8423b7a0f5
- Upgrade printpdf 0.7 → 0.12.5 in job_seekers (fixes lopdf HIGH CVE RUSTSEC-2023-0068)
Rewrote build_resume_pdf() for the new Op-based API; same PDF output
- Add wallet/me/holds and wallet/me/holds/{id}/release routes to profession_shared
Backed by wallet::hold::list_for_user and wallet::hold::release
Applies to all 9 profession services via the shared router
- Add deny.toml for cargo-deny (advisory + ban policy enforcement)
RSA timing CVE and bincode unmaintained acknowledged with documented reasons
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
59 lines
2.5 KiB
TOML
59 lines
2.5 KiB
TOML
# cargo-deny configuration for nxtgauge-backend-rust
|
|
# https://embarkstudios.github.io/cargo-deny/
|
|
#
|
|
# For this private/proprietary workspace we only enforce:
|
|
# - advisories (CVEs / RustSec)
|
|
# - bans (forbidden crates, duplicate versions)
|
|
# License compliance is skipped — our internal crates have no license field.
|
|
|
|
[graph]
|
|
targets = []
|
|
|
|
# ── Advisories (CVEs / RustSec) ──────────────────────────────────────────────
|
|
[advisories]
|
|
version = 2
|
|
db-path = "~/.cargo/advisory-db"
|
|
db-urls = ["https://github.com/rustsec/advisory-db"]
|
|
ignore = [
|
|
# RUSTSEC-2023-0071 - rsa: Marvin Attack timing side-channel — no upstream fix available.
|
|
# Impact: potential RSA key recovery via timing. Low risk: we use RSA only for JWT
|
|
# verification (public-key ops), not for decryption. Acknowledged.
|
|
"RUSTSEC-2023-0071",
|
|
# RUSTSEC-2025-0141 - bincode: unmaintained (not a vulnerability, just no active maintainer).
|
|
# bincode is used transitively; no replacement available in our dep tree.
|
|
"RUSTSEC-2025-0141",
|
|
]
|
|
|
|
# ── Bans (duplicate deps / forbidden crates) ──────────────────────────────────
|
|
[bans]
|
|
# Warn on multiple versions of the same crate.
|
|
multiple-versions = "warn"
|
|
# Crates we never want in the dependency tree.
|
|
deny = [
|
|
# Avoid the old `time` crate (use chrono / time 0.3 instead)
|
|
{ name = "time", version = "=0.1" },
|
|
]
|
|
|
|
# ── Licenses (skipped for private workspace) ──────────────────────────────────
|
|
# We do not enforce license policy here because:
|
|
# - All our own workspace crates are proprietary and unpublished.
|
|
# - Third-party license compliance is managed separately.
|
|
[licenses]
|
|
version = 2
|
|
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "CC0-1.0", "Zlib", "OpenSSL"]
|
|
confidence-threshold = 0.6
|
|
|
|
[[licenses.clarify]]
|
|
name = "ring"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
|
|
|
|
[[licenses.exceptions]]
|
|
allow = ["LicenseRef-Private"]
|
|
crate = "auth"
|
|
|
|
# ── Sources ───────────────────────────────────────────────────────────────────
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|