Cargo.toml

[workspace.package]
edition = "2024"
license = "Apache-2.0 or MIT"
repository = "https://github.com/edge-toolkit/core"
rust-version = "1.91.1"

[workspace]
members = [
  "libs/edge-toolkit",
  "libs/et-otlp",
  "libs/path",
  "libs/test-helpers",
  "libs/test-otlp",
  "libs/wasi-guest",
  "libs/web",
  "libs/ws-runner-common",
  "services/ws-modules/audio1",
  "services/ws-modules/bluetooth",
  "services/ws-modules/comm1",
  "services/ws-modules/data1",
  "services/ws-modules/except1",
  "services/ws-modules/face-detection",
  "services/ws-modules/geolocation",
  "services/ws-modules/graphics-info",
  "services/ws-modules/har1",
  "services/ws-modules/llm1",
  "services/ws-modules/math1",
  "services/ws-modules/math1-sender",
  "services/ws-modules/nfc",
  "services/ws-modules/pic-viewer",
  "services/ws-modules/sensor1",
  "services/ws-modules/speech-recognition",
  "services/ws-modules/video1",
  "services/ws-modules/wasi-comm1",
  "services/ws-modules/wasi-data1",
  "services/ws-modules/wasi-math1",
  "services/ws-modules/wasi-math1-sender",
  "services/modules",
  "services/storage",
  "services/websockify",
  "services/ws",
  "services/ws-pyo3-runner",
  "services/ws-server",
  "services/ws-wasm-agent",
  "services/ws-wasi-runner",
  "services/ws-web-runner",
  "services/ws-test-server",
  "utilities/int-gen",
  "utilities/cli",
  "utilities/onnx",
  "utilities/repo-check",
  "utilities/wasm-cov-wrapper",
  "generated/rust-rest",
]
resolver = "2"

