deny.toml

targets = [
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "x86_64-apple-darwin" },
]

[licenses]
unlicensed = "deny"
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception"]
deny = ["AGPL-1.0", "AGPL-3.0"]
copyleft = "warn"
allow-osi-fsf-free = "either"
default = "deny"
confidence-threshold = 0.8
exceptions = []
private = { ignore = false, registries = [] }

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[bans]
multiple-versions = "deny"
deny = [
    # See: https://github.com/rust-random/rand/issues/645
    { name = "rand", version = "<0.6" },

    # See: https://github.com/near/nearcore/pull/3595
    { name = "keccak-hash", version = "<0.4.1" },
    { name = "primitive-types", version = "<0.10.1" },
    { name = "uint", version = "<0.8.2" },

    # https://github.com/near/nearcore/pull/8562
    { name = "borsh", version = "0.10, <0.10.2" },
]

skip = [
    { name = "clap", version = "=2.34.0" },
    # criterion uses clap=2.34.0 which relies on an older textwrap
    { name = "textwrap", version = "=0.11.0" },

    # wasmer 0.17 and wasmtime 0.17 use conflicting versions of those
    { name = "wasmparser", version = "=0.51.4" },
    # wasmer 0.17 and wasmtime 0.17 uses older versions of some crates
    { name = "generic-array", version = "=0.12.4" },

    # `sha2` uses it
    { name = "cfg-if", version = "=1.0.0" },

    # `sha2`, `blake3` and `curve25519-dalek` need to be updated.
    { name = "block-buffer", version = "=0.9.0" },
    { name = "digest", version = "=0.9.0" },
    { name = "sha2", version = "=0.9.9" },

    # near-vm-runner and wasmer-compiler-near use 0.78.2
    { name = "wasmparser", version = "=0.78.2" },
    # Need this specific version of pwasm-utils for backwards-compatible
    # stack limiting.
    { name = "pwasm-utils", version = "=0.12.0" },
    { name = "parity-wasm", version = "=0.41.0" },

    # wasmer and wasmtime
    { name = "target-lexicon", version = "=0.10.0" },
    { name = "wasmparser", version = "=0.84.0" },

    # wasmtime v4
    { name = "wasmparser", version = "=0.95.0" },

    # finite-wasm
    { name = "wasmparser", version = "=0.99.0" },

    # wasmer 0.17.x
    { name = "parking_lot", version = "=0.10.2" },
    { name = "parking_lot_core", version = "=0.7.2" },
    { name = "lock_api", version = "=0.3.4" },
    { name = "digest", version = "=0.8.1" },

    # wasmer 0.18
    { name = "nix", version = "=0.15.0" },

    # many crates haven't updated to syn 2.0 yet.
    { name = "syn", version = "=1.0.103" },

    # old version of tokio, parking_lot
    { name = "windows-sys", version = "=0.36.1" },
    { name = "windows_x86_64_msvc", version = "=0.36.1" },

    # old version of rustix, wasmtime, is-terminal, etc.
    { name = "rustix", version = "0.36.6" },
    { name = "linux-raw-sys", version = "0.1.4" },
    { name = "windows-sys", version = "=0.42.0" },
    { name = "windows-sys", version = "=0.45.0" },
    { name = "windows_x86_64_msvc", version = "=0.42.1" },
    { name = "windows-targets", version = "=0.42.1" },

    # chrono uses old time crate
    { name = "time", version = "=0.1.44" },

    # ed25519-dalek uses older versions of rand and rand_core
    { name = "rand", version = "=0.7.3" },
    { name = "rand_core", version = "=0.5.1" },
    { name = "rand_chacha", version = "=0.2.2" },
    { name = "getrandom", version = "=0.1.16" },

    # criterion and criterion-plot use conflicting versions
    { name = "semver-parser", version = "=0.7.0" },
    { name = "semver", version = "=0.9.0" },

    # wasmer-runtime-core-near and parity-secp256k1 use an older version
    { name = "arrayvec", version = "=0.5.2" },

    # borsh uses a very old version of proc-macro-crate
    { name = "proc-macro-crate", version = "=0.1.5" },

    # criterion and wasmer-runtime-core-near depend on this older
    # version of the crate.
    { name = "rustc_version", version = "=0.2.3" },

    # paperclip-macros, strum_macros, walrus-macro depend on this while clap3.1.6 uses heck=0.4.0
    { name = "heck", version = "=0.3.3" },

    # Wasmer requires a newer version and the rest of the ecosystem hasn't caught up yet.
    { name = "hashbrown", version = "0.11.0" },

    # prometheus depends on an old version of protobuf
    { name = "protobuf", version = "=2.27.1" },

    # opentelemetry-otlp depends on an old version of tonic which depends on an old version of tokio-util
    { name = "tokio-util", version = "=0.6.10" },

    # rust-s3 is using an old version of smartstring
    { name = "smartstring", version = "=0.2.10" },

    # validator 0.12 ~ 0.16 is still using an old version of idna
    { name = "idna", version = "=0.2.3" },

    # zeropool-bn uses borsh 0.9
    { name = "borsh", version = "=0.9.3" },
    { name = "borsh-derive", version = "=0.9.3" },
    { name = "borsh-derive-internal", version = "=0.9.3" },
    { name = "borsh-schema-derive-internal", version = "=0.9.3" },

    # near-test-contracts
    { name = "wasm-encoder", version = "=0.11.0" },
]