deny.toml

[bans]
multiple-versions = "deny"
# Do not add exemptions for duplicate dependencies! Duplicate dependencies slow
# down compilation, bloat the binary, and tickle race conditions in `cargo doc`
# (see rust-lang/cargo#3613). Submit PRs upstream to remove duplicated
# transitive dependencies. If necessary, use patch directives in the root
# Cargo.toml to point at a Materialize-maintained fork that avoids the
# duplicated transitive dependencies.

# Use `tracing` instead.
[[bans.deny]]
name = "env_logger"

# Use `md-5` instead, which is part of the RustCrypto ecosystem.
[[bans.deny]]
name = "md5"

# Use `sha1` instead, which the RustCrypto ecosystem recently took control of.
# `sha-1` is the older and now deprecated name.
[[bans.deny]]
name = "sha-1"

# Use `prost` or `protobuf-native` instead.
[[bans.deny]]
name = "protobuf"

# Strum has suspect code quality and includes many unneeded features. Use
# more targeted enum macro crates, e.g. `enum-kinds`.
[[bans.deny]]
name = "strum"
[[bans.deny]]
name = "strum-macros"

[[bans.deny]]
name = "log"
wrappers = [
    "deadpool-postgres",
    "env_logger",
    "eventsource-client",
    "fail",
    "globset",
    "hyper-rustls",
    "jsonpath_lib",
    "launchdarkly-server-sdk",
    "launchdarkly-server-sdk-evaluation",
    "mio",
    "native-tls",
    "opentls",
    "os_info",
    "postgres",
    "pprof",
    "prost-build",
    # TODO(guswynn): switch to tracing in rdkafka
    "rdkafka",
    "reqwest",
    "tokio-postgres",
    "tokio-tungstenite",
    "tokio-util",
    "tracing-log",
    "tracing",
    "tungstenite",
    "ureq",
    "want",
    "wasm-bindgen-backend",
    "workspace-hack",
]

# We prefer the system's native TLS or OpenSSL to Rustls, since they are more
# mature and more widely used.
[[bans.deny]]
name = "rustls"

# once_cell is going to be added to std, and doesn't use macros
# Unfortunately, its heavily used, so we have lots of exceptions.
[[bans.deny]]
name = "lazy_static"
wrappers = [
  "aws-arn",
  "aws-http",
  "bindgen",
  "bstr",
  "clap",
  "console",
  "criterion",
  "crossbeam-epoch",
  "crossbeam-utils",
  "fail",
  "findshlibs",
  "indicatif",
  "launchdarkly-server-sdk",
  "launchdarkly-server-sdk-evaluation",
  "mysql_async",
  "mysql_common",
  "native-tls",
  "opentelemetry",
  "parse_duration",
  "procfs",
  "prometheus",
  "proptest",
  "prost-build",
  "rayon-core",
  "reqwest",
  "schannel",
  "sharded-slab",
  "tracing-core",
  "tracing-log",
  "tracing-subscriber",
  "wasm-bindgen-backend",
  "which",
]

# The `uncased` crate serves the same purpose as `unicase` and is more
# actively maintained.
[[bans.deny]]
name = "unicase"
wrappers = [
    "mime_guess",
    "pulldown-cmark",
]

# Must be manually kept in sync with about.toml.
# See: https://github.com/EmbarkStudios/cargo-about/issues/201
[licenses]
allow = [
    "Apache-2.0",
    "CC0-1.0",
    "0BSD",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ICU",
    "ISC",
    "MIT",
    "MPL-2.0",
    "Zlib",
]
copyleft = "deny"
private = { ignore = true }
[[licenses.clarify]]
name = "ring"
expression = "ISC"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

[sources]
unknown-git = "deny"
unknown-registry = "deny"
allow-git = [
    # Waiting on https://github.com/tokio-rs/axum/pull/1598 to make it into a
    # release.
    "https://github.com/tokio-rs/axum.git",

    # Waiting for a new release of strip-ansi-escapes that avoids the indirect
    # dependency on arrayvec v0.5.2 via a dependency on vte v0.10.1.
    "https://github.com/alacritty/vte",

    # Waiting for a new release that bumps to itoa v1.0.
    # See: https://github.com/BurntSushi/rust-csv/issues/271
    "https://github.com/BurntSushi/rust-csv.git",

    # Waiting for https://github.com/chronotope/chrono/pull/906
    # to be released in the v0.4.x series.
    "https://github.com/chronotope/chrono.git",

    # Waiting on v0.18.
    # See: https://github.com/open-telemetry/opentelemetry-rust/pull/779
    "https://github.com/MaterializeInc/opentelemetry-rust.git",

    # Waiting on tracing-opentelemetry to upgrade to the as-yet unreleased
    # v0.18 of opentelemetry.
    "https://github.com/MaterializeInc/tracing.git",

    # Waiting on https://github.com/tikv/pprof-rs/pull/181 to make it into a
    # release.
    "https://github.com/MaterializeInc/pprof-rs.git",

    # Waiting on https://github.com/AltSysrq/proptest/pull/264.
    "https://github.com/MaterializeInc/proptest.git",

    # Waiting on https://github.com/sfackler/rust-postgres/pull/752.
    "https://github.com/MaterializeInc/rust-postgres.git",
    "https://github.com/MaterializeInc/rust-postgres-array.git",

    # Waiting on https://github.com/MaterializeInc/serde-value/pull/35.
    "https://github.com/MaterializeInc/serde-value.git",

    # Waiting on https://github.com/edenhill/librdkafka/pull/4051.
    "https://github.com/MaterializeInc/rust-rdkafka.git",

    # Waiting on https://github.com/jorgecarleitao/arrow2/pull/1297 to make it
    # into a release.
    "https://github.com/jorgecarleitao/arrow2.git",

    # Waiting for hashlink, indexmap, and lru to upgrade to hashbrown v0.13,
    # which depends on ahash v0.8 instead of v0.7. In the meantime we've
    # backported the ahash v0.8 bump into hashbrown v0.12.
    "https://github.com/MaterializeInc/hashbrown.git",

    # Dependencies that we control upstream whose official releases we don't
    # care about.
    "https://github.com/frankmcsherry/columnation",
    "https://github.com/TimelyDataflow/timely-dataflow",
    "https://github.com/TimelyDataflow/differential-dataflow.git",

    # Waiting on https://github.com/launchdarkly/rust-eventsource-client/pull/43
    # to make it into a release.
    "https://github.com/MaterializeInc/rust-eventsource-client.git",

    # Waiting on https://github.com/launchdarkly/rust-server-sdk/pull/20 to make
    # it into a release.
    "https://github.com/MaterializeInc/rust-server-sdk",
]