    # Configuration for cargo-deny
# https://embarkstudios.github.io/cargo-deny/

# Note: running just `cargo deny check` is equivalent to `cargo deny check advisories bans licenses sources`

[advisories]
# The path where the advisory database is cloned/fetched into
db-path = "~/.cargo/advisory-db"
# The url(s) of the advisory databases to use
db-urls = ["https://github.com/rustsec/advisory-db"]
# The lint level for crates that have been yanked from their source registry
yanked = "deny"
# A list of advisory IDs to ignore. Note that ignored advisories will still
# output a note when they are encountered.
ignore = [
    # atomic-polyfill is a transitive dep via postcard → heapless → atomic-polyfill.
    # The advisory is unmaintained status only — not a security vulnerability.
    # atomic-polyfill is a no-op on x86_64 and wasm32 (both have native atomics).
    # We cannot remove it without switching away from postcard; revisit if postcard
    # drops the heapless dependency in a future release.
    "RUSTSEC-2023-0089",
]

[licenses]
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
#
# This project is dual-licensed under MIT OR Apache-2.0. We accept any
# dependency license that is compatible with both — i.e. permissive
# licenses without copyleft obligations.
#
# NOTE: To avoid warnings, only actively used licenses are listed below.
# Uncomment additional licenses as you add dependencies that need them.

allow = [
    # This project's licenses
    "MIT",
    "Apache-2.0",
    # Other permissive licenses already pulled in by transitive deps
    "BSD-3-Clause",
    "MPL-2.0",
    "Unicode-3.0",
    "Zlib",
]

# ============================================================================
# PERMISSIVE LICENSES - Uncomment as needed when adding dependencies
# ============================================================================
#
# Most Common in Rust (90% of crates use these):
#   "MIT",
#   "Apache-2.0",
#   "Apache-2.0 WITH LLVM-exception",
#
# BSD Family:
#   "BSD-2-Clause",
#   "BSD-3-Clause",
#   "0BSD",
#   "ISC",
#
# Public Domain / Highly Permissive:
#   "CC0-1.0",
#   "Unlicense",
#   "BSL-1.0",
#   "Zlib",
#
# Other Permissive:
#   "MPL-2.0",
#   "Unicode-DFS-2016",
#
# Avoid adding copyleft licenses (GPL/LGPL/AGPL) — they would force this
# crate's downstream consumers to adopt those terms, breaking the
# MIT/Apache dual-license guarantee.

# The confidence threshold for detecting a license from license text.
confidence-threshold = 0.8

# Allow 1 or more licenses on a per-crate basis
exceptions = []

# Ignore workspace members for license checks (they're your own code)
private = { ignore = true }

[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "warn"
# Lint level for when a crate version requirement is `*`
wildcards = "warn"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
highlight = "all"
# List of crates that are allowed. Use with care!
allow = []
# List of crates to deny
deny = []
# Certain crates/versions that will be skipped when doing duplicate detection.
skip = []
# Similarly named crates that are allowed. Similar to `skip` but can use
# glob patterns.
skip-tree = []

[sources]
# Lint level for what to happen when a crate from a crate registry that is not
# in the allow list is encountered
unknown-registry = "warn"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
unknown-git = "warn"
# List of URLs for allowed crate registries. Defaults to the crates.io index
# if not specified. If it is specified but empty, no registries from URLs
# will be allowed.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# List of URLs for allowed Git repositories
allow-git = []