# cargo-deny config. Load-bearing rule: NEVER GPL/LGPL/AGPL.
# Per `~/Code/CLAUDE.md`, taking on a copyleft dep is incompatible with the
# ecosystem's licensing plan (MIT for tooling, PolyForm-NC for products).

[graph]
all-features = true

[advisories]
version = 2
yanked = "deny"

# Every entry below arrived on 2026-08-08 with `quasi-tauri`, and every one of
# them is transitive through `tauri` with no version of anything we depend on
# directly that avoids it. The two that had an upgrade path were taken rather
# than listed: `time` went to 0.3.55 for RUSTSEC-2026-0009, which is what raised
# the workspace `rust-version` to 1.88.
#
# An ignore list rots into a list of things nobody looks at, so this one has a
# review task: GoingsOn `quasicoherent`, "Re-check the quasi-tauri advisory
# ignores". Delete an entry the moment tauri's tree stops needing it.
ignore = [
    # gtk-rs GTK3 bindings, unmaintained. Ten crates, one cause: tauri's Linux
    # backend is GTK3 and the bindings were retired when gtk-rs moved to GTK4.
    # Unmaintained rather than vulnerable, and it resolves when tauri does.
    "RUSTSEC-2024-0411",
    "RUSTSEC-2024-0412",
    "RUSTSEC-2024-0413",
    "RUSTSEC-2024-0414",
    "RUSTSEC-2024-0415",
    "RUSTSEC-2024-0416",
    "RUSTSEC-2024-0417",
    "RUSTSEC-2024-0418",
    "RUSTSEC-2024-0419",
    "RUSTSEC-2024-0420",

    # `proc-macro-error`, unmaintained, via `glib-macros` and so via the same
    # GTK3 stack. A build-time proc macro: it runs on our machines over our own
    # source and is not in any shipped binary.
    "RUSTSEC-2024-0370",

    # The `unic-*` set, unmaintained, all five via `urlpattern` in
    # `tauri-utils`. Unicode character tables.
    "RUSTSEC-2025-0075",
    "RUSTSEC-2025-0080",
    "RUSTSEC-2025-0081",
    "RUSTSEC-2025-0098",
    "RUSTSEC-2025-0100",
]

[licenses]
version = 2
confidence-threshold = 0.9
allow = [
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "MPL-2.0",
    "CC0-1.0",
    "BSL-1.0",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]