[licenses]
clarify = [
  { name = "near-chain", expression = "MIT OR Apache-2.0", license-files = [
  ] },
]
allow = [
  "Apache-2.0",
  "MIT",
  "BSD-3-Clause",
  "BSD-2-Clause",
  "MPL-2.0",
  "Zlib",
  "Apache-2.0 WITH LLVM-exception",
  "ISC",
  "Unicode-3.0",
  "CC0-1.0",
  "CDLA-Permissive-2.0",
  "CDDL-1.0",
]

[advisories]
ignore = [
  "RUSTSEC-2022-0054", # wee_alloc is unmaintained
  "RUSTSEC-2024-0370", # proc-macro-error is unmaintained
  "RUSTSEC-2026-0173", # proc-macro-error2 is unmaintained
  "RUSTSEC-2024-0436", # paste is unmaintained
  "RUSTSEC-2024-0384", # instant is unmaintained
  "RUSTSEC-2023-0089", # atomic-polyfill is unmaintained
  # TODO(#3732): remove once quick-xml dependency is >= 0.41.0
  "RUSTSEC-2026-0194", # quadratic attribute duplicate-check
  "RUSTSEC-2026-0195", # unbounded namespace-declaration allocation
  # Remove once near-sdk and nearcore depend on wasmtime >= 46.0.2; the 45.x line
  # has no patched release. Only reachable through near-vm-runner, which never
  # shares a Store across Engines.
  "RUSTSEC-2026-0222", # wasmtime stores can mix up type indices between engines
]

[bans]
multiple-versions = "allow"
skip = [{ name = "windows-sys" }]
skip-tree = [
  { name = "axum" },
  { name = "dstack-sdk" },
  { name = "near-jsonrpc-client" },
  { name = "near-vm-runner" },
  { name = "pprof" },
  { name = "reqwest" },
  { name = "lru" },                 # TODO(#1730): Remove once nearcore updates to a fixed version
]

[sources]
unknown-git = "deny"
allow-git = [
  "https://github.com/near/nearcore",
]