[graph]
targets = []

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
ignore = [
    # rsa Marvin timing side-channel (RUSTSEC-2023-0071) surfaces via
    # sqlx-mysql which is a transitive dep of sqlx. socle only enables
    # the postgres feature so the mysql (and rsa) code paths are never compiled
    # or linked. No actionable fix until sqlx drops the mysql dep or patches rsa.
    "RUSTSEC-2023-0071",
    # rand unsound aliased-mut-ref (RUSTSEC-2026-0097) pulled in transitively
    # by sqlx-postgres 0.8.x. Fix requires rand >= 0.9.3 which sqlx 0.8.x has
    # not yet released. Conditions for UB are extremely narrow (custom logger +
    # trace logging + ThreadRng reseeding). Review when sqlx 0.8.x ships fix.
    # review-by: 2026-07-20
    "RUSTSEC-2026-0097",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "OpenSSL",
    "Zlib",
    "CC0-1.0",
]
exceptions = []

[bans]
multiple-versions = "warn"
wildcards = "allow"
deny = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = [
    "https://github.com/rust-lang/crates.io-index",
]
allow-git = []
