[advisories]
ignore = [
	# chrono depends on time 0.1, which is not patched
    "RUSTSEC-2020-0071",
	# webpki 0.21.4 only used by aws-smithy-client 0.41.0 in our deprecated
	# generated clients. This is used only for type ser/de and old tests.
	"RUSTSEC-2023-0052",
	# rustls 0.19.1 is only used by aws-smithy-client in our deprecated
	# generated clients. This is used only for type ser/de and old tests.
	"RUSTSEC-2024-0336",
	# Inputs are only read from trusted sources
	"RUSTSEC-2024-0421",
	# TODO(RVT-4096):
	"RUSTSEC-2023-0071",
	# Unmaintained, low-impact crates
	"RUSTSEC-2020-0163",
	"RUSTSEC-2024-0370",
	"RUSTSEC-2024-0384",
	# SlateDB currently pulls in bincode 1, which is unmaintained without a patched release.
	"RUSTSEC-2025-0141",
]

[licenses]
allow = [
	# Proprietary license for this repository's own workspace crates. See LICENSE.
	"LicenseRef-RivetEnterprise",
	"Apache-2.0",
	"0BSD",
	"BSD-2-Clause",
	"BSD-3-Clause",
	"ISC",
	"MIT",
	"MPL-2.0",
	"CC0-1.0",
	"Unicode-3.0",
	"Zlib",
	"EPL-2.0",
	"Unlicense",
	# Boost Software License, not Business Source License (clipboard-win, error-code, xxhash-rust).
	"BSL-1.0",
	# Mozilla's CA root list (webpki-roots, webpki-root-certs).
	"CDLA-Permissive-2.0",
]
unused-allowed-license = "allow"

[[licenses.exceptions]]
name = "epaint_default_fonts"
allow = ["OFL-1.1", "Ubuntu-font-1.0"]

[[licenses.exceptions]]
name = "unicode-ident"
allow = ["Unicode-DFS-2016"]

[[licenses.exceptions]]
name = "ring"
allow = ["OpenSSL"]

# See https://github.com/EmbarkStudios/buildkite-jobify/blob/a1b953b03f3330e499b1af47cc2dc38bd777da7c/deny.toml#LL27C1-L38C1
[[licenses.clarify]]
name = "ring"
expression = "ISC AND MIT AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]