terraphim-ai/deny.toml at main · terraphim/terraphim-ai · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# cargo-deny configuration for cargo-deny 0.19.0+
# https://embarkstudios.github.io/cargo-deny/

[advisories]
db-path = "~/.cargo/advisory-dbs"
db-urls = ["https://github.com/RustSec/advisory-db"]
# unmaintained uses enum: "all", "workspace", "transitive", "none"
unmaintained = "workspace"
yanked = "warn"

# Ignore specific advisories
ignore = [
    # RSA Marvin Attack - transitive dep via octocrab -> jsonwebtoken -> rsa
    # No safe upgrade available yet; RustCrypto team migrating to constant-time impl
    # TODO: Remove once octocrab updates to rsa with constant-time support
    "RUSTSEC-2023-0071",
    # atty unaligned read - transitive dep, only affects Windows with custom allocators
    "RUSTSEC-2021-0145",
    # atty unmaintained - used by terraphim_agent, should migrate to std::io::IsTerminal
    # TODO: Replace atty with is-terminal or std::io::IsTerminal
    "RUSTSEC-2024-0375",
    # bincode unmaintained - used by redb persistence backend
    # TODO: Evaluate alternatives (postcard, rkyv, etc.)
    "RUSTSEC-2025-0141",
    # dotenv unmaintained - used by atlassian_haystack
    # TODO: Replace with dotenvy
    "RUSTSEC-2021-0141",
    # term_size unmaintained - transitive dep via terraphim_validation
    # TODO: Replace with terminal_size
    "RUSTSEC-2020-0163",
    # rustls-webpki CRL revocation bypass - transitive dep via serenity -> hyper-rustls -> rustls 0.21.x
    # serenity 0.12 pins hyper-rustls 0.24 which pins rustls 0.21; cannot override without serenity upgrade
    # Disabled by default: discord removed from tinyclaw default features
    # TODO: Remove once serenity 0.13+ releases with rustls 0.23+ support
    "RUSTSEC-2026-0049",
    # rand unsound with custom logger + thread_rng - currently transitive via proptest/dev tooling.
    # TODO: remove once the rand 0.9.3+ upgrade lands across the dependency graph.
    "RUSTSEC-2026-0097",
]

[licenses]
version = 2
allow = [
    "MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause", "BSD-3-Clause", "ISC", "Zlib",
    "MPL-2.0", "CC0-1.0", "Unicode-3.0", "Unicode-DFS-2016",
    "BSL-1.0", "0BSD", "OpenSSL",
    "Unlicense",
    "GPL-3.0-or-later",
    "AGPL-3.0-or-later",
    "CDLA-Permissive-2.0",
    "bzip2-1.0.6",
]
confidence-threshold = 0.8

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[bans]
multiple-versions = "warn"
wildcards = "allow"

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]

# Allow specific git sources for our forks and security patches
allow-git = [
    "https://github.com/terraphim/rust-genai.git",
    "https://github.com/AlexMikhalev/self_update.git",
    # Security patch: tokio-tungstenite v0.28.0 pulls in rustls 0.23+ avoiding RUSTSEC-2026-0049
    "https://github.com/snapview/tokio-tungstenite.git",
    # Security patch: rustls-webpki 0.103.10 to fix RUSTSEC-2026-0049 (used by newer rustls)
    "https://github.com/rustls/webpki.git",
]