deny.toml

[advisories]
# Ignore unmaintained/vulnerable crates that come from upstream dependencies we cannot control
ignore = [
    # rustls-pemfile is unmaintained but comes from bollard -> testcontainers (dev dependency)
    # No safe upgrade available, waiting for upstream to migrate to rustls-pki-types
    "RUSTSEC-2025-0134",

    # bincode is unmaintained but comes from reth-nippy-jar (upstream reth dependency)
    # No safe upgrade available
    "RUSTSEC-2025-0141",

    # paste is unmaintained but widely used in ecosystem (alloy, reth, etc.)
    # No safe upgrade available
    "RUSTSEC-2024-0436",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",
    "0BSD",
    "BSL-1.0",
    "OpenSSL",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

# Allow workspace crates that don't have explicit license fields
exceptions = []

[bans]
deny = ["reth"]
multiple-versions = "deny"

# Skip crates with multiple versions from upstream dependencies that we cannot control
# These are primarily from reth, alloy, and upstream dependencies
skip = [
    # Windows platform crates - different versions used by various upstream deps
    "windows-sys",
    "windows",
    "windows-core",
    "windows-result",
    "windows-targets",
    "windows_aarch64_gnullvm",
    "windows_aarch64_msvc",
    "windows_i686_gnu",
    "windows_i686_gnullvm",
    "windows_i686_msvc",
    "windows_x86_64_gnu",
    "windows_x86_64_gnullvm",
    "windows_x86_64_msvc",

    # Core macro/derive crates - commonly have version differences across ecosystem
    "darling",
    "darling_core",
    "darling_macro",
    "thiserror",
    "thiserror-impl",

    # Crypto/random crates - version differences from different crypto stacks
    "rand",
    "rand_core",
    "rand_chacha",
    "getrandom",
    "r-efi",
    "secp256k1",
    "secp256k1-sys",

    # Hash/collection crates
    "hashbrown",
    "hashlink",
    "foldhash",
    "itertools",
    "lru",

    # Crypto crates - version differences from different crypto stacks
    "block-buffer",
    "const-oid",
    "crypto-common",
    "digest",
    "hex-literal",
    "sha1",
    "signature",
    "strum",
    "strum_macros",

    # System/platform crates
    "rustix",
    "linux-raw-sys",
    "socket2",
    "bitflags",
    "redox_users",
    "system-configuration",

    # Network crates
    "tungstenite",
    "tokio-tungstenite",

    # Metrics
    "metrics-util",
    "metrics-exporter-prometheus",

    # Other common duplicates from upstream
    "axum",
    "axum-core",
    "base64",
    "bincode",
    "core-foundation",
    "crossterm",
    "ethereum_ssz",
    "generic-array",
    "matchit",
    "nix",
    "gloo-timers",
    "indexmap",
    "miniz_oxide",
    "opentelemetry_sdk",
    "opentelemetry-http",
    "opentelemetry-otlp",
    "opentelemetry-proto",
    "opentelemetry",
    "prost-derive",
    "prost",
    "send_wrapper",
    "tonic",
    "tower",
    "tracing-opentelemetry",
    "webpki-roots",
    "webpki-root-certs",

    # libp2p dependency chain version mismatch
    "unsigned-varint",
    "if-addrs",
    "yamux",

    # spin version mismatch: base-protocol uses 0.9.x, buddy_system_allocator uses 0.10.x
    "spin",

    # mach2 version mismatch: tracing-samply uses 0.5.0, metrics-process uses 0.6.0
    "mach2",

    # reqwest version mismatch: alloy use 0.12.x, newer deps use 0.13.x
    "reqwest",

    # rlimit version mismatch: base-builder-core uses 0.10.x, metrics-process uses 0.11.x
    "rlimit",

    # quick-error version mismatch: proptest -> rusty-fork uses 1.x, other deps use 2.x
    "quick-error",

    # rustls-platform-verifier version mismatch: jsonrpsee uses 0.5.x, reqwest uses 0.6.x
    "rustls-platform-verifier",

    # AWS SDK version mismatches from tips aws-sdk-s3 dependency
    "aws-smithy-http",
    "aws-smithy-json",

    # TLS/HTTP stack version mismatches from aws-sdk/rdkafka deps
    "h2",
    "http",
    "http-body",
    "hyper",
    "hyper-rustls",
    "rustls",
    "rustls-webpki",
    "tokio-rustls",

    # toml/serde stack version mismatches from upstream deps
    "serde_spanned",
    "syn",
    "toml",
    "toml_datetime",
    "toml_edit",

    # etcetera version mismatch: sqlx-mysql uses 0.8.x, testcontainers uses 0.11.x
    "etcetera",

    "half",
    "memoffset",
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"

# Allow git sources from known upstream repositories
allow-git = [
    "https://github.com/paradigmxyz/reth",
    "https://github.com/op-rs/op-reth",
    "https://github.com/ethereum-optimism/optimism",
]