deny.toml

# Dependency policy for icp-cli, enforced by the Dependencies workflow. icp-cli
# ships a linked binary, so these rules cover what we may distribute rather than
# obligations passed to downstream crates (cf. dfinity/candid).

[graph]
# Dev-only deps never reach the released binary. Explicit so a changed default
# cannot silently widen the graph.
exclude-dev = true

[advisories]
# Vulnerabilities are denied, except those listed in `ignore` below, each of
# which needs a fix already in progress and a link to it. Informational advisories are
# transitive crates we do not pick, usually with no patched version, and GHSA
# omits them so Dependabot never raises them either. Replaces the stale
# hand-maintained ignore list in .cargo/audit.toml.
unmaintained = "none"
# Not a vulnerability, and usually clears on the next `cargo update`.
yanked = "warn"
ignore = [
  # crypto-bigint 0.5 has no patched release, and ic-agent's elliptic-curve
  # 0.13 stack pins it. A timing side channel is a remote risk for a local CLI
  # that signs only with the user's own keys. Remove once ic-agent ships the
  # 0.14 stack (dfinity/agent-rs#745) and icp-cli moves to it.
  { id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5 pinned by ic-agent; fix in dfinity/agent-rs#745" },
  # zstd 0.13 and zstd-safe 7 have no patched release on their line, and
  # wasmtime's cache crate requires `zstd = "0.13"`; the patched versions are a
  # semver-major bump, and as of 2026-10-26 no wasmtime release or open PR moves
  # it (bytecodealliance/wasmtime#14995 and #14996 were closed unmerged). The
  # flaws are in streaming decompression of untrusted input and in `Seekable`,
  # and wasmtime only round-trips its own cache files. Remove once a wasmtime
  # release requires zstd 0.14 and icp-cli moves to it.
  { id = "RUSTSEC-2026-0391", reason = "zstd 0.13 pinned by wasmtime-internal-cache; no wasmtime release on zstd 0.14 yet" },
  { id = "RUSTSEC-2026-0398", reason = "zstd-safe 7 pinned by wasmtime-internal-cache; no wasmtime release on zstd 0.14 yet" },
  { id = "RUSTSEC-2026-0403", reason = "zstd-safe 7 pinned by wasmtime-internal-cache; no wasmtime release on zstd 0.14 yet" },
]

[licenses]
# Binary distribution, so: attribution-only terms, plus MPL-2.0, whose copyleft
# is file-scoped and we modify none of those files. Strong copyleft would reach
# the whole linked binary. Unlisted licenses are denied.
#
# ittapi (GPL-2.0-only) and r-efi (LGPL-2.1-or-later) are dual-licensed and
# satisfied from an entry below.
allow = [
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "BlueOak-1.0.0",
  "CC0-1.0",
  "CDLA-Permissive-2.0",
  "ISC",
  "MIT",
  "MPL-2.0",
  "Unicode-3.0",
  "Zlib",
]

# OpenSSL and Unicode-DFS-2016 sat here unused for years; warn on the next drift.
unused-allowed-license = "warn"

[bans]
# ~60 shared crates differ across cargo-generate, wasmtime, ic-agent and reqwest
# pins we do not control.
multiple-versions = "allow"

[sources]
# Everything resolves from crates.io, and a git revision is mutable enough to
# make a tagged release non-reproducible. cargo-deny only warns by default.
unknown-registry = "deny"
unknown-git = "deny"