[workspace.dependencies]
actix = "0.13"
actix-files = "0.7"
actix-rt = "2"
actix-web = { version = "4", features = ["rustls-0_23"] }
actix-web-thiserror = "0.2"
actix-ws = "0.4"
# Only ever named in an `error.rs` `#[from]` variant, which a repo-wide rule enforces.
# Present because wit-parser and the wasmtime bindgen return `anyhow::Result`, and `?` cannot convert one
# without a `From<anyhow::Error>` impl, which has to name the type.
anyhow = "1"
async-trait = "0.1"
asyncapi-rust = "0.5"
backon = { version = "1.6", default-features = false }
base64 = "0.23"
bytemuck = { version = "1.16", features = ["derive"] }
bytes = "1"
bytesize = { version = "2", features = ["serde"] }
cc = "1"
chrono = { version = "0.4", features = ["serde"] }
clap = { version = "4.4", features = ["derive"] }
clap-markdown = "0.1"
command-error = "0.8"
const-hex = "1.19"
deno_core = "0.407"
deno_error = "=0.7.1"
deno_resolver = "0.85"
# `transpile` enables on-the-fly TS transpilation (deno_node ships its own TS).
# `hmr` makes `op_snapshot_options` use `state.try_take(...).unwrap_or_default()`
# instead of panicking when no SnapshotOptions struct is in OpState -- without
# baking our own startup snapshot we'd otherwise hit the panic on first run.
deno_runtime = { version = "0.262", features = ["transpile", "hmr"] }
edge-toolkit = { path = "libs/edge-toolkit", version = "0.2.0" }
et-modules-service = { path = "services/modules", version = "0.1.0" }
et-otlp = { path = "libs/et-otlp", version = "0.1.0" }
et-path = { path = "libs/path", version = "0.1.0" }
et-rest-client = { path = "generated/rust-rest", version = "0.1.0", default-features = false }
et-storage-service = { path = "services/storage", version = "0.1.0" }
et-test-helpers = { path = "libs/test-helpers", version = "0.1.0" }
et-test-otlp = { path = "libs/test-otlp", version = "0.1.0" }
et-wasi-guest = { path = "libs/wasi-guest", version = "0.1.0" }
et-web = { path = "libs/web", version = "0.1.0" }
et-websockify-service = { path = "services/websockify", version = "0.1.0" }
et-ws-runner-common = { path = "libs/ws-runner-common", version = "0.1.0" }
et-ws-server = { path = "services/ws-server", version = "0.1.0" }
et-ws-service = { path = "services/ws", version = "0.1.0" }
et-ws-test-server = { path = "services/ws-test-server", version = "0.1.0" }
et-ws-wasm-agent = { path = "services/ws-wasm-agent", version = "0.1.0" }
fake = "5"
fs-err = "3"
futures-core = "0.3"
futures-util = "0.3"
heck = "0.5"
hostname = "0.4"
humantime-serde = "1"
# Already a workspace dependency via deno_image/ws-web-runner, so this adds no new crate or license to review.
# Explicit format features only (no avif/dds/exr/hdr/ico/pnm/qoi/tga/tiff): et-storage-service only decodes
# the extensions is_image_filename() recognises.
image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg", "png", "webp"] }
js-sys = "0.3"
# Pinned to the earliest API version the crate offers.
# The generated manifests use only long-stable objects (Namespace, ConfigMap, PersistentVolumeClaim, Deployment,
# Service), so generating against the oldest supported version keeps them applicable to the widest range of k3s
# releases without giving anything up.
k8s-openapi = { version = "0.28", features = ["v1_32"] }
kdl = { version = "6", features = ["v1"] }
libc = "0.2"
local-ip-address = "0.6"
log = "0.4"
# minicov's profiler runtime must match the LLVM of the toolchain that instruments the guests.
# Held at exactly 0.3.8 (profraw format 10, LLVM 22) because wasm-bindgen-test 0.3.78 -- the only release that
# pairs with wasm-bindgen 0.2.128 -- pins `minicov = "=0.3.8"` under its coverage cfg (wasm-bindgen PR 5283),
# and cargo unifies every 0.3.x onto one copy. As a caret range the resolver satisfied that pin the other way
# round: it kept 0.3.9 for us and dropped wasm-bindgen-test to 0.3.45, whose test exports the 0.2.128 runner
# cannot see, so every browser coverage build reported `no tests to run!` and then failed on its missing
# `*.profraw` (`No such file or directory`). Seen on commit
# https://github.com/edge-toolkit/core/commit/e8a38b44eba21f46001ec01cd1ddccdd3eeca4ea at
# https://github.com/edge-toolkit/core/actions/runs/35032214650/job/104593077391.
#
# `vars.rust_nightly` has to carry the LLVM this minicov targets. 0.3.9 moved to profraw format 11 ("Sync with
# LLVM 23.1.0-rc3"), and pairing either release with the other's LLVM makes capture_coverage walk value-profile
# records with the wrong layout, trapping inside every instrumented WASI guest with
# `memory fault at wasm address 0xecec7ccd` / `wasm trap: out of bounds memory access` from
# `initializeValueProfRuntimeRecord`. Bump both together, never one alone; the `=` lifts once wasm-bindgen-test
# accepts a newer minicov.
minicov = "=0.3.8"
# Third-party OTLP mock collector, wrapped by et-test-otlp for the workspace's integration tests.
# Serves the spec paths (/v1/traces, ...), so a consumer points `collector_url` at the mock's own `/v1` base
# for `et-otlp`'s `{collector_url}/traces` shape to land on them.
mock-collector = "0.2"
onnx-extractor = "0.5"
# Storage backend abstraction: local disk by default, any object_store backend via a URL.
# `aws` pulls the S3 client (which also covers S3-compatible servers such as the rustfs mise tool the backend
# test runs against). Only `aws` is enabled -- adding `gcp`/`azure`/`http` is a one-word change if a consumer
# ever needs them, and each drags its own SDK surface, so they stay off until asked for.
object_store = { version = "0.14", default-features = false, features = ["aws", "fs"] }
openapiv3 = "2"
opentelemetry = "0.32"
opentelemetry-appender-tracing = "0.32"
opentelemetry-http = "0.32"
opentelemetry-otlp = { version = "0.32", default-features = false, features = [
  "http-json",
  "http-proto",
  "logs",
  "metrics",
  "reqwest-blocking-client",
  "trace",
] }
opentelemetry-proto = { version = "0.32", default-features = false, features = [
  "gen-tonic-messages",
  "logs",
  "metrics",
  "trace",
  "with-serde",
] }
opentelemetry_sdk = "0.32"
ort = { version = "=2.0.0-rc.10", default-features = false, features = ["copy-dylibs"] }
pollster = "1.0"
port_check = "0.3"
pretty_yaml = "0.6"
prettyplease = "0.3"
progenitor = "0.15"
progenitor-client = "0.15"
prost = "0.14"
# `auto-initialize` starts the embedded CPython interpreter on first use.
# The pyo3 runner never calls `Py_Initialize` itself.
pyo3 = { version = "0.29", features = ["auto-initialize"] }
# Build-script half of pyo3. Kept on the same release so both resolve the interpreter identically.
pyo3-build-config = "0.29"
qr2term = "0.3"
quote = "1"
# Kept in lockstep with whichever rand major `fake` builds against.
# The generated deployments seed a fake-driven RNG, so the two crates have to agree on the `Rng` trait.
rand = "0.10"
# Reproducibility is the whole point of this dependency, not randomness quality.
# ChaCha is the one rand generator whose output is guaranteed stable across releases for a given seed, so a
# regenerated deployment keeps the credentials it had. `rand`'s own SmallRng/StdRng explicitly do not promise
# that, and StepRng (the obvious "just count up" answer) is deprecated without replacement in rand 0.9.
rand_chacha = "0.10"
rcgen = "0.14"
regex = { version = "1.12", default-features = false }
reqwest = { version = "0.13", default-features = false }
retry = { version = "2", default-features = false }
retry-policies = "0.5"
rstest = "0.27"
rustls = "0.23"
schemars = { version = "1.2", features = ["derive"] }
secrecy = { version = "0.10", features = ["serde"] }
semver = "1"
serde = { version = "1.0", features = ["derive"] }
serde-env = "0.3"
serde-inline-default = "1.0"
serde-wasm-bindgen = "0.6"
serde_default = "0.2"
serde_json = "1"
serde_path_to_error = "0.1"
serde_urlencoded = "0.7"
serde_yaml = "0.9"
sha2 = { version = "0.11", default-features = false }
strum = { version = "0.28", features = ["derive"] }
syn = "3"
sys_traits = { version = "0.1", features = ["libc", "real"] }
temp-env = "0.3"
tempfile = "3"
testing_logger = "0.1"
textwrap = { version = "0.16", default-features = false }
thiserror = "2"
tokio = "1"
tokio-tungstenite = { version = "0.30", default-features = false }
toml = "1.1"
tracing = "0.1"
tracing-actix-web = { version = "0.7", default-features = false, features = [
  "emit_event_on_error",
  "opentelemetry_0_32",
  "uuid_v7",
] }
tracing-log = "0.2"
tracing-opentelemetry = "0.33"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tracing-wasm = "0.2"
tree-sitter = "0.27"
tree-sitter-zig = "1"
# Already resolved transitively (object_store, reqwest, ...), so this adds no new crate or license to review.
# object_