muxa/deny.toml at main · Open330/muxa · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# cargo-deny configuration.
# Install: `cargo install cargo-deny`
# Run:     `cargo deny check`

[graph]
all-features = true

[advisories]
version = 2
ignore = [
    # openidconnect 4.0.1 -> rsa 0.9.10. Reviewed 2026-09-27:
    # RUSTSEC-2023-0071 leaks PRIVATE keys from private-key timing operations.
    # Muxa only consumes issuer JWKS and verifies ID-token signatures
    # (CoreJsonWebKey::verify_signature -> verify_rsa_signature with n/e).
    # It never loads an RSA private key, decrypts RSA data, or signs client
    # assertions. OAuth client authentication uses a client secret over HTTP.
    # Tests sign fixture tokens with Ed25519, not RSA. No patched rsa version
    # exists. Reassess before introducing RSA signing/decryption or changing
    # the OIDC dependency: https://rustsec.org/advisories/RUSTSEC-2023-0071.html
    "RUSTSEC-2023-0071",

    # Transitive through zellij-tile 0.44.3 -> zellij-utils -> clap 3.
    # zellij-tile 0.44.3 is the latest plugin API crate as of v0.8.0, and
    # these are unmaintained advisories rather than memory-safety CVEs.
    # Revisit when zellij-tile moves off clap 3.
    "RUSTSEC-2024-0370", # proc-macro-error
    "RUSTSEC-2024-0375", # atty
    # Transitive through notify-rust -> tauri-winrt-notification -> quick-xml.
    # tauri-winrt-notification is a Windows-only (WinRT toast) dependency, so
    # quick-xml is not compiled into muxa on the Unix targets we ship. Both are
    # DoS-on-untrusted-XML issues; muxa never feeds attacker-controlled XML to
    # this crate (Windows notification templates only), and tauri-winrt-notification
    # 0.7.2 pins quick-xml ^0.37 so the fixed 0.41 can't be selected yet.
    # Revisit when notify-rust ships a tauri-winrt-notification that allows quick-xml >=0.41.
    "RUSTSEC-2026-0194", # quick-xml: quadratic runtime on duplicate attribute names
    "RUSTSEC-2026-0195", # quick-xml: unbounded namespace-declaration allocation (NsReader)
]

[licenses]
version = 2
# Licenses accepted in our dependency tree. MPL-2.0 appears transitively
# via `dirs -> dirs-sys -> option-ext`; MPL-2.0 is file-level copyleft, fine
# to link against without triggering our distribution obligations.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "0BSD",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MIT",
    "MIT-0",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "CC0-1.0",
    # `webpki-roots >= 1.0` (transitive via reqwest -> hyper-rustls)
    # ships under CDLA-Permissive-2.0 — a permissive, OSI-aligned data
    # license with no copyleft. Compatible with our MIT/Apache-2.0
    # distribution model. https://cdla.dev/permissive-2-0/
    "CDLA-Permissive-2.0",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"