lancedb/deny.toml

# cargo-deny configuration for LanceDB.
#
# Run locally with `cargo deny check`. See
# https://embarkstudios.github.io/cargo-deny/ for the full reference.

# The set of target triples we care about. cargo-deny will only consider
# dependencies that are used on at least one of these targets. Keeping this
# explicit avoids noise from platform-specific crates (e.g. wasm, android,
# ios) that we never actually ship.
[graph]
targets = [
    "x86_64-unknown-linux-gnu",
    "aarch64-unknown-linux-gnu",
    "x86_64-apple-darwin",
    "aarch64-apple-darwin",
    "x86_64-pc-windows-msvc",
    "aarch64-pc-windows-msvc",
]
all-features = true

[output]
feature-depth = 1

# ---------------------------------------------------------------------------
# Advisories: security vulnerabilities and yanked crates.
# ---------------------------------------------------------------------------
[advisories]
version = 2
# Fail the check if any crate in the lockfile has been yanked from crates.io.
# Yanked crates are a signal the author retracted the release (often due to
# bugs or security issues) and should not be depended on.
yanked = "deny"
# Advisory IDs we have explicitly reviewed and chosen to accept. Every
# entry must include a rationale and, where possible, an upstream issue
# pointing to a fix. Revisit this list whenever dependencies are updated.
ignore = [
    # rsa: Marvin Attack timing side-channel in PKCS#1 v1.5 decryption.
    # Reached only through opendal → reqsign → rsa. We do not use RSA
    # decryption in LanceDB ourselves; this is dormant in the signing path.
    # No fixed release exists upstream as of this writing.
    # https://rustsec.org/advisories/RUSTSEC-2023-0071
    { id = "RUSTSEC-2023-0071", reason = "rsa crate via opendal/reqsign; no fixed upstream release" },

    # instant: unmaintained. Pulled in via backoff → instant. Upstream
    # recommends switching to `web-time`; fix has to come from backoff.
    # https://rustsec.org/advisories/RUSTSEC-2024-0384
    { id = "RUSTSEC-2024-0384", reason = "transitive via backoff; waiting on backoff replacement" },

    # paste: unmaintained (author archived the repo). Used transitively by
    # datafusion and the arrow ecosystem; widespread, no drop-in replacement.
    # https://rustsec.org/advisories/RUSTSEC-2024-0436
    { id = "RUSTSEC-2024-0436", reason = "transitive via datafusion; awaiting ecosystem migration" },

    # tantivy: segfault on malformed input due to missing bounds check.
    # Pulled in via lance for full-text search. We only feed tantivy
    # documents we construct ourselves, not attacker-controlled bytes.
    # Tracked for a lance dependency bump.
    # https://rustsec.org/advisories/RUSTSEC-2025-0003
    { id = "RUSTSEC-2025-0003", reason = "tantivy via lance; inputs are internally produced, not user-supplied bytes" },

    # backoff: unmaintained. Reached only via async-openai. Replacement
    # requires async-openai to migrate (or us to drop async-openai).
    # https://rustsec.org/advisories/RUSTSEC-2025-0012
    { id = "RUSTSEC-2025-0012", reason = "transitive via async-openai; waiting on upstream migration" },

    # number_prefix: unmaintained. Transitive via indicatif → hf-hub.
    # No security impact, just maintenance status.
    # https://rustsec.org/advisories/RUSTSEC-2025-0119
    { id = "RUSTSEC-2025-0119", reason = "transitive via hf-hub/indicatif; cosmetic formatting crate" },

    # unsafe-libyaml: unmaintained. Transitive via lance-tokenizer → lindera
    # → serde_yaml_ng. No maintained upgrade exists; clearing it requires
    # lindera to move off serde_yaml_ng.
    # https://rustsec.org/advisories/RUSTSEC-2024-0449
    { id = "RUSTSEC-2024-0449", reason = "transitive via lindera (lance-tokenizer); no maintained upgrade available" },

    # pyo3 advisories in the Python bindings; tracked pending a patched pyo3 release.
    # https://rustsec.org/advisories/RUSTSEC-2026-0176
    # https://rustsec.org/advisories/RUSTSEC-2026-0177
    { id = "RUSTSEC-2026-0176", reason = "pyo3 in Python bindings; awaiting patched pyo3 release" },
    { id = "RUSTSEC-2026-0177", reason = "pyo3 in Python bindings; awaiting patched pyo3 release" },

    # zip < 9.0.0: SUID/SGID bits, symlink targets and permissions applied through
    # symlinks during archive extraction. Transitive via candle-core (optional
    # local-embedding feature); every published candle release pins zip < 9
    # (0.9.x/0.10.x ^7.2, 0.11.0 ^8.6), so no dependency bump clears it.
    # LanceDB never extracts archives; the zip crate is only linked.
    # https://rustsec.org/advisories/RUSTSEC-2026-0367
    # https://rustsec.org/advisories/RUSTSEC-2026-0368
    # https://rustsec.org/advisories/RUSTSEC-2026-0369
    { id = "RUSTSEC-2026-0367", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" },
    { id = "RUSTSEC-2026-0368", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" },
    { id = "RUSTSEC-2026-0369", reason = "zip via candle-core; candle pins zip < 9 and lancedb never extracts archives" },

