deny.toml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

[advisories]
ignore = [
    { id = "RUSTSEC-2023-0071", reason = "No fixed version; reqsign only signs locally generated outbound requests and exposes no remote signing or decryption timing oracle." },
    # zstd 0.13 is still required by Arrow, DataFusion, Parquet, and other upstream crates.
    # Revisit these API-specific exceptions as those dependencies adopt zstd 0.14.
    { id = "RUSTSEC-2026-0391", reason = "No caller uses the affected raw Encoder/Decoder::with_context constructors." },
    { id = "RUSTSEC-2026-0398", reason = "The affected zstd-safe seekable feature is not enabled." },
    { id = "RUSTSEC-2026-0403", reason = "No old zstd caller uses write::Decoder or raw streaming decode; compression-codecs now uses patched zstd-safe 8.2." },
]

[licenses]
allow = [
    "0BSD",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "CC0-1.0",
    "MIT",
    "Unicode-3.0",
    "Zlib",
    "bzip2-1.0.6",
]

exceptions = [
    # open data licenses that SHOULD be OK
    { crate = "webpki-root-certs", allow = [
        "CDLA-Permissive-2.0",
    ] },
]