deny.toml

# cargo-deny policy for the Flash nested workspace.
#
# Flash is excluded from the root cargo workspace (edition 2024,
# resolver 3, its own pinned toolchain), so the root deny.toml never sees this
# lockfile. Reedline is the first external dependency; this policy keeps it and
# every later addition audited by CI instead of allowing them to arrive
# unreviewed.

[advisories]
version = 2
# No ignores — an entry here must carry a comment justifying the exception.
ignore = []

[licenses]
version = 2
confidence-threshold = 0.9
# Flash itself ships under MIT. Dependencies may use this reviewed set of
# permissive licenses; Unicode-3.0 covers data tables in unicode-ident.
allow = [
    "Apache-2.0",
    "MIT",
    "Unicode-3.0",
]

[bans]
# A duplicate version flags supply-chain bloat for review without blocking a
# legitimate transitive diamond.
multiple-versions = "warn"
wildcards = "warn"

[sources]
# Crates may come only from crates.io. Adding a git or private-registry source
# is a supply-chain decision that must be made explicitly here.
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]