.cargo-deny.toml

# Config file reference can be found at https://embarkstudios.github.io/cargo-deny/checks/cfg.html.

[graph]
all-features        = true
exclude-dev         = true
no-default-features = true

[advisories]
ignore = [
  # Keep local ignores in sync with nomos-node if needed. Unused entries removed.
  "RUSTSEC-2024-0370", # proc-macro-error unmaintained; upstream dependency
  "RUSTSEC-2024-0384", # instant unmaintained; upstream dependency
  "RUSTSEC-2024-0388", # derivative unmaintained; no safe upgrade available upstream
  "RUSTSEC-2024-0436", # paste unmaintained; upstream dependency
  "RUSTSEC-2025-0012", # backoff unmaintained; upstream workspace still relies on it
  "RUSTSEC-2025-0055", # tracing-subscriber ansi escape issue; upstream dependency
  "RUSTSEC-2025-0134", # rustls-pemfile unmaintained; transitive via rustls stack
  "RUSTSEC-2025-0141", # bincode unmaintained; no safe upgrade available
  "RUSTSEC-2026-0002", # lru IterMut soundness issue; pending upstream upgrade
]
yanked = "deny"

[bans]
allow-wildcard-paths = false
multiple-versions    = "allow"

[licenses]
allow = [
  "Apache-2.0 WITH LLVM-exception",
  "Apache-2.0",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "BSL-1.0",
  "CC0-1.0",
  "CDLA-Permissive-2.0",
  "ISC",
  "MIT",
  "MPL-2.0",
  "Unicode-3.0",
  "Zlib",
]
private = { ignore = false }
unused-allowed-license = "deny"

[[licenses.clarify]]
expression    = "MIT AND ISC"
license-files = [{ hash = 0xbd0eed23, path = "LICENSE" }]
name          = "ring"

[[licenses.clarify]]
expression    = "MIT"
license-files = [{ hash = 0xcb90f5db, path = "LICENSE" }]
name          = "jsonpath-rust"

[sources]
allow-git        = ["https://github.com/EspressoSystems/jellyfish.git"]
unknown-git      = "deny"
unknown-registry = "deny"

[sources.allow-org]
github = ["logos-co"]