# cargo-deny policy for metrics-lib (v0.9.5+).
# Run locally with:  cargo deny --workspace check all

[graph]
all-features = true

[advisories]
# Newer cargo-deny schema requires explicit `version`; pin to v2.
version = 2
# Warn on yanked crates; let security advisories fail.
yanked = "warn"
# Known transitive unmaintained-crate advisories we accept.
ignore = [
    # `atty` (unmaintained) reaches us only through the pinned
    # `criterion = "=0.4.0"` dev-dependency (criterion ⇒ clap 3 ⇒
    # atty). The `=0.4.0` pin exists for github-action-benchmark
    # output-layout compatibility — see the comment in Cargo.toml.
    # Migration to criterion 0.5 is queued for the v1.0 release once
    # the benchmark-action JSON shape is reconciled.
    "RUSTSEC-2024-0375",
]
# The `unmaintained` field has been split; let cargo-deny use defaults.

[bans]
# Detect accidentally pulling the same crate at multiple major versions.
multiple-versions = "warn"
# `wildcards` discourages `*` dep specs; we don't use any, so make it
# strict.
wildcards = "deny"

[licenses]
# Required: every dependency must carry a license we recognise.
version = 2
allow = [
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "CC0-1.0",
]
# Confidence threshold for license detection on crates with no SPDX
# expression — 0.8 is the cargo-deny default.
confidence-threshold = 0.8

[sources]
# Only crates.io and the rust-lang Git mirror are allowed.
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []
