# cargo deny check — enforces docs/06 §5 (no GPL in shipped apps) and advisories.
[advisories]
version = 2
yanked = "deny"
ignore = [
  # Unmaintained (no known vulnerability), build-time only: pulled in by uniffi 0.28's proc-macros and
  # bindgen, never linked into the shipped library's runtime paths. Goes away with a uniffi upgrade,
  # which regenerates the Swift/Kotlin bindings (tracked in fuzz/README.md "Dependency policy").
  { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
  { id = "RUSTSEC-2024-0436", reason = "paste via uniffi_core/uniffi_bindgen 0.28 (proc-macro)" },
]

[licenses]
version = 2
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "MPL-2.0",
  # webpki-roots (Mozilla's CA bundle, used by kv-sync's TLS): permissive data license.
  "CDLA-Permissive-2.0"]
confidence-threshold = 0.9

[bans]
multiple-versions = "warn"
wildcards = "deny"
# The workspace's own crates are path dependencies without a version; they are never published.
allow-wildcard-paths = true

[sources]
unknown-registry = "deny"
unknown-git = "deny"