|
1 | 1 | [licenses] |
2 | 2 | # List of explicitly allowed licenses |
| 3 | +# Note: All licenses not in this list are denied by default |
3 | 4 | allow = [ |
4 | 5 | "MIT", |
5 | 6 | "Apache-2.0", |
6 | 7 | "Apache-2.0 WITH LLVM-exception", |
7 | | - "BSD-2-Clause", |
8 | | - "BSD-3-Clause", |
9 | | - "ISC", |
10 | | - "Unicode-DFS-2016", |
11 | | -] |
12 | | -# List of explicitly disallowed licenses |
13 | | -deny = [ |
14 | | - "GPL-2.0", |
15 | | - "GPL-3.0", |
16 | | - "AGPL-1.0", |
17 | | - "AGPL-3.0", |
| 8 | + "MPL-2.0", |
| 9 | + "Unicode-3.0", |
18 | 10 | ] |
| 11 | +# Don't warn about unused licenses in the allow list |
| 12 | +unused-allowed-license = "allow" |
19 | 13 |
|
20 | 14 | [bans] |
21 | 15 | # Lint level for when multiple versions of the same crate are detected |
22 | 16 | multiple-versions = "warn" |
23 | 17 | # List of crates that are allowed to have multiple versions |
| 18 | +# These duplicates are caused by transitive dependencies and are safe to allow |
24 | 19 | skip = [ |
25 | | - { name = "windows_aarch64_gnullvm" }, |
26 | | - { name = "windows_aarch64_msvc" }, |
27 | | - { name = "windows_i686_gnu" }, |
28 | | - { name = "windows_i686_msvc" }, |
29 | | - { name = "windows_x86_64_gnu" }, |
30 | | - { name = "windows_x86_64_gnullvm" }, |
31 | | - { name = "windows_x86_64_msvc" }, |
| 20 | + { crate = "bitflags" }, |
| 21 | + { crate = "windows-link" }, |
| 22 | + { crate = "windows-sys" }, |
| 23 | + { crate = "windows-targets" }, |
| 24 | + { crate = "windows_aarch64_gnullvm" }, |
| 25 | + { crate = "windows_aarch64_msvc" }, |
| 26 | + { crate = "windows_i686_gnu" }, |
| 27 | + { crate = "windows_i686_gnullvm" }, |
| 28 | + { crate = "windows_i686_msvc" }, |
| 29 | + { crate = "windows_x86_64_gnu" }, |
| 30 | + { crate = "windows_x86_64_gnullvm" }, |
| 31 | + { crate = "windows_x86_64_msvc" }, |
32 | 32 | ] |
33 | 33 |
|
34 | 34 | [advisories] |
35 | 35 | # The path where the advisory database is cloned/fetched into |
36 | 36 | db-path = "~/.cargo/advisory-db" |
37 | 37 | # The url(s) of the advisory databases to use |
38 | 38 | db-urls = ["https://github.com/rustsec/advisory-db"] |
39 | | -# The lint level for security vulnerabilities |
40 | | -vulnerability = "deny" |
41 | | -# The lint level for unmaintained crates |
42 | | -unmaintained = "all" |
| 39 | +# Determines how unmaintained crate advisories are handled |
| 40 | +# "all" - Any crate that matches an unmaintained advisory will fail |
| 41 | +# "workspace" - Only fail if unmaintained crate is a direct dependency |
| 42 | +# "none" - Unmaintained advisories are completely ignored |
| 43 | +unmaintained = "workspace" |
43 | 44 | # The lint level for crates that have been yanked from their source registry |
44 | 45 | yanked = "warn" |
45 | | -# The lint level for crates with security notices |
46 | | -notice = "warn" |
47 | 46 | # A list of advisory IDs to ignore |
48 | 47 | ignore = [] |
49 | 48 |
|
|
0 commit comments