content: # https://embarkstudios.github.io/cargo-deny/checks/cfg.html
  [graph]
  all-features = true
  exclude = [
      # dev only dependency
      "criterion"
  ]
  
  [advisories]
  version = 2
  ignore = [
      { id = "RUSTSEC-2024-0436", reason = "Unmaintained paste crate, not critical." },
      { id = "RUSTSEC-2025-0056", reason = "Unmaintained adler crate, not a direct dependency" },
      { id = "RUSTSEC-2024-0388", reason = "Unmaintained derivative crate, not a direct dependency" },
  ]
  
  [licenses]
  version = 2
  allow = [
      "Apache-2.0",
      "Apache-2.0 WITH LLVM-exception",
      "CDLA-Permissive-2.0",
      "BSD-2-Clause",
      "BSD-3-Clause",
      "BSL-1.0",
      "ISC",
      "MIT",
      "MPL-2.0",
      "Unicode-3.0",
      "Zlib",
  ]
  exceptions = [
      { allow = ["Unicode-DFS-2016"], crate = "unicode-ident" },
  ]
  
  [bans]
  # We should disallow this, but it's currently a PITA.
  multiple-versions = "allow"
  wildcards = "allow"
  
  [sources]
  unknown-registry = "deny"
  unknown-git = "deny"
  
  allow-git = [
      # A patch override for the bindings fixing a bug for Android before upstream
      # releases a new version.
      "https://github.com/tokio-rs/tracing.git",
      # Well, it's Ruma.
      "https://github.com/ruma/ruma",
      # A patch override for the bindings: https://github.com/rodrimati1992/const_panic/pull/10
      "https://github.com/jplatte/const_panic",
      # A patch override for the bindings: https://github.com/smol-rs/async-compat/pull/22
      "https://github.com/element-hq/async-compat",
      # We can release vodozemac whenever we need but let's not block development
      # on releases.
      "https://github.com/matrix-org/vodozemac",
      # A patch override for the bindings: https://github.com/Alorel/rust-indexed-db/pull/72
      "https://github.com/matrix-org/rust-indexed-db",
  ]
  