The `[advisories]` section

Contains all of the configuration for cargo deny check advisories

Default Config Reference

[advisories]
db-urls = ["https://github.com/RustSec/advisory-db"]
db-path = "~/.cargo/advisory-dbs" # Or wherever $CARGO_HOME/advisory-dbs resolves to
yanked = "warn"
unmaintained = "all"
unsound = "workspace"
maximum-db-staleness = "P90D" # Only checked when advisory database fetching has been disabled
unused-ignored-advisory = "warn"

All of the fields below are optional. If the [advisories] section is omitted entirely, the advisory check still runs using the default value documented for each field — for example, the RustSec Advisory DB is fetched and checked by default.

Example Config

[advisories]
db-path = "~/.cargo/advisory-dbs"
db-urls = ["https://github.com/RustSec/advisory-db"]
ignore = [
    "RUSTSEC-0000-0000",
    "crate@0.1",
    { crate = "yanked", reason = "a new version has not been released" },
]
unmaintained = "workspace"
unused-ignored-advisory = "warn"

`db-urls`

URLs to one or more advisory databases.

Default: RustSec Advisory DB

`db-path`

Path to the root directory into which one or more advisory databases are cloned into.

This value supports basic shell expansion:

~ - Expands to home::home_dir
$VARNAME - Expands to std::env::var("VARNAME")
${VARNAME} - Expands to std::env::var("VARNAME")
${VARNAME:-fallback} - Expands to std::env::var("VARNAME") or the fallback value if it doesn't exist (everything between the :- and })
$CARGO_HOME - Expands to std::env::var("CARGO_HOME") if it exists, otherwise expands to $(home::home_dir())/.cargo

Note that the path must be valid utf-8, after expansion.

Default: $CARGO_HOME/advisory-dbs

`version`

version = 2

The version field is (at the time of this writing) no longer used, the following fields have been removed and will now emit errors.

vulnerability - Removed, all vulnerability advisories now emit errors.
unsound - Removed, all unsound advisories now emit errors.
notice - Removed, all notice advisories now emit errors.
severity-threshold - Removed, all vulnerability advisories now emit errors.

As before, if you want to ignore a specific advisory, add it to the ignore field.

`yanked`

Determines what happens when a crate with a version that has been yanked from its source registry is encountered.

deny - Will emit an error with the crate name and version that was yanked, and fail the check.
warn (default) - Prints a warning with the crate name and version that was yanked, but does not fail the check.
allow - Prints a note about the yanked crate, but does not fail the check.

`disable-yank-checking`

Controls whether the local registry indices are checked for yanked crates (see yanked).

false (default) - The local registry indices are checked for yanked crates.
true - Yank checking is disabled; the local registry indices are not checked for yanked crates.

`ignore`

ignore = [
   "RUSTSEC-0000-0000",
   { id = "RUSTSEC-0000-0000", reason = "this vulnerability does not affect us as we don't use the particular code path" },
   "yanked@0.1.1",
   { crate = "yanked-crate@0.1.1", reason = "a semver compatible version hasn't been published yet" },
]

Every advisory in the advisory database contains a unique identifier, eg. RUSTSEC-2019-0001. Putting an identifier in this array will cause the advisory to be treated as a note, rather than a warning or error.

In addition, yanked crate versions can be ignored by specifying a PackageSpec with an optional reason.

Default: empty (no advisories or yanked crates are ignored).

`expiry`

ignore = [
   { id = "RUSTSEC-0000-0000", expiry = "P30D" },
]

Allows an advisory to be ignored until the specified duration has elapsed since the the advisory was published. If there is no expiry for the individual ignore then ignore-expiry is used if it is present.

`allow`

ignore = [
   { id = "RUSTSEC-0000-0000", allow = ['some-crate@0.1.0'] },
]

A list of PackageSpecs of the crates that are allowed to directly depend on the crate(s) that the advisory applies to. This allows an advisory to be ignored, but not allow new crates/updates to add more dependencies on the crate(s) with the advisory.

`ignore-expiry`

ignore-expiry = "P90D"

The default duration used if an expiry is not present for a specific advisory.

`unmaintained`

unmaintained = 'workspace'

Determines if unmaintained advisories will result in an error. An unmaintained error can still be ignored specifically via the ignore option.

all (default) - Any crate that matches an unmaintained advisory will fail
workspace - Unmaintained advisories will only fail if they apply to a crate which is a direct dependency of one or more workspace crates.
transitive - Unmaintained advisories will only fail if they apply to a crate which is not a direct dependency of one or more workspace crates.
none - Unmaintained advisories are completely ignored.

`unsound`

unsound = 'workspace'

Determines if unsound advisories will result in an error. An unsound error can still be ignored specifically via the ignore option.

all - Any crate that matches an unsound advisory will fail
workspace (default) - Unsound advisories will only fail if they apply to a crate which is a direct dependency of one or more workspace crates.
transitive - Unsound advisories will only fail if they apply to a crate which is not a direct dependency of one or more workspace crates.
none - Unsound advisories are completely ignored.

`git-fetch-with-cli`

Deprecated. cargo-deny now fetches with git cli unconditionally, using this will issue a deprecation warning and have no effect.

`maximum-db-staleness`

The maximum duration that can pass before the database is considered stale and an error is emitted. This is only checked when advisory database fetching has been disabled via the --offline or check --disable-fetch flags, as otherwise the database is always cloned or fetched to be up to date with the remote git repository.

The default if not specified is the same value that cargo-audit uses, and cargo-deny has been using, which is P90D, or 90 days.

`unused-ignored-advisory`

Determines what happens when one of the advisories that appears in the ignore list is not encountered in the dependency graph.

warn (default) - A warning is emitted for each advisory that appears in advisories.ignore but which is not used in any crate.
allow - Unused advisories in the advisories.ignore list are ignored.
deny - An unused advisory in the advisories.ignore list triggers an error, and cause the advisory check to fail.

Durations

We use the RFC3339 duration format as it is somewhat standard...though not well documented. The official grammar is as follows:

   dur-second        = 1*DIGIT "S"
   dur-minute        = 1*DIGIT "M" [dur-second]
   dur-hour          = 1*DIGIT "H" [dur-minute]
   dur-time          = "T" (dur-hour / dur-minute / dur-second)
   dur-day           = 1*DIGIT "D"
   dur-week          = 1*DIGIT "W"
   dur-month         = 1*DIGIT "M" [dur-day]
   dur-year          = 1*DIGIT "Y" [dur-month]
   dur-date          = (dur-day / dur-month / dur-year) [dur-time]

   duration          = "P" (dur-date / dur-time / dur-week)

However, as far as I can tell, there are no official spec compliance tests one can run for the duration formation, and several parsers I found written in other languages seemed to...not actually properly follow the grammar, so the implementation in cargo-deny may be wrong according to the spec, but at least it will be consistently wrong.

Note that while the spec supports , as a decimal separator, for simplicity cargo-deny only supports . as a decimal separator.

One final note, there are 2 units available in the format that are not exact, namely, year 'Y' and month 'M'. It's not recommended to use either of them for that reason, but if you do they are calculated as follows.

1 year = 365 days
1 month = 30.43 days