deny.toml

# cargo-deny configuration for SciRS2
# This file defines policies for dependencies, licenses, and security

[advisories]
version = 2
ignore = [
    "RUSTSEC-2024-0436", # paste - unmaintained but widely used, no replacement yet
    { id = "RUSTSEC-2026-0049", reason = "rustls-webpki vulnerability via rumqttc 0.25.1; no upstream fix available yet" },
    { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile 2.2.0 unmaintained, pulled in by rumqttc 0.25.1; no upstream fix available" },
    { id = "RUSTSEC-2024-0384", reason = "instant 0.1.13 unmaintained, pulled in by hdf5 0.8.1; no upstream fix available" },
    { id = "RUSTSEC-2026-0097", reason = "SciRS2 does not use custom loggers with rand::rng(); unsoundness is not exploitable in our use case. Affects rand 0.8.5 (via statrs), 0.9.2 (via tungstenite), 0.10.0 (via scirs2-transform). No patched version available yet." },
]

[licenses]
version = 2
# Licensing policy for COOLJAPAN Pure Rust ecosystem
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "MPL-2.0",
    "NCSA",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[bans]
# Multiple versions of the same crate
multiple-versions = "warn"
wildcards = "warn"
highlight = "all"

# Deny specific crates per COOLJAPAN Pure Rust Policy
deny = [
    # OpenBLAS/BLAS dependencies (use OxiBLAS instead)
    { name = "openblas-src" },
    { name = "blas-src" },
    { name = "cblas-sys" },
    { name = "lapack-src" },
    { name = "lapacke-sys" },

    # bincode (use oxicode instead)
    { name = "bincode" },
]

# Skip version checking for certain crates
skip = []
skip-tree = []

[sources]
# Only allow crates from official registries and COOLJAPAN org
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = ["cool-japan", "rust-lang"]