nearcore/deny.toml at master · near/nearcore · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
[graph]
targets = [
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "x86_64-apple-darwin" },
]

[licenses]
version = 2
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception"]
confidence-threshold = 0.8
exceptions = []
private = { ignore = false, registries = [] }

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[bans]
multiple-versions = "deny"
deny = [
    # See: https://github.com/rust-random/rand/issues/645
    { name = "rand", version = "<0.6" },

    # See: https://github.com/near/nearcore/pull/3595
    { name = "keccak-hash", version = "<0.4.1" },
    { name = "primitive-types", version = "<0.10.1" },
    { name = "uint", version = "<0.8.2" },

    # https://github.com/near/nearcore/pull/8562
    { name = "borsh", version = "0.10, <0.10.2" },
]

skip = [
    # wasmer and wasmtime
    { name = "memoffset", version = "=0.6.5" },
    { name = "finite-wasm", version = "^0.5" },

    # wasm-tools
    { name = "wasmparser", version = "=0.105.0" },
    { name = "wasmparser", version = "=0.228.0" },
    { name = "wasmparser", version = "=0.236.1" },
    { name = "wasm-encoder", version = "=0.27.0" },
    { name = "wasm-encoder", version = "=0.236.0" },
    { name = "wasmprinter", version = "=0.2.57" },
    { name = "wasmprinter", version = "=0.236.1" },

    # many crates haven't updated to syn 2.0 yet.
    { name = "syn", version = "=1.0.103" },
    { name = "heck", version = "=0.4.0" },

    # ubiquituous dependencies that are prone to duplication due to frequent "breaking" releases.
    { name = "windows-sys", version = "<0.60" },
    { name = "windows_x86_64_msvc", version = "<0.60" },
    { name = "windows-targets", version = "<0.53" },
    { name = "windows-core", version = "<0.53" },

    # ed25519-dalek, bolero uses older versions of rand and rand_core
    { name = "rand", version = "<0.9" },
    { name = "rand_core", version = "<0.9" },
    { name = "rand_chacha", version = "<0.9" },
    { name = "getrandom", version = "^0.2" },

    # bindgen (build-dep of librocksdb-sys) pulls an older itertools.
    { name = "itertools", version = "<0.14" },

    # Hashbrowns
    { name = "hashbrown", version = "0.12.0" },
    { name = "hashbrown", version = "0.13.2" },
    { name = "hashbrown", version = "0.14.5" },
    { name = "hashbrown", version = "0.15.2" },
    { name = "hashbrown", version = "0.16.1" },
    { name = "zerocopy", version = "^0.7" },

    # foldhash
    { name = "foldhash", version = "=0.2.0" },
    { name = "foldhash", version = "=0.1.3" },

    # Bolero requires a newer version and the rest of the ecosystem hasn't caught up yet.
    { name = "bitflags", version = "=1.3.2" },
    { name = "indexmap", version = "=1.9.2" },

    { name = "ahash", version = "=0.7.8" },

    # Everything depends on this...
    { name = "lru", version = "=0.7.8" },

    # reed-solomon-erasure latest version
    { name = "parking_lot", version = "=0.11.2" },
    { name = "parking_lot_core", version = "=0.8.6" },
    { name = "spin", version = "=0.9.9" },

    # ecosystem migration to 2.0 is in early phases at the time of writing.
    { name = "thiserror", version = "<2.0" },
    { name = "thiserror-impl", version = "<2.0" },

    # indicatif brings in newer versions
    { name = "encode_unicode", version = "^0.3" },
    { name = "console", version = "^0.15" },
    { name = "unicode-width", version = "<0.2" },
    { name = "windows-link", version = "^0.1" },

    # http ecosystem split.
    { name = "nix", version = "^0.24" },
    { name = "mio", version = "^0.8" },
    { name = "base64", version = "^0.21" },

    # object_store and rust-s3 still use reqwest 0.12 internally
    { name = "reqwest", version = "^0.12" },
    { name = "core-foundation", version = "^0.9" },
    { name = "openssl-probe", version = "=0.1.5" },
    { name = "security-framework", version = "^2" },
    { name = "windows-result", version = "^0.1" },

    # rust-s3 brings in older versions of these via minidom/rxml/attohttpc
    { name = "quick-xml", version = "^0.32" },
    { name = "quick-xml", version = "^0.36" },

    # ring and rustls pull in untrusted 0.7; aws-lc-rs (and other newer crates)
    # pull in untrusted 0.9. Both are tiny and serve the same purpose; the
    # ecosystem hasn't fully migrated yet.
    { name = "untrusted", version = "=0.7.1" },
    { name = "untrusted", version = "=0.9.0" },

    # okApi uses mostly schemars 0.8 for now, though it's not necessary
    { name = "schemars", version = "^0.8" },
    { name = "schemars_derive", version = "^0.8" },

    { name = "bytesize", version = "=1.1.0" },
    { name = "num-bigint", version = "=0.3.3" },
    { name = "num-rational", version = "=0.3.2" },
    { name = "regex-syntax", version = "=0.6.28" },
]