1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
[advisories]
db-path = "~/.cargo/advisory-db"
db-url = "https://github.com/rustsec/advisory-db"
vulnerability = "deny"
unmaintained = "warn"
notice = "warn"
ignore = [
# ignore because mio/miow still depend on net2, next mio release fixes this
"RUSTSEC-2020-0016",
# ignore because rusoto_credentials still depends on dirs instead of dirs-next
# https://github.com/rusoto/rusoto/pull/1846
"RUSTSEC-2020-0053",
]
[licenses]
unlicensed = "deny"
allow = [
"Apache-2.0",
]
deny = [
"GPL-1.0",
"GPL-2.0",
"GPL-3.0",
"AGPL-1.0",
"AGPL-3.0",
]
copyleft = "allow"
allow-osi-fsf-free = "either"
confidence-threshold = 0.8
[bans]
multiple-versions = "deny"
highlight = "all"
wildcards = "allow"
# ignore duplicated deps because of dav1d-sys via metadeps depending on old
# error-chain and toml
# https://github.com/rust-av/dav1d-rs/issues/26
# https://github.com/joshtriplett/metadeps/pull/12
# https://github.com/joshtriplett/metadeps/pull/4
[[bans.skip]]
name = "error-chain"
version = "0.10"
[[bans.skip]]
name = "toml"
version = "0.2"
# ignore duplicated deps because of mio-named-pipes via mio depending on old
# miow
# https://github.com/alexcrichton/mio-named-pipes/issues/7
[[bans.skip]]
name = "miow"
version = "0.2"
[[bans.skip]]
name = "winapi"
version = "0.2"
# ignore duplicated deps because of rav1e depending on an old version of paste
# https://github.com/xiph/rav1e/pull/2489
[[bans.skip]]
name = "paste"
version = "0.1"
# ignore duplicated deps because of chrono, cookie, cookie_store, hyper,
# hyperx, reqwest depending on old time
# https://github.com/chronotope/chrono/issues/400
# https://github.com/pfernie/cookie_store/issues/11
# https://github.com/hyperium/hyper/pull/2139
# https://github.com/dekellum/hyperx/issues/21
# https://github.com/seanmonstar/reqwest/issues/934
[[bans.skip]]
name = "time"
version = "0.1"
# ignore duplicated tokio dep because of gst-plugin-threadshare having its own
# fork
# https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/118
[[bans.skip]]
name = "tokio"
version = "0.2.13"
[[bans.skip]]
name = "tokio-macros"
# ignore duplicated textwrap dependency because clap depends on an old version
# https://github.com/clap-rs/clap/pull/1994
[[bans.skip]]
name = "textwrap"
version = "0.11"
# ignore duplicated miniz_oxide dependency because png/tiff depend on an old version
# https://github.com/image-rs/image-tiff/pull/76
# https://github.com/image-rs/image-png/pull/235
[[bans.skip]]
name = "miniz_oxide"
version = "0.3"
# ignore duplicated wasi dependency because rand/getrandom depend on an old version
[[bans.skip]]
name = "wasi"
version = "0.9"
# ignore duplicated base64 dependency because reqwest/tungstenite/rusoto/rust-argon2 depend on an old version
# https://github.com/seanmonstar/reqwest/pull/1050
# https://github.com/rusoto/rusoto/pull/1837
# https://github.com/snapview/tungstenite-rs/pull/149
# https://github.com/sru-systems/rust-argon2/pull/39
[[bans.skip]]
name = "base64"
version = "0.12"
# ignore duplicated cfg-if dependency because a few dozen dependencies still
# pull in the old version
[[bans.skip]]
name = "cfg-if"
version = "0.1"
# ignore duplicated pin-project dependency because a futures, hyper and rusoto
# still depend on the old version
# https://github.com/rust-lang/futures-rs/commit/8a65340675fdf0ba16997cf507ee6bb27d1dcd15
# https://github.com/hyperium/hyper/commit/02732bef0c1accb441b9b14c07cb2c494234a682
# https://github.com/rusoto/rusoto/pull/1847
[[bans.skip]]
name = "pin-project"
version = "0.4"
[[bans.skip]]
name = "pin-project-internal"
version = "0.4"
# ignore duplicated crossbeam-utils dependency because rust-argon2 depend on an old version
# https://github.com/sru-systems/rust-argon2/pull/39
[[bans.skip]]
name = "crossbeam-utils"
version = "0.7"
# ignore duplicated tinyvec dependency because lewton depends on an old version
# https://github.com/RustAudio/lewton/commit/b8d72804db89db358b99784e1ad9d7a22534743c
[[bans.skip]]
name = "tinyvec"
version = "0.3"
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-git = [
"https://gitlab.freedesktop.org/gstreamer/gstreamer-rs",
"https://github.com/gtk-rs/gtk-rs",
"https://github.com/fengalin/tokio",
"https://github.com/rust-av/flavors",
]
|