deny.toml

[licenses]
allow = [
  "0BSD",
  "Apache-2.0",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "BSL-1.0",
  "CC0-1.0",
  "ISC",
  "MIT",
  "OpenSSL",
  "Unicode-3.0",
  "Unicode-DFS-2016",
  "Zlib"
]

private = { ignore = true }

exceptions = [
    # MPL-2.0 are added case-by-case to make sure we are in compliance. To be in
    # compliance we cannot be modifying the source files.
    { allow = ["MPL-2.0"], name = "colored", version = "*" },
    { allow = ["MPL-2.0"], name = "webpki-roots", version = "*" },
    { allow = ["MPL-2.0"], name = "vector-config-common", version = "*" },
    { allow = ["MPL-2.0"], name = "vector-config-macros", version = "*" },
    { allow = ["MPL-2.0"], name = "vrl", version = "*" },
]

[[licenses.clarify]]
name = "ring"
version = "*"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

[advisories]
ignore = [
    # Vulnerability in `rsa` crate: https://rustsec.org/advisories/RUSTSEC-2023-0071.html
    # There is not fix available yet.
    # https://github.com/vectordotdev/vector/issues/19262
    "RUSTSEC-2023-0071",

    # Vulnerability in `tonic` crate: https://rustsec.org/advisories/RUSTSEC-2024-0376
    # There is a fixed version (v0.12.3) but we are blocked from upgrading to `http` v1, which
    # `tonic` v0.12 depends on. See https://github.com/vectordotdev/vector/issues/19179
    "RUSTSEC-2024-0376",

    # Advisory in rustls crate: https://rustsec.org/advisories/RUSTSEC-2024-0336 If a `close_notify`
    # alert is received during a handshake, `complete_io` does not terminate.
    # Vulnerable version only used in dev-dependencies
    "RUSTSEC-2024-0336",

    # unmaintained dependencies
    "RUSTSEC-2021-0139", # ansi_term
    "RUSTSEC-2024-0388", # derivative
    "RUSTSEC-2024-0384", # instant`
    "RUSTSEC-2020-0168", # mach
    "RUSTSEC-2024-0370", # proc-macro-error
    "RUSTSEC-2024-0320", # yaml-rust
]