# cargo deny check — enforces docs/06 §5 (no GPL in shipped apps) and advisories.
[advisories]
version = 2
yanked = "deny"
ignore = [
  # basic-toml is NOT removed by the uniffi 0.32 upgrade (which did drop bincode and paste): every release
  # through 0.32.2 enables askama's "config" feature, and askama_derive 0.16 still depends on basic-toml for it.
  # Build-time only (template config parsing in the bindings generator); no known vulnerability.
  # Revisit when askama or uniffi_bindgen drops basic-toml.
  { id = "RUSTSEC-2026-0374", reason = "basic-toml (unmaintained, no known vulnerability) via askama_derive 0.16 in uniffi_bindgen 0.32: build-time code generation only" },
]

[licenses]
version = 2
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "MPL-2.0",
  # webpki-roots (Mozilla's CA bundle, used by kv-sync's TLS): permissive data license.
  "CDLA-Permissive-2.0"]
confidence-threshold = 0.9

[bans]
multiple-versions = "warn"
wildcards = "deny"
# The workspace's own crates are path dependencies without a version; they are never published.
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"