deny.toml

# Documentation for this configuration file can be found here
# https://embarkstudios.github.io/cargo-deny/checks/cfg.html

targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "aarch64-linux-android" },
]

# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
[licenses]
allow = [
    "Apache-2.0 WITH LLVM-exception",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MIT",
    "MPL-2.0",
    "OpenSSL",
    "Unicode-DFS-2016",
    "Zlib",
]

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
multiple-versions = "deny"
wildcards = "allow"
deny = []

skip-tree = [
    # wit-bindgen and wasmtime both depend on the wasm-tools crates, and
    # wit-bindgen's latest release may sometimes lag behind when we bump
    # wasmtime's dependencies on wasm-tools. wit-bindgen is only used for
    # building component-based test programs, so we are going to ignore
    # the multiple-versions errors it will introduce.
    { name = "wit-bindgen", depth = 20 },

    # Criterion 0.3 is pretty old at this point and has had an upcoming 0.4 for
    # a long time. This is a dev-dependency so we don't really mind its
    # dependency tree, so skip it entirely.
    { name = "criterion", depth = 20 },

    # This is maintained externally and we allow it to have duplicate
    # dependencies relative to Wasmtime's main dependency tree.
    { name = "witx", depth = 20 },

    # This is somewhat unmaintained at this point and seems to pull in an old
    # version of `env_logger`, so ignore it.
    { name = "pretty_env_logger", depth = 20 },

    # They want to publish version 2.0 to upgrade `hashbrown` so in the meantime
    # it is duplicated for us.
    { name = "indexmap", depth = 2 },

    # This is on and older version of `wasm-encoder` and is one we can't
    # necessarily easily update, so let `wasm-encoder` get duplicated for now.
    { name = "wasm-coredump-builder", depth = 2 },

    # The native-tls crate hasn't kept up with updates to the underlying
    # windows-sys, while the rest of the ecosystem has. This duplicated
    # dependency appears to be benign.
    { name = "windows-sys", depth = 3 },
]