matrix-rust-sdk

# https://embarkstudios.github.io/cargo-deny/checks/cfg.html

[graph]

all-features = true

exclude = [

    # dev only dependency

    "criterion"

]

[advisories]

version = 2

ignore = [

    { id = "RUSTSEC-2024-0388", reason = "Unmaintained derivative crate, not a direct dependency" },

]

[licenses]

version = 2

allow = [

    "Apache-2.0",

    "Apache-2.0 WITH LLVM-exception",

    "CDLA-Permissive-2.0",

    "BSD-2-Clause",

    "BSD-3-Clause",

    "BSL-1.0",

    "ISC",

    "MIT",

    "MPL-2.0",

    "Unicode-3.0",

    "Zlib",

]

[bans]

# We should disallow this, but it's currently a PITA.

multiple-versions = "allow"

wildcards = "allow"

[sources]

unknown-registry = "deny"

unknown-git = "deny"

allow-git = [

    # A patch override for the bindings fixing a bug for Android before upstream

    # releases a new version.

    "https://github.com/tokio-rs/tracing.git",

    # Well, it's Ruma.

    "https://github.com/ruma/ruma",

    # A patch override for the bindings: https://github.com/rodrimati1992/const_panic/pull/10

    "https://github.com/jplatte/const_panic",

    # A patch override for the bindings: https://github.com/smol-rs/async-compat/pull/22

    "https://github.com/element-hq/async-compat",

    # We can release vodozemac whenever we need but let's not block development

    # on releases.

    "https://github.com/matrix-org/vodozemac",

]