1717# this list would mean the nix crate, as well as any of its exclusive
1818# dependencies not shared by any other crates, would be ignored, as the target
1919# list here is effectively saying which targets you are building for.
20+ [graph ]
2021targets = [
2122 # The triple can be any string, but only the target triples built in to
2223 # rustc (as of 1.40) can be checked against actual config expressions
@@ -35,26 +36,12 @@ targets = [
3536db-path = " ~/.cargo/advisory-db"
3637# The url(s) of the advisory databases to use
3738db-urls = [" https://github.com/rustsec/advisory-db" ]
38- # The lint level for security vulnerabilities
39- vulnerability = " deny"
40- # The lint level for unmaintained crates
41- unmaintained = " warn"
39+ version = 2
4240# The lint level for crates that have been yanked from their source registry
4341yanked = " warn"
44- # The lint level for crates with security notices. Note that as of
45- # 2019-12-17 there are no security notice advisories in
46- # https://github.com/rustsec/advisory-db
47- notice = " warn"
4842# A list of advisory IDs to ignore. Note that ignored advisories will still
4943# output a note when they are encountered.
50- ignore = [
51- # stderrlog needs to fix it
52- " RUSTSEC-2020-0071" ,
53- # stderrlog needs to fix it
54- " RUSTSEC-2020-0159" ,
55- # stderrlog needs to fix it
56- " RUSTSEC-2022-0006" ,
57- ]
44+ ignore = []
5845# Threshold for security vulnerabilities, any vulnerability with a CVSS score
5946# lower than the range specified will be ignored. Note that ignored advisories
6047# will still output a note when they are encountered.
@@ -63,45 +50,21 @@ ignore = [
6350# * Medium - CVSS Score 4.0 - 6.9
6451# * High - CVSS Score 7.0 - 8.9
6552# * Critical - CVSS Score 9.0 - 10.0
66- # severity-threshold =
53+ # severity-threshold =
6754
6855# This section is considered when running `cargo deny check licenses`
6956# More documentation for the licenses section can be found here:
7057# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
7158[licenses ]
72- # The lint level for crates which do not have a detectable license
73- unlicensed = " deny"
7459# List of explictly allowed licenses
7560# See https://spdx.org/licenses/ for list of possible licenses
7661# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
7762allow = [
7863 " MIT" ,
7964 " Apache-2.0" ,
8065 " BSD-3-Clause" ,
81- " Unicode-DFS-2016" ,
82- ]
83- # List of explictly disallowed licenses
84- # See https://spdx.org/licenses/ for list of possible licenses
85- # [possible values: any SPDX 3.11 short identifier (+ optional exception)].
86- deny = [
87- " GPL-2.0" ,
88- " GPL-3.0" ,
89- # "Nokia",
66+ " Unicode-3.0" ,
9067]
91- # Lint level for licenses considered copyleft
92- copyleft = " deny"
93- # Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
94- # * both - The license will be approved if it is both OSI-approved *AND* FSF
95- # * either - The license will be approved if it is either OSI-approved *OR* FSF
96- # * osi-only - The license will be approved if is OSI-approved *AND NOT* FSF
97- # * fsf-only - The license will be approved if is FSF *AND NOT* OSI-approved
98- # * neither - This predicate is ignored and the default lint level is used
99- allow-osi-fsf-free = " neither"
100- # Lint level used when no other predicates are matched
101- # 1. License isn't in the allow or deny lists
102- # 2. License isn't copyleft
103- # 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither"
104- default = " deny"
10568# The confidence threshold for detecting a license from license text.
10669# The higher the value, the more closely the license text must be to the
10770# canonical license text of a valid SPDX license file.
@@ -178,8 +141,8 @@ deny = [
178141skip = [
179142 # { name = "ansi_term", version = "=0.11.0" },
180143]
181- # Similarly to `skip` allows you to skip certain crates during duplicate
182- # detection. Unlike skip, it also includes the entire tree of transitive
144+ # Similarly to `skip` allows you to skip certain crates during duplicate
145+ # detection. Unlike skip, it also includes the entire tree of transitive
183146# dependencies starting at the specified crate, up to a certain depth, which is
184147# by default infinite
185148skip-tree = [
0 commit comments