deny.toml

[graph]
targets = []
all-features = true

[advisories]
version = 2
ignore = [
  # Transitive through lopdf. RUSTSEC-2026-0192 marks ttf-parser unmaintained,
  # but lopdf has no safe replacement path yet; keep this scoped and revisit
  # when lopdf drops ttf-parser or the PDF adapter moves to a maintained parser.
  { id = "RUSTSEC-2026-0192", reason = "transitive through lopdf; no safe upgrade is available yet" },
]

[licenses]
version = 2
allow = [
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "MIT",
  "AGPL-3.0-only",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-3.0",
  "Zlib",
]
exceptions = [
  # headless_chrome currently uses auto_generate_cdp only as a build dependency to
  # generate CDP bindings during compilation; it is not linked into runtime binaries.
  { crate = "auto_generate_cdp", allow = ["GPL-3.0-or-later"] },
  # Transitive through auto_generate_cdp -> ureq; scoped to this crate.
  { crate = "webpki-roots", allow = ["CDLA-Permissive-2.0"] },
  # notify is the daemon's cross-platform config watcher; keep its permissive
  # public-domain dedication scoped instead of admitting CC0 workspace-wide.
  { crate = "notify", allow = ["CC0-1.0"] },
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]