forked from 1b-agent/fieldcraft-upstream
jyvikoandClaude Opus 5.5
3977a0b630
RUSTSEC-2026-0367/0368/0369 are in ZipArchive::extract and ZipStreamReader::extract. Our zip 9 is updated to the fixed 9.0.4. zip 3 comes only through the pinned solidcraft-io, which never calls extract (3MF parts are read by name), so the three are ignored with that reason until SolidCraft moves to a fixed zip. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo
48 lines
1.7 KiB
TOML
48 lines
1.7 KiB
TOML
[advisories]
|
|
unmaintained = "all"
|
|
yanked = "warn"
|
|
# zip 3 comes only through solidcraft-io (pinned rev, still on zip 3; our own zip is 9.0.4,
|
|
# which is fixed). All three are in `ZipArchive::extract` / `ZipStreamReader::extract`, which
|
|
# neither FieldCraft nor solidcraft-io calls: 3MF parts are read by name into memory. Drop these
|
|
# once SolidCraft moves to a fixed zip.
|
|
ignore = [
|
|
{ id = "RUSTSEC-2026-0367", reason = "zip 3 via solidcraft-io; extract() is never called" },
|
|
{ id = "RUSTSEC-2026-0368", reason = "zip 3 via solidcraft-io; extract() is never called" },
|
|
{ id = "RUSTSEC-2026-0369", reason = "zip 3 via solidcraft-io; extract() is never called" },
|
|
]
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
wildcards = "warn"
|
|
allow-wildcard-paths = true
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
# SolidCraft's kernel and its patched truck crates, pinned by rev in Cargo.toml.
|
|
# storytold/craft-libs: the Craft family's shared UI components (craft-ui), pinned by rev.
|
|
allow-git = ["https://github.com/bherbruck/solidcraft", "https://github.com/storytold/craft-libs"]
|
|
|
|
# What FieldCraft may ship: permissive licences only (no copyleft). A crate offering
|
|
# a choice (MIT OR LGPL) passes on its permissive option. THIRD-PARTY-LICENSES.txt is generated at
|
|
# release time (`cargo xtask licences`); this is the policy every pull request is held to.
|
|
[licenses]
|
|
confidence-threshold = 0.9
|
|
allow = [
|
|
"0BSD",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"BSL-1.0",
|
|
"CDLA-Permissive-2.0",
|
|
"ISC",
|
|
"MIT",
|
|
"OFL-1.1",
|
|
"Ubuntu-font-1.0",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
"Zlib",
|
|
]
|