walletkit/deny.toml at main · worldcoin/walletkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
[graph]
# Cargo deny will check dependencies via `--all-features`
all-features = true

[sources]
unknown-registry = "deny"

[bans]
deny = [
  { name = "openssl", reason = "increases complexity for foreign binding compilation and bundle size" },
]

[licenses]
version = 2
# We want really high confidence when inferring licenses from text
confidence-threshold = 1.0

# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
allow = [
  "0BSD",
  "Apache-2.0 WITH LLVM-exception",
  "Apache-2.0",
  "BSD-2-Clause",
  # "BSD-2-Clause-Patent",
  "BSD-3-Clause",
  "BSL-1.0",
  "CC0-1.0",
  "CDLA-Permissive-2.0",
  "ISC",
  "MIT",
  "MPL-2.0",             # Although this is copyleft, it is scoped to modifying the original files
  "OpenSSL",
  "Unicode-3.0",
  "Unlicense",
  "Zlib",
]

[[licenses.clarify]]
name = "webpki"
version = "0.22.4"
expression = "ISC"
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]

# Ignore unmaintained required crates warning
[advisories]
ignore = [
  "RUSTSEC-2024-0388", # Unmaintained `derivative` (2024-11-22)
  "RUSTSEC-2024-0436", # Unmaintained `paste` (2025-04-04)
  "RUSTSEC-2023-0089", # Unmaintained `atomic-polyfill` (2025-06-03)
  "RUSTSEC-2025-0055", # `tracing-subscriber` < 0.3.20, requires bumps on `semaphore-rs` (and Ark deps) (2025-09-09)
  "RUSTSEC-2025-0141", # Unmaintained `bincode`, feature complete for now (2026-01-15)
  "RUSTSEC-2025-0057", # Unmaintained `fxhash` (2025-09-05)
  "RUSTSEC-2026-0247", # Unmaintained `bitmaps` (transitive via `im` / `provekit` / `world-id-proof`)
  "RUSTSEC-2026-0248", # Unmaintained `im` (transitive via `provekit` / `world-id-proof`)
  "RUSTSEC-2026-0251", # Unmaintained `sized-chunks` (transitive via `im` / `provekit` / `world-id-proof`)
]