deny.toml

[bans]
multiple-versions = "deny"
# Try to avoid exemptions for duplicate dependencies! Duplicate dependencies
# slow down compilation, bloat the binary, and tickle race conditions in `cargo
# doc` (see rust-lang/cargo#3613).
#
# If possible, submit PRs upstream to remove duplicated transitive dependencies.
# You can use patch directives in the root Cargo.toml to point at a
# Materialize-maintained fork that avoids the duplicated transitive
# dependencies.
skip = [
    # One-time exception for base64 due to its prevalence in the crate graph.
    { name = "base64", version = "0.13.1" },
    # `ring` depends on an older version of this crate. The dependency will be
    #  upgraded to 0.9 when they publish 0.17.
    { name = "spin", version = "0.9.8" },
    # `syn` is a core crate that a huge part of the ecosystem either directly, or
    # transitively depends on. They just released v2.0 which not all crates have
    # migrated to yet.
    { name = "syn", version = "1.0.107" },
    # `tokio` depends on a newer version of socket2, we are okay with _temporarily_
    # allowing these duplicate dependencies until the rest of the ecosystem catches
    # up.
    { name = "socket2", version = "0.4.9" },
    { name = "windows-sys", version = "0.42.0" },
    { name = "windows-sys", version = "0.45.0" },
    { name = "windows-targets", version = "0.42.0" },
    { name = "windows_aarch64_gnullvm", version = "0.42.0" },
    { name = "windows_aarch64_msvc", version = "0.42.0" },
    { name = "windows_i686_gnu", version = "0.42.0" },
    { name = "windows_i686_msvc", version = "0.42.0" },
    { name = "windows_x86_64_gnullvm", version = "0.42.0" },
    { name = "windows_x86_64_gnu", version = "0.42.0" },
    { name = "windows_x86_64_msvc", version = "0.42.0" },
    # Newer versions of crates like `tempfile` are held back by crates like `atty`.
    # This is very Unfortunate as we don't actually use these platforms.
    { name = "hermit-abi", version = "0.1.6" },
    { name = "hermit-abi", version = "0.2.6" },
    { name = "redox_syscall", version = "0.2.10" },

    # Waiting on https://github.com/tokio-rs/prost/pull/833 to make it into a
    # release. (not yet in v0.11.9)
    { name = "prettyplease", version = "0.1.25" },

    # Will require updating many crates
    { name = "indexmap", version = "1.9.1" },
    # Required by indexmap 1.9.1, which is depended on by many things
    { name = "hashbrown", version = "0.12.3" },

    # https://github.com/Keats/jsonwebtoken has already updated to `pem` version `2`
    # on its main branch, but hasn't released a new version with that change yet
    # TODO: Fork https://github.com/Keats/jsonwebtoken and cherry-pick the change from
    # https://github.com/Keats/jsonwebtoken/pull/322
    { name = "pem", version = "1.1.1" },

    # Had to update `tower-http` to `0.4.3` to fix the `base64` duplicate version
    # but this introduced a new dependency on `bitflags 2.3.3` but all the rest of
    # our crates use `bitflags 1.3.2`
    # TODO: fork `tower-http` and swap to use older bitflags
    { name = "bitflags", version = "1.3.2" },
]

# Use `tracing` instead.
[[bans.deny]]
name = "env_logger"

# Use `md-5` instead, which is part of the RustCrypto ecosystem.
[[bans.deny]]
name = "md5"

# Use `sha1` instead, which the RustCrypto ecosystem recently took control of.
# `sha-1` is the older and now deprecated name.
[[bans.deny]]
name = "sha-1"

# Use `prost` or `protobuf-native` instead.
[[bans.deny]]
name = "protobuf"

# Strum has suspect code quality and includes many unneeded features. Use
# more targeted enum macro crates, e.g. `enum-kinds`.
[[bans.deny]]
name = "strum"
[[bans.deny]]
name = "strum-macros"

[[bans.deny]]
name = "log"
wrappers = [
    "deadpool-postgres",
    "env_logger",
    "eventsource-client",
    "fail",
    "generator",
    "globset",
    "hyper-rustls",
    "jsonpath_lib",
    "launchdarkly-server-sdk",
    "launchdarkly-server-sdk-evaluation",
    "mio",
    "native-tls",
    "opentls",
    "os_info",
    "postgres",
    "pprof",
    "prost-build",
    # TODO(guswynn): switch to tracing in rdkafka
    "rdkafka",
    "reqwest",
    "tokio-postgres",
    "tokio-tungstenite",
    "tokio-util",
    "tracing-log",
    "tracing",
    "tungstenite",
    "ureq",
    "want",
    "wasm-bindgen-backend",
    "workspace-hack",
]

# We prefer the system's native TLS or OpenSSL to Rustls, since they are more
# mature and more widely used.
[[bans.deny]]
name = "rustls"

# once_cell is going to be added to std, and doesn't use macros
# Unfortunately, its heavily used, so we have lots of exceptions.
[[bans.deny]]
name = "lazy_static"
wrappers = [
  "aws-http",
  "bindgen",
  "bstr",
  "clap",
  "console",
  "criterion",
  "crossbeam-epoch",
  "crossbeam-utils",
  "fail",
  "findshlibs",
  "indicatif",
  "insta",
  "launchdarkly-server-sdk",
  "launchdarkly-server-sdk-evaluation",
  "mysql_async",
  "mysql_common",
  "native-tls",
  "opentelemetry",
  "parse_duration",
  "procfs",
  "prometheus",
  "proptest",
  "prost-build",
  "rayon-core",
  "reqwest",
  "schannel",
  "sharded-slab",
  "tracing-core",
  "tracing-log",
  "tracing-subscriber",
  "wasm-bindgen-backend",
  "which",
]

# The `uncased` crate serves the same purpose as `unicase` and is more
# actively maintained.
[[bans.deny]]
name = "unicase"
wrappers = [
    "mime_guess",
    "pulldown-cmark",
]

# Must be manually kept in sync with about.toml.
# See: https://github.com/EmbarkStudios/cargo-about/issues/201
[licenses]
allow = [
    "Apache-2.0",
    "CC0-1.0",
    "0BSD",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ICU",
    "ISC",
    "MIT",
    "MPL-2.0",
    "Zlib",
]
copyleft = "deny"
private = { ignore = true }
[[licenses.clarify]]
name = "ring"
expression = "ISC"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

[sources]
unknown-git = "deny"
unknown-registry = "deny"
# Do not allow non-MaterializeInc Git repositories here! Git repositories must
# be owned by the MaterializeInc organization so that maintainership is shared
# amongst Materialize employees and so that historical versions of Materialize
# remain buildable even if upstream Git repositories disappear. If you don't
# have permissions to create a fork in the MaterializeInc organization, ask in
# #eng-infra on Slack.
allow-org = { github = ["MaterializeInc"] }