |
# MIT rather than PolyForm. The threat model asks whether someone could collect |
| 6 |
# rent with just this crate and contribute nothing; an HTML/CSS sanitizer is not |
| 7 |
# a service anyone can run, and someone who takes it still has to build a |
| 8 |
# product around it. The perimeter is the MNW server, which stays PolyForm. |
| 9 |
license = "MIT" |
| 10 |
# Internal shared crate, consumed by path inside this repo and never published. |
| 11 |
# `publish = false` is what makes that a cargo-enforced fact rather than a |
| 12 |
# convention: without it an accidental `cargo publish` is one command away. |
| 13 |
publish = false |
| 14 |
|
| 15 |
[dependencies] |
| 16 |
# The HTML allowlist. Version-matched to the server, which is the only consumer; |
| 17 |
# they resolve to one copy through the path dep either way. |
| 18 |
ammonia = "4" |
| 19 |
# The CSS parser/printer the scoping pass is built on. `default-features = false` |
| 20 |
# keeps the bundler, source maps and the JS/Node glue out: this crate parses a |
| 21 |
# stylesheet and prints it back, and nothing else. |
| 22 |
# Pinned exactly, not floated. This is a pre-1.0 alpha whose `CssRule` enum is |
| 23 |
# matched exhaustively here on purpose (a new at-rule must be a compile error |
| 24 |
# and then a deliberate allow-or-block decision, never a silent pass-through), |
| 25 |
# so a patch bump is a breaking change for this crate. alpha.72 adds |
| 26 |
# `PositionTry` and does exactly that. |
| 27 |
lightningcss = { version = "=1.0.0-alpha.71", default-features = false, features = ["visitor"] } |
| 28 |
url = "2.5.8" |
| 29 |
# Two warn-level lines in the CSS pass, where a cap is hit. The crate emits no |
| 30 |
# other diagnostics and takes no subscriber: the consumer owns that. |
| 31 |
tracing = "0.1" |
| 32 |
|
| 33 |
[dev-dependencies] |
| 34 |
proptest = "1" |
| 35 |
|
| 36 |
[lints.rust] |
| 37 |
unused = "warn" |
| 38 |
unreachable_pub = "warn" |
| 39 |
|
| 40 |
[lints.clippy] |
| 41 |
pedantic = { level = "warn", priority = -1 } |
| 42 |
# Allow-list tuned from a measured breakdown across server/multithreaded/pter |
| 43 |
# (2026-07-22). These are the high-churn / low-signal pedantic lints; everything |
| 44 |
# else in `pedantic` stays a warning. Keep this block identical across repos. |
| 45 |
module_name_repetitions = "allow" |
| 46 |
# Doc lints. No docs-completeness push is underway. |
| 47 |
missing_errors_doc = "allow" |
| 48 |
missing_panics_doc = "allow" |
| 49 |
doc_markdown = "allow" |
| 50 |
# Numeric casts. Endemic and mostly intentional in size and byte math. |
| 51 |
cast_possible_truncation = "allow" |
| 52 |
cast_sign_loss = "allow" |
| 53 |
cast_precision_loss = "allow" |
| 54 |
cast_possible_wrap = "allow" |
| 55 |
cast_lossless = "allow" |
| 56 |
# Subjective structure and style nags. High churn, low signal. |
| 57 |
must_use_candidate = "allow" |
| 58 |
too_many_lines = "allow" |
| 59 |
struct_excessive_bools = "allow" |
| 60 |
similar_names = "allow" |
| 61 |
items_after_statements = "allow" |
| 62 |
single_match_else = "allow" |
| 63 |
# Frequent false-positives in TUI and router-heavy code. |
| 64 |
match_same_arms = "allow" |
| 65 |
unnecessary_wraps = "allow" |
| 66 |
type_complexity = "allow" |
| 67 |
|