anvilsign in

collin/anvil

1# Duplicates `clippy::multiple_crate_versions` is allowed to ignore.
2#
3# The lint is on (see `[workspace.lints.clippy]` in Cargo.toml) so that a *new*
4# duplicate has to be argued for. Everything below is a duplicate we cannot
5# remove from here: some other crate in the tree pins the older copy, and the
6# only fix is that crate moving. Each entry says who is holding it, so this
7# list doubles as the "what are we waiting on" record — when a bump makes an
8# entry unnecessary, delete it rather than leaving it to rot.
9#
10# Nothing here is ours to collapse today: `argon2` was, and was taken, which
11# is what removed argon2, blake2 and password-hash from this list.
12
13allowed-duplicate-crates = [
14 # --- The RustCrypto `digest` 0.10 -> 0.11 seam ------------------------
15 # Half the tree has moved to digest 0.11 (aes-gcm, ssh-key, russh, our own
16 # sha2/hmac) and half has not (gix's sha1, `rsa` 0.9 in anvil-web's tests,
17 # argon2 0.5). Every crate below is simply the same crate on both sides of
18 # that line, and they collapse when the stragglers move — mostly gix.
19 "block-buffer",
20 "const-oid",
21 "cpufeatures",
22 "crypto-common",
23 "digest",
24 "generic-array",
25 "sha1",
26 "sha3",
27
28 # --- Held by direct dependencies of ours ------------------------------
29 "base64", # axum 0.8 is on 0.22; we are on 0.23.
30 "tower-http", # reqwest 0.13 uses 0.6 internally; we are on 0.7.
31 "hashlink", # rusqlite 0.40 moved to 0.12; something older wants 0.11.
32
33 # --- Entirely inside other crates' trees ------------------------------
34 "bitflags", # 1.x lingers under a few transitive crates.
35 "foldhash", # gix-pack's clru vs jaq-json.
36 "getrandom", # 0.2/0.3/0.4 across rand, ring and gix.
37 "hashbrown", # three copies, all within gix's own sub-crates.
38 "r-efi", # a getrandom UEFI backend, one per getrandom major.
39 "rand_core", # tracks the getrandom split above.
40 "syn", # proc-macro crates mid-migration from 2.x to 3.x.
41]