deny.toml

# cargo-deny configuration.
# Install: `cargo install cargo-deny`
# Run:     `cargo deny check`

[graph]
all-features = true

[advisories]
version = 2
ignore = [
    # Transitive through zellij-tile 0.44.3 -> zellij-utils -> clap 3.
    # zellij-tile 0.44.3 is the latest plugin API crate as of v0.8.0, and
    # these are unmaintained advisories rather than memory-safety CVEs.
    # Revisit when zellij-tile moves off clap 3.
    "RUSTSEC-2024-0370", # proc-macro-error
    "RUSTSEC-2024-0375", # atty
    # Transitive through notify-rust -> tauri-winrt-notification -> quick-xml.
    # tauri-winrt-notification is a Windows-only (WinRT toast) dependency, so
    # quick-xml is not compiled into muxa on the Unix targets we ship. Both are
    # DoS-on-untrusted-XML issues; muxa never feeds attacker-controlled XML to
    # this crate (Windows notification templates only), and tauri-winrt-notification
    # 0.7.2 pins quick-xml ^0.37 so the fixed 0.41 can't be selected yet.
    # Revisit when notify-rust ships a tauri-winrt-notification that allows quick-xml >=0.41.
    "RUSTSEC-2026-0194", # quick-xml: quadratic runtime on duplicate attribute names
    "RUSTSEC-2026-0195", # quick-xml: unbounded namespace-declaration allocation (NsReader)
]

[licenses]
version = 2
# Licenses accepted in our dependency tree. MPL-2.0 appears transitively
# via `dirs -> dirs-sys -> option-ext`; MPL-2.0 is file-level copyleft, fine
# to link against without triggering our distribution obligations.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "0BSD",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MIT",
    "MIT-0",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "CC0-1.0",
    # `webpki-roots >= 1.0` (transitive via reqwest -> hyper-rustls)
    # ships under CDLA-Permissive-2.0 — a permissive, OSI-aligned data
    # license with no copyleft. Compatible with our MIT/Apache-2.0
    # distribution model. https://cdla.dev/permissive-2-0/
    "CDLA-Permissive-2.0",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"