deny.toml

[bans]
multiple-versions = "deny"
# Dependencies cannot be specified with the "*" version.
wildcards = "deny"

[licenses]
unlicensed = "deny"
copyleft = "deny"
confidence-threshold = 0.95
allow = [
    "Apache-2.0",
    "MIT",
    "BSD-3-Clause",
    "BSD-2-Clause",
    "0BSD",
    "ISC",
    "BlueOak-1.0.0"
]

[advisories]
unmaintained = "deny"
vulnerability = "deny"
yanked = "warn"
ignore = [
    "RUSTSEC-2020-0159",

    # `serde_cbor` is unmaintained
    # (https://rustsec.org/advisories/RUSTSEC-2021-0127.html)
    #
    # Pulled-in by `cddl-cat` which is used for validating
    # CDDL schema conformance in tests.
    "RUSTSEC-2021-0127",

    # `xml-rs` is unmaintained, pulled in from a transitive
    # dependency `serde-xml`
    # (https://rustsec.org/advisories/RUSTSEC-2022-0048.html)
    "RUSTSEC-2022-0048",

    # `ansi_term` is unmaintained, pulled in from dependency
    # `tracing-subscriber`
    "RUSTSEC-2021-0139",
]