deny.toml

[advisories]
# Ignore unmaintained/vulnerable crates that come from upstream dependencies we cannot control
ignore = [
    # bincode is unmaintained but comes from reth-nippy-jar (upstream reth dependency)
    # No safe upgrade available
    "RUSTSEC-2025-0141",

    # paste is unmaintained but widely used in ecosystem (alloy, reth, etc.)
    # No safe upgrade available
    "RUSTSEC-2024-0436",

    # atomic-polyfill is unmaintained but comes from upstream reth/alloy dependencies
    "RUSTSEC-2023-0089",

    # tar PAX extension vulnerability — comes from reth-cli-commands, waiting for upstream fix
    "RUSTSEC-2026-0066",

    # AWS-LC X.509 vulnerabilities — transitive from aws-sdk deps, waiting for upstream fix
    "RUSTSEC-2026-0044",
    "RUSTSEC-2026-0048",

    # backoff is unmaintained — transitive from upstream reth/alloy dependencies
    "RUSTSEC-2025-0012",

    # derivative is unmaintained — transitive from upstream reth dependencies
    "RUSTSEC-2024-0388",

    # instant is unmaintained — transitive from upstream reth dependencies
    "RUSTSEC-2024-0384",

    # aws-lc-sys SHAKE API — transitive from aws-sdk deps
    "RUSTSEC-2026-0074",

    # lz4 decompression info leak — transitive from reth-cli-commands
    "RUSTSEC-2026-0041",

    # rsa Marvin Attack — transitive from upstream dependencies
    "RUSTSEC-2023-0071",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",
    "0BSD",
    "BSL-1.0",
    "OpenSSL",
    "CDLA-Permissive-2.0",
    "LGPL-3.0-only",
    "LGPL-3.0-or-later",
]
confidence-threshold = 0.8

# Allow workspace crates that don't have explicit license fields
exceptions = []

[bans]
deny = ["reth"]
multiple-versions = "deny"

# Skip crates with multiple versions from upstream dependencies that we cannot control
# These are primarily from reth, alloy, and upstream dependencies
skip = [
    # Windows platform crates - different versions used by various upstream deps
    "windows",
    "windows-core",
    "windows-implement",
    "windows-link",
    "windows-result",
    "windows-strings",
    "windows-sys",
    "windows-targets",
    "windows_aarch64_gnullvm",
    "windows_aarch64_msvc",
    "windows_i686_gnu",
    "windows_i686_gnullvm",
    "windows_i686_msvc",
    "windows_x86_64_gnu",
    "windows_x86_64_gnullvm",
    "windows_x86_64_msvc",

    # Core macro/derive crates - commonly have version differences across ecosystem
    "darling",
    "darling_core",
    "darling_macro",
    "thiserror",
    "thiserror-impl",

    # Crypto/random crates - version differences from different crypto stacks
    "rand",
    "rand_core",
    "rand_chacha",
    "getrandom",
    "r-efi",
    "secp256k1",
    "secp256k1-sys",

    # Hash/collection crates
    "hashbrown",
    "hashlink",
    "foldhash",
    "itertools",
    "lru",

    # System/platform crates
    "socket2",
    "bitflags",
    "redox_users",
    "windows",
    "windows-collections",
    "windows-core",
    "windows-future",
    "windows-implement",
    "windows-link",
    "windows-numerics",
    "windows-result",
    "windows-strings",
    "windows-threading",

    # Network crates
    "tungstenite",
    "tokio-tungstenite",
    "axum",
    "axum-core",
    "hyper-timeout",
    "tonic",
    "tonic-build",
    "tower",

    # Other common duplicates from upstream
    "base64",
    "bincode",
    "bindgen",
    "console",
    "core-foundation",
    "derive_more",
    "derive_more-impl",
    "dirs",
    "dirs-sys",
    "generic-array",
    "indexmap",
    "indicatif",
    "matchit",
    "nix",
    "num_enum",
    "num_enum_derive",
    "ordered-float",
    "petgraph",
    "proc-macro-crate",
    "gloo-timers",
    "miniz_oxide",
    "prost-derive",
    "prost",
    "prost-build",
    "prost-types",
    "rustc-hash",
    "sync_wrapper",
    "sysinfo",
    "webpki-roots",
    "webpki-root-certs",

    # wasm-streams version mismatch from transitive deps
    "wasm-streams",

    "discv5",

    # libp2p dependency chain version mismatch
    "unsigned-varint",
    "if-addrs",
    "yamux",

    # spin version mismatch: base-protocol uses 0.9.x, buddy_system_allocator uses 0.10.x
    "spin",

    # backtrace/risc0-zkvm version mismatch: backtrace uses newer addr2line/gimli/object than risc0
    "addr2line",
    "gimli",
    "object",

    # mach2 version mismatch: tracing-samply uses 0.5.0, metrics-process uses 0.6.0
    "mach2",

    # reqwest version mismatch: alloy use 0.12.x, newer deps use 0.13.x
    "reqwest",

    # quick-error version mismatch: proptest -> rusty-fork uses 1.x, other deps use 2.x
    "quick-error",

    # rustls-platform-verifier version mismatch: jsonrpsee uses 0.5.x, reqwest uses 0.6.x
    "rustls-platform-verifier",

    # TLS/HTTP stack version mismatches from aws-sdk deps
    "h2",
    "http",
    "http-body",
    "hyper",
    "hyper-rustls",
    "rustls",
    "rustls-webpki",
    "tokio-rustls",

    # toml/serde stack version mismatches from upstream deps
    "serde_spanned",
    "syn",
    "toml",
    "toml_datetime",
    "toml_edit",

    # etcetera version mismatch: sqlx-mysql uses 0.8.x, testcontainers uses 0.11.x
    "etcetera",

    "half",
    "memoffset",

    # SP1 + risc0/boundless transitive dependency mismatches
    "opentelemetry",
    "opentelemetry-appender-tracing",
    "opentelemetry-otlp",
    "opentelemetry-proto",
    "opentelemetry_sdk",
    "tracing-opentelemetry",
    "strum_macros",
    "wit-bindgen",
    "block-buffer",
    "const-oid",
    "crypto-common",
    "digest",
    "hmac",
    "sha2",

    # risc0/boundless transitive dependency mismatches
    # boundless-market v1.4.0 pulls alloy 1.x alongside our alloy 2.0
    "alloy-consensus",
    "alloy-consensus-any",
    "alloy-contract",
    "alloy-eips",
    "alloy-genesis",
    "alloy-hardforks",
    "alloy-json-rpc",
    "alloy-network",
    "alloy-network-primitives",
    "alloy-provider",
    "alloy-rpc-client",
    "alloy-rpc-types",
    "alloy-rpc-types-anvil",
    "alloy-rpc-types-any",
    "alloy-rpc-types-eth",
    "alloy-serde",
    "alloy-signer",
    "alloy-signer-local",
    "alloy-transport",
    "alloy-transport-http",
    "alloy-tx-macros",
    "cargo-platform",
    "cargo_metadata",
    "cpufeatures",
    "foreign-types",
    "foreign-types-shared",
    "num-bigint",

    "ringbuffer",
    "tracing-subscriber",
    "untrusted",

    "winnow",

    "jni",
    "jni-sys",
    "keccak",
    "md-5",
    "proptest-derive",
    "ruzstd",
    "sha1",
    "sha3",
    "twox-hash",
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"

# Allow git sources from known upstream repositories
allow-git = [
    "https://github.com/paradigmxyz/reth",
    "https://github.com/op-rs/op-reth",
    "https://github.com/ethereum-optimism/optimism",
]