deny.toml

# Copyright (C) 2026 rezky_nightky
# SPDX-License-Identifier: GPL-3.0-only

[graph]
targets = []
all-features = false
no-default-features = false

[output]
feature-depth = 1

[advisories]
# v50.0.0-beta.7: RUSTSEC-2024-0384 — `instant` crate is unmaintained.
# Pulled transitively by notify-types v1.0.1 -> notify v7.0.0. The
# author recommends `web-time` as replacement, but notify-types has
# not migrated yet. `instant` is only used for time measurement
# (Instant::now wrapper) — not security-critical. No safe upgrade
# available until notify-types publishes a new version. Suppressing
# until upstream resolves.
ignore = ["RUSTSEC-2024-0384"]

[licenses]
allow = [
  "Apache-2.0",
  "MIT",
  "GPL-3.0-only",
  "GPL-3.0-or-later",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-3.0",
  "Zlib",
  "Unicode-DFS-2016",
  "MPL-2.0",
  "CC0-1.0",
]
confidence-threshold = 0.8
unused-allowed-license = "allow"
unused-license-exception = "allow"
exceptions = []

[licenses.private]
ignore = true
registries = []

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []
# Transitive dependency duplicates that cannot be resolved without upstream
# changes. These are caused by the dependency tree pulling in different
# major versions of the same crate through different paths:
#
# - bitflags 1.3.2 (via inotify -> notify) vs 2.13.1 (via crossterm, ctrlc, etc.)
#   notify v7 pulls inotify v0.10 which still uses bitflags 1.x; cannot force
#   inotify to use bitflags 2.x without upstream PR. Expected to resolve when
#   notify migrates to inotify 0.11+.
#
# - windows-sys 0.52.0 (via notify v7) vs 0.61.2 (via ctrlc, rustix, anstream,
#   mio, etc.) Different minor versions of windows-sys — notify v7 pins
#   0.52, the rest of the ecosystem uses 0.61. Windows-only, transitive-only.
#
# Both are Windows-specific or transitive-only — they don't affect the
# cosmostrix binary on Linux/macOS/FreeBSD at runtime. Skipping them here
# silences the duplicate-versions warning without hiding real issues.
#
# v50.0.0-beta.7: removed mio 0.8.11 skip (notify 7 migrated to mio 1.x,
# eliminating the duplicate). Removed windows-sys 0.48.0 skip (was from
# the old mio 0.8 chain, no longer present).
skip = [
    { name = "bitflags", version = "1.3.2" },
    { name = "windows-sys", version = "0.52.0" },
]
skip-tree = []

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []