| 1 |
# cargo-deny config. Load-bearing rule: NEVER GPL/LGPL/AGPL. |
| 2 |
# Per `~/Code/CLAUDE.md`, taking on a copyleft dep is incompatible with the |
| 3 |
# ecosystem's licensing plan (MIT for tooling, PolyForm-NC for products). |
| 4 |
|
| 5 |
[graph] |
| 6 |
all-features = true |
| 7 |
|
| 8 |
[advisories] |
| 9 |
version = 2 |
| 10 |
yanked = "deny" |
| 11 |
|
| 12 |
# Every entry below arrived on 2026-08-08 with `quasi-tauri`, and every one of |
| 13 |
# them is transitive through `tauri` with no version of anything we depend on |
| 14 |
# directly that avoids it. The two that had an upgrade path were taken rather |
| 15 |
# than listed: `time` went to 0.3.55 for RUSTSEC-2026-0009, which is what raised |
| 16 |
# the workspace `rust-version` to 1.88. |
| 17 |
# |
| 18 |
# An ignore list rots into a list of things nobody looks at, so this one has a |
| 19 |
# review task: GoingsOn `quasicoherent`, "Re-check the quasi-tauri advisory |
| 20 |
# ignores". Delete an entry the moment tauri's tree stops needing it. |
| 21 |
ignore = [ |
| 22 |
# gtk-rs GTK3 bindings, unmaintained. Ten crates, one cause: tauri's Linux |
| 23 |
# backend is GTK3 and the bindings were retired when gtk-rs moved to GTK4. |
| 24 |
# Unmaintained rather than vulnerable, and it resolves when tauri does. |
| 25 |
"RUSTSEC-2024-0411", |
| 26 |
"RUSTSEC-2024-0412", |
| 27 |
"RUSTSEC-2024-0413", |
| 28 |
"RUSTSEC-2024-0414", |
| 29 |
"RUSTSEC-2024-0415", |
| 30 |
"RUSTSEC-2024-0416", |
| 31 |
"RUSTSEC-2024-0417", |
| 32 |
"RUSTSEC-2024-0418", |
| 33 |
"RUSTSEC-2024-0419", |
| 34 |
"RUSTSEC-2024-0420", |
| 35 |
|
| 36 |
# `proc-macro-error`, unmaintained, via `glib-macros` and so via the same |
| 37 |
# GTK3 stack. A build-time proc macro: it runs on our machines over our own |
| 38 |
# source and is not in any shipped binary. |
| 39 |
"RUSTSEC-2024-0370", |
| 40 |
|
| 41 |
# The `unic-*` set, unmaintained, all five via `urlpattern` in |
| 42 |
# `tauri-utils`. Unicode character tables. |
| 43 |
"RUSTSEC-2025-0075", |
| 44 |
"RUSTSEC-2025-0080", |
| 45 |
"RUSTSEC-2025-0081", |
| 46 |
"RUSTSEC-2025-0098", |
| 47 |
"RUSTSEC-2025-0100", |
| 48 |
] |
| 49 |
|
| 50 |
[licenses] |
| 51 |
version = 2 |
| 52 |
confidence-threshold = 0.9 |
| 53 |
allow = [ |
| 54 |
"MIT", |
| 55 |
"MIT-0", |
| 56 |
"Apache-2.0", |
| 57 |
"Apache-2.0 WITH LLVM-exception", |
| 58 |
"BSD-2-Clause", |
| 59 |
"BSD-3-Clause", |
| 60 |
"ISC", |
| 61 |
"Zlib", |
| 62 |
"Unicode-3.0", |
| 63 |
"Unicode-DFS-2016", |
| 64 |
"MPL-2.0", |
| 65 |
"CC0-1.0", |
| 66 |
"BSL-1.0", |
| 67 |
] |
| 68 |
|
| 69 |
[bans] |
| 70 |
multiple-versions = "warn" |
| 71 |
wildcards = "deny" |
| 72 |
|
| 73 |
[sources] |
| 74 |
unknown-registry = "deny" |
| 75 |
unknown-git = "deny" |
| 76 |
allow-registry = ["https://github.com/rust-lang/crates.io-index"] |
| 77 |
|