# cargo deny check: known vulnerabilities, licences and where crates come from. Run before a push
# (CLAUDE.md, Tests). It reads Cargo.lock and the RustSec database, and builds nothing.

[graph]
# Production runs on Linux; Windows and macOS-only crates are not ipx's concern.
targets = ["x86_64-unknown-linux-gnu"]

[advisories]
ignore = [
    # ringbuf 0.4's double free needs an element whose Drop panics; librqbit-utp's buffer holds
    # only u8, which has no Drop. Its fix is ringbuf 0.5, which librqbit 9.0.1 cannot take (#281).
    { id = "RUSTSEC-2026-0293", reason = "librqbit-utp's ring buffer holds u8: no Drop to panic" },
]

[licenses]
# Permissive licences only; anything else is a question for the owner before it comes in.
allow = [
    "MIT", "MIT-0", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause",
    "ISC", "Zlib", "Unlicense", "0BSD", "CC0-1.0", "BSL-1.0", "Unicode-3.0", "MPL-2.0",
    "CDLA-Permissive-2.0",
]
# ipx's own crates have no licence field and are not published.
private = { ignore = true }

[bans]
# Two versions of one crate (syn 1 and 2, and 25 more) only cost build time, and a warning for
# each on every run would be read by nobody.
multiple-versions = "allow"
wildcards = "deny"
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"