From 92fb2860ae1b622b463c557880255b592f2cebe4 Mon Sep 17 00:00:00 2001 From: HackingGate Date: Thu, 22 Oct 2026 22:14:02 +0900 Subject: [PATCH] cargo-deny admits the Zlib licence, which foldhash carries under serde_json 1.0.154 serde_json 1.0.154 (#404) depends on foldhash 0.2.0, licensed Zlib, which the allow list did not name. CI does not run cargo-deny, so main stayed green while the pre-push `uphold supply-chain` refused every push from it. Zlib is permissive and OSI approved, with no copyleft and no attribution required in the binary. Claude-Session: https://claude.ai/code/session_01HM96sKSAyDhLk9smu82u5V --- deny.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deny.toml b/deny.toml index a49c4f2..1f65d8f 100644 --- a/deny.toml +++ b/deny.toml @@ -45,6 +45,9 @@ allow = [ "Unicode-3.0", "Unicode-DFS-2016", "Unlicense", + # foldhash, which serde_json depends on. Permissive and OSI + # approved: no attribution in the binary, no copyleft. + "Zlib", ] # A dual-licensed crate is taken under the first of its licences this list # admits, which is how `MIT OR Apache-2.0` resolves without a note per crate.