[advisories]
ignore = [
    # RUSTSEC-2026-0097 / GHSA-cq8v-f236-94qc — low-severity unsoundness in
    # rand 0.8.x when a custom `log::Logger` calls `rand::rng()` during a
    # ThreadRng reseed. We don't implement such a logger, and the runtime
    # transitive path (statrs → nalgebra → mistralrs) is pinned to rand 0.8
    # upstream. Revisit when statrs/nalgebra bump to rand 0.9+.
    "RUSTSEC-2026-0097",
    # RUSTSEC-2024-0384 — `instant` is unmaintained (replaced by `web_time`).
    # Transitive via notify-types → instant. No direct action available until
    # the `notify` crate drops this dependency upstream.
    "RUSTSEC-2024-0384",
]

[licenses]
# `unlicensed = "deny"` was removed in cargo-deny 0.16 (see PR #611);
# crates with no detectable license now fail by default. Anything not in
# `allow` below also fails.
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "MIT-0",                   # used by `borrow-or-share` (transitive via fluent-uri)
    "CDLA-Permissive-2.0",     # used by `webpki-root-certs` (transitive via reqwest)
    "CC0-1.0",                 # used by `notify` (file-watching backend for hot-reload)
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
# Internal workspace dev-deps use `path = ".."` without a `version` field
# because adding `version` forces cargo publish dry-run to resolve them via
# the registry — see CHANGELOG entry for v0.7.7. Path-only workspace deps
# are inherently safe (they only resolve locally, never published).
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"
