rays
341d880e13
cargo deny check found 10 RustSec advisories in Cargo.lock: ammonia 4.1.4 (three, XSS via SVG animation tags among them), rustls 0.23.44 (five), h2 0.4.15 (one) and ringbuf 0.4.8 (one). cargo update took ammonia to 4.2.4, rustls to 0.23.46 and h2 to 0.4.20. ringbuf's fix is 0.5, which librqbit 9.0.1 (the newest) cannot take; its double free needs an element whose Drop panics and librqbit-utp's buffer holds u8, so deny.toml ignores it with that reason. deny.toml allows permissive licences only, crates.io only, and no wildcard versions; ipx and ipx-directory say publish = false, as feed did. cargo machete found crates/ipx still listing atom_syndication, quick-xml and rss, which only crates/feed uses since parsing moved there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.3 KiB
TOML
35 lines
1.3 KiB
TOML
# cargo deny check: known vulnerabilities, licences and where crates come from. Run before a push
|
|
# (CLAUDE.md, Tests). It reads Cargo.lock and the RustSec database, and builds nothing.
|
|
|
|
[graph]
|
|
# Production runs on Linux; Windows and macOS-only crates are not ipx's concern.
|
|
targets = ["x86_64-unknown-linux-gnu"]
|
|
|
|
[advisories]
|
|
ignore = [
|
|
# ringbuf 0.4's double free needs an element whose Drop panics; librqbit-utp's buffer holds
|
|
# only u8, which has no Drop. Its fix is ringbuf 0.5, which librqbit 9.0.1 cannot take (#281).
|
|
{ id = "RUSTSEC-2026-0293", reason = "librqbit-utp's ring buffer holds u8: no Drop to panic" },
|
|
]
|
|
|
|
[licenses]
|
|
# Permissive licences only; anything else is a question for the owner before it comes in.
|
|
allow = [
|
|
"MIT", "MIT-0", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause",
|
|
"ISC", "Zlib", "Unlicense", "0BSD", "CC0-1.0", "BSL-1.0", "Unicode-3.0", "MPL-2.0",
|
|
"CDLA-Permissive-2.0",
|
|
]
|
|
# ipx's own crates have no licence field and are not published.
|
|
private = { ignore = true }
|
|
|
|
[bans]
|
|
# Two versions of one crate (syn 1 and 2, and 25 more) only cost build time, and a warning for
|
|
# each on every run would be read by nobody.
|
|
multiple-versions = "allow"
|
|
wildcards = "deny"
|
|
allow-wildcard-paths = true
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|