# Configuration for cargo-deny
# See: https://embarkstudios.github.io/cargo-deny/

[graph]
targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "x86_64-apple-darwin" },
    { triple = "aarch64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
]

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
unmaintained = "workspace"
yanked = "deny"
ignore = [
    # quick-xml 0.37.5 XML-parsing DoS, reached only through
    # `little_exif 0.6.23` (an EXIF/XMP dependency of elide-image, new with
    # the metadata modality). It pins `^0.37`, the fix landed in the
    # semver-incompatible 0.41, and 0.6.23 is the latest release, so there is
    # no in-range update: unresolvable here until upstream `little_exif`
    # bumps. Our own quick-xml is 0.42, which is patched.
    #
    # 0194 is reachable, and the ignore is a deferral, not a dismissal.
    # `little_exif`'s `remove_exif_from_xmp` calls `attributes()` with the
    # default duplicate-name check, reached from its PNG EXIF-clear path, so
    # a crafted image spends O(N^2) on one start tag's attributes. The
    # advisory measures ~6s at 80k attributes and ~10min at 800k, and it is
    # pure computation: a caller-side I/O timeout cannot interrupt it.
    #
    # Bumping our own `quick-xml` does not help. Cargo would resolve two
    # copies and the 0.37 one reached through `little_exif` stays live; only
    # a `little_exif` release built against >= 0.41 removes it. Filed
    # upstream as TechnikTobi/little_exif#104, with the migration mapped out.
    #
    # Until then the mitigation is the caller's. This crate is a stateless
    # library with no request boundary of its own, so it cannot size-limit
    # what it is handed without inventing a policy for every embedder; a
    # host taking untrusted uploads should bound document size before
    # calling `analyze`. See `Document`'s own docs, and #444.
    "RUSTSEC-2026-0194",
    # 0195 does not apply: it is an `NsReader` namespace-resolution bug and
    # `little_exif` uses the plain `Reader`, as the upstream issue confirms.
    "RUSTSEC-2026-0195",
]

[licenses]
confidence-threshold = 0.8
private = { ignore = false, registries = [] }
unused-allowed-license = "warn"

allow = [
    "0BSD",
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "Unicode-3.0",
    "Unlicense",
    "BSL-1.0",
    "CC0-1.0",
    "Zlib",
]

exceptions = [
    # libmp3lame Rust bindings used by the MP3 codec for the
    # decode → mutate → re-encode redaction round-trip. LGPL-3.0
    # imposes redistribution constraints: see
    # https://www.gnu.org/licenses/lgpl-3.0.html. Static linking
    # (the default for `mp3lame-sys`) obliges us to either ship
    # the LGPL source alongside the binary or provide a means for
    # end users to relink against a modified libmp3lame.
    { name = "mp3lame-sys", allow = ["LGPL-3.0"] },
    { name = "mp3lame-encoder", allow = ["LGPL-3.0"] },

    # Mozilla's root CA certificate bundle, reached only with the
    # `deepgram` feature on: deepgram -> tokio-tungstenite ->
    # webpki-roots, for TLS trust anchors when transcribing
    # through Deepgram's hosted API.
    #
    # CDLA-Permissive-2.0 is the Linux Foundation's *data* licence,
    # which is what this crate ships: the certificate bundle is
    # data, not code. It adds no copyleft obligation to software
    # that uses the data, requires no attribution in binaries, and
    # disclaims warranty. Both major versions are present because
    # 0.26 re-exports 1.0.
    #
    # Scoped as an exception rather than an allowed licence so the
    # grant stays limited to this bundle. Nothing else in the graph
    # may ship under it without another decision here.
    { name = "webpki-roots", allow = ["CDLA-Permissive-2.0"] },
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"

allow = []

deny = [
    { name = "openssl-sys", version = "*" },
    { name = "openssl", version = "*" },
]

skip = []
skip-tree = []
# Self-referential dev-dependency for test feature activation is not a real wildcard.
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# elide is consumed straight from the in-house GitHub mirror until its
# crates publish to crates.io. Scoped to that repo on purpose; the
# adapters are workspace members now, not a git source.
allow-git = ["https://github.com/nvisycom/elide"]