PolterType/deny.toml at main · Just-Code-NET/PolterType · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# cargo-deny configuration: license / advisory / duplicate checks.
# See https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = false

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked  = "warn"
# Each ignore is either "unmaintained, no safe upgrade exists" or a
# vulnerability whose only exposure is trusted input. Re-audit this
# list whenever `tray-icon`, `iced`/`winit`, or `zbus`/`notify-rust`
# get bumped — most entries disappear with those upgrades.
ignore = [
    # ── gtk-rs GTK3 bindings: unmaintained ─────────────────────────
    # Pulled in by `tray-icon`'s Linux backend, which still targets
    # GTK3. No fixed release exists; goes away when tray-icon moves
    # to GTK4 / layer-shell.
    "RUSTSEC-2024-0411", # gdkwayland-sys
    "RUSTSEC-2024-0412", # gdk
    "RUSTSEC-2024-0413", # atk
    "RUSTSEC-2024-0414", # gdkx11-sys
    "RUSTSEC-2024-0415", # gtk
    "RUSTSEC-2024-0416", # atk-sys
    "RUSTSEC-2024-0418", # gdk-sys
    "RUSTSEC-2024-0419", # gdk-pixbuf
    "RUSTSEC-2024-0420", # gtk-sys
    # glib 0.18's `VariantStrIter` is unsound (NULL-deref under
    # optimisation). Same GTK3 stack and the same wait: the fix is
    # glib >=0.20, which needs gtk-rs 0.20, which needs a tray-icon
    # that has left GTK3. Nothing here calls the affected API — the
    # crate reaches us through tray-icon/tao for the tray widgets,
    # and poltertype-tray's own use is `log_set_handler`, which does
    # not touch `GVariant` iteration.
    "RUSTSEC-2024-0429", # glib
    # ── unmaintained, transitive, no safe upgrade ───────────────────
    "RUSTSEC-2024-0370", # proc-macro-error (via iced/gtk macro stack)
    "RUSTSEC-2024-0384", # instant (via winit/calloop stack)
    "RUSTSEC-2026-0192", # ttf-parser (via iced font stack; fix = skrifa migration upstream)
    "RUSTSEC-2026-0206", # rustybuzz (via iced text shaping; same skrifa/harfrust migration upstream)
    # ── quick-xml DoS advisories (fix requires >=0.41, parents pin lower)
    # Both dependency paths only ever parse *trusted, local* XML:
    #   * wayland-scanner (proc-macro) — bundled Wayland protocol
    #     definitions at build time, never in the shipped binary;
    #   * tauri-winrt-notification (Windows) — toast XML we generate
    #     ourselves.
    # Attacker-controlled XML never reaches these parsers. Drop when
    # smithay-client-toolkit / notify-rust bump quick-xml.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "CC0-1.0",
    "Zlib",
    "0BSD",
    "MPL-2.0",
    # Boost — OSI-approved permissive; clipboard-win / error-code via iced.
    "BSL-1.0",
    # Community Data License (permissive) — webpki-roots' Mozilla CA
    # bundle, used only by xtask's HTTPS wordlist fetches.
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.93

[bans]
multiple-versions = "warn"
wildcards         = "deny"
# Our own kb-* crates reference each other by path (versionless in
# workspace.dependencies) — that's the intended monorepo layout, not
# a wildcard registry requirement.
allow-wildcard-paths = true

[sources]
unknown-registry = "warn"
unknown-git      = "warn"