deny.toml

# https://embarkstudios.github.io/cargo-deny/

[graph]
targets = [
    { triple = "aarch64-apple-darwin" },
    { triple = "aarch64-linux-android" },
    { triple = "x86_64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-unknown-linux-musl" },
]


[licenses]
confidence-threshold = 0.93
allow = [
    "Apache-2.0 WITH LLVM-exception",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "MIT",
    "Unicode-3.0",
    "IJG", # for parts of jpeg-encoder ported from IJG libjpeg; highly permissive
]

[[licenses.exceptions]]
# Not copyleft so only applies with feature dependencies
allow = ["MPL-2.0"]
name = "mp4parse"

[advisories]
yanked = "deny"
ignore = [
    # `paste` (through rav1e) is unmaintained, migration <https://github.com/xiph/rav1e/issues/3418>
    # However the crate still works with forseeable problems only in future editions.
    "RUSTSEC-2024-0436",
]


[bans]
multiple-versions = "deny"
wildcards = "allow" # at least until https://github.com/EmbarkStudios/cargo-deny/issues/241 is fixed
deny = []
skip = [
    { name = "bitflags" },   # Some deps depend on 1.3.2 while others on 2.6.0
    { name = "hashbrown" },  # Some deps depend on 0.13.2 while others on 0.14.5
    { name = "zune-core" },  # Some deps depend on 0.4.12 while others on 0.5.0
    { name = "zune-jpeg" },  # Some deps depend on 0.4.21 while others on 0.5.1
    { name = "winnow" },     # Some deps depend on 0.7.15 while others on 1.0.0
]