GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — tinydocs/deny.toml at main · tinyhumansai/tinydocs

Expand file tree

/

deny.toml

Copy path
More file actions
More file actions

Latest commit

 

History

History
History
71 lines (66 loc) · 2.58 KB
/

deny.toml

Copy path

File metadata and controls

71 lines (66 loc) · 2.58 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# cargo-deny configuration — run locally with `cargo deny check all`.
# CI runs the same check in the "Supply chain" job of .github/workflows/ci.yml.
[graph]
all-features = true
[advisories]
# Fail on any crate with a security advisory or an unmaintained warning.
# Add an entry here only with a comment explaining the exposure and the plan.
#
# Every entry below is an *unmaintained* notice, not a vulnerability, and every
# one arrives transitively through the two format writers. None is reachable
# from `tinydocs::spec`, so a host that takes this crate with
# `default-features = false` — the wire contract without a codec — pulls none of
# them.
#
# Nothing here silences a vulnerability. RUSTSEC-2026-0187 (stack overflow in
# lopdf via deeply nested PDF objects, a ~21 KB crafted file aborting the
# process with an uncatchable SIGABRT) is *fixed*, not ignored: pdf-extract is
# pinned to 0.12, which resolves lopdf 0.42.0.
ignore = [
# ttf-parser, via pdf-extract -> lopdf. lopdf's font parser, so it is on the
# extraction path rather than an unused corner — but the advisory is the
# author declaring the crate finished, not a defect. No alternative without
# replacing lopdf, which is pdf-extract's core dependency.
#
# Plan: track lopdf. It is actively maintained (0.42.0 shipped the fix for
# RUSTSEC-2026-0187), so a font-parser migration would come from there.
"RUSTSEC-2026-0192",
]
[licenses]
# Licenses accepted for this crate and its dependencies. Keep GPL-3.0-only for
# the template crate itself; the remaining entries cover compatible dependency
# licenses commonly encountered by Rust projects.
allow = [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
# ZIP 9's Rust-native bzip2 implementation uses the upstream bzip2 license.
"bzip2-1.0.6",
# constant_time_eq 0.1.5, via ppt-rs -> zip 0.6.6. A public-domain
# dedication — strictly more permissive than the rest of this list, and it
# imposes no obligation on a GPL-3.0-only crate.
"CC0-1.0",
"GPL-3.0-only",
"ISC",
"MIT-0",
"MIT",
"MPL-2.0",
"Unicode-3.0",
"Zlib",
]
confidence-threshold = 0.9
[bans]
# Duplicate versions bloat build times; review them rather than ignoring them.
multiple-versions = "warn"
wildcards = "deny"
# Crates that must never enter the dependency graph.
deny = []
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
"https://github.com/bokuweb/docx-rs",
"https://github.com/yingkitw/ppt-rs",
]
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.