axum/deny.toml

[graph]
exclude-unpublished = true

[advisories]
unmaintained = "none"
ignore = []

[licenses]
confidence-threshold = 0.8
allow = [
    "Apache-2.0",
    "BSD-3-Clause",
    "MIT",
    "Unicode-3.0",
]

[bans]
multiple-versions = "deny"
highlight = "all"
skip-tree = [
    # currently duplicated through header, reqwest, tower-http and cookie
    # C.f. https://github.com/tokio-rs/axum/pull/1641
    { name = "base64" },
    # parking_lot pulls in old versions of windows-sys
    { name = "windows-sys" },
    # old version pulled in by rustls via ring
    { name = "spin" },
    # lots still pulls in syn 1.x
    { name = "syn" },
    # until 1.0 is out we're pulling in both 0.14 and 1.0-rc.x
    { name = "hyper" },
    # pulled in by tracing-subscriber
    { name = "regex-syntax" },
    # pulled in by tracing-subscriber
    { name = "regex-automata" },
    # pulled in by hyper
    { name = "socket2" },
    # hyper-util hasn't upgraded to 0.5 yet, but it's the same service / layer
    # crates beneath
    { name = "tower" },
    # tower hasn't upgraded to 1.0 yet
    { name = "sync_wrapper" },
    # pulled in by quickcheck and cookie
    { name = "rand" },
]

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-git = []