    # quick-xml < 0.41.0: quadratic runtime on duplicate attribute names (DoS).
    # quick-xml < 0.41.0: unbounded namespace-declaration allocation in NsReader (DoS).
    # Pulled in transitively by inferno (dev-only flame-graph dep), lance-namespace-impls
    # (git dep from lance), and opendal/reqsign (cloud storage XML parsing). The XML
    # parsed by opendal/reqsign comes from trusted cloud-storage endpoints (S3, GCS,
    # Azure), not attacker-controlled input. Clearing requires upstream crates to migrate
    # to quick-xml >= 0.41.0.
    # https://rustsec.org/advisories/RUSTSEC-2026-0194
    # https://rustsec.org/advisories/RUSTSEC-2026-0195
    { id = "RUSTSEC-2026-0194", reason = "transitive via inferno/lance/opendal; XML from trusted cloud endpoints, not attacker-controlled" },
    { id = "RUSTSEC-2026-0195", reason = "transitive via inferno/lance/opendal; XML from trusted cloud endpoints, not attacker-controlled" },
    # smartstring: unmaintained — the repository was archived by its author on
    # 2026-05-03. Not a vulnerability. Reached only transitively through polars
    # (polars-core/-io/-ops/-time/-utils); nothing in LanceDB depends on it directly.
    # The advisory states no safe upgrade is available: upstream recommends
    # compact_str/smol_str, so clearing this requires polars to migrate.
    # https://rustsec.org/advisories/RUSTSEC-2026-0249
    { id = "RUSTSEC-2026-0249", reason = "smartstring unmaintained via polars; no fixed upstream release" },
    # crypto-bigint < 0.7.6: timing side-channels in constant-time ops,
    # incl. subtraction, zero counting, division and Montgomery multiplication.
    # Reached only through aws-sdk-s3 sigv4a -> aws-sigv4 (p256/ecdsa); signed
    # requests carry the SigV4a credential-derived key. The patched 0.7.6 was
    # published 2026-10-23, but no published aws-sigv4 release uses it yet
    # (latest 1.6.3 pins crypto-bigint ^0.5), so clearing requires smithy-rs to
    # ship an updated aws-sigv4.
    # https://rustsec.org/advisories/RUSTSEC-2026-0387
    { id = "RUSTSEC-2026-0387", reason = "crypto-bigint via aws-sigv4 (sigv4a); no fixed upstream aws-sigv4 release yet" },
]


# ---------------------------------------------------------------------------
# Licenses: only allow licenses we've reviewed as compatible with Apache-2.0.
# ---------------------------------------------------------------------------
[licenses]
version = 2
# SPDX identifiers for licenses that are compatible with our Apache-2.0
# distribution. Additions require legal review.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",
    "BSL-1.0",
    # 0BSD ("BSD Zero Clause") is effectively public domain — no attribution
    # required. Pulled in by `mock_instant`.
    "0BSD",
    # CDLA-Permissive-2.0 is a permissive data license used by `webpki-roots`
    # for the Mozilla CA root bundle. Data-only, distribution-compatible.
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8
# Per-crate license exceptions: allow a license for a specific crate only,
# rather than globally via the `allow` list above.
exceptions = []
# Crates whose license cannot be determined from Cargo metadata but whose
# license we've manually confirmed from upstream. Keep this list minimal.
[[licenses.clarify]]
# polars-arrow-format omits the `license` field in its Cargo.toml, but the
# upstream repo (pola-rs/polars-arrow-format) is dual-licensed Apache-2.0 OR
# MIT. See https://github.com/pola-rs/polars-arrow-format/blob/main/LICENSE
crate = "polars-arrow-format"
expression = "Apache-2.0 OR MIT"
license-files = []

# ---------------------------------------------------------------------------
# Bans: disallow specific crates and flag dependency hygiene issues.
# ---------------------------------------------------------------------------
[bans]
# Warn (not deny) on duplicate versions of the same crate. In a large
# workspace like this one, duplicates are common and often unavoidable
# transitively. We surface them to discourage growth, but don't fail CI.
multiple-versions = "warn"
# Wildcard version requirements (`foo = "*"`) are a footgun — they let any
# future release in without review. Ban them outright.
wildcards = "deny"
# Lint every dependency declared by a workspace member against the shared
# `[workspace.dependencies]` table: any crate used by more than one member must
# go through `workspace = true`, and entries nothing uses are an error. This
# keeps versions from drifting between the core crate and the bindings.
# Python bundles a patched path crate while the Rust SDK uses the overridable
# upstream source. Check shared external declarations, not these path bindings.
workspace-dependencies = { duplicates = "deny", unused = "deny", include-path-dependencies = false }
# Internal workspace crates reference each other via `path = "..."`, which
# cargo-deny sees as a wildcard version. That's fine for private workspace
# members (not published to crates.io), so allow it specifically for paths.
allow-wildcard-paths = true
# Features that, if enabled, should cause the check to fail.
deny = []
# Crates to skip when checking for duplicate versions.
skip = []
# Similar to `skip`, but also skips the entire transitive subtree.
skip-tree = []

# ---------------------------------------------------------------------------
# Sources: restrict where crates can come from.
# ---------------------------------------------------------------------------
[sources]
# Deny any registry other than the ones explicitly listed below.
unknown-registry = "deny"
# Deny any git dependency whose host isn't in the allow-list below. This
# prevents accidental pulls from arbitrary forks.
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# Lance is developed in a sibling repo and pulled as a git dependency until
# releases are cut to crates.io. Allow that specific host.
allow-git = [
    "https://github.com/lance-format/lance",
    # Pinned by Lance for the multipart write mode API (see [patch.crates-io] in Cargo.toml).
    "https://github.com/apache/arrow-rs-object-store",
]