deny.toml

# Documentation for this configuration file can be found here
# https://embarkstudios.github.io/cargo-deny/checks/cfg.html

[graph]
targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "aarch64-linux-android" },
]

# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
[licenses]
allow = [
    "Apache-2.0 WITH LLVM-exception",
    "Apache-2.0",
    "BSD-3-Clause",
    "ISC",
    "MIT",
    "MPL-2.0",
    "Unicode-DFS-2016",
    "Zlib",
    "Unicode-3.0",
]

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
multiple-versions = "deny"
wildcards = "allow"
deny = []
skip = [
    { name = "heck", reason = "wasm-compose uses an old version of `heck` and was updated in https://github.com/bytecodealliance/wasm-tools/pull/2359, but that hasn't released yet" },
]
skip-tree = [
    # proptest depends on bitflags 1.x.x while other crates depend on 2.x.x so
    # ignore its dependency tree until it updates.
    { name = "proptest", depth = 20 },

    # This is maintained externally and we allow it to have duplicate
    # dependencies relative to Wasmtime's main dependency tree.
    { name = "witx", depth = 20 },

    # They want to publish version 2.0 to upgrade `hashbrown` so in the meantime
    # it is duplicated for us.
    { name = "indexmap", depth = 2 },

    # criterion is on old version, will update on next release.
    { name = "itertools" },

    # backtrace currently using an older version of gimli/addr2line
    { name = "backtrace" },

    # right now terminal_size pulls in an older version of io-lifetimes
    { name = "io-lifetimes" },

    { name = "file-per-thread-logger", reason = "this uses an old version of env-logger; may be unmaintained?" }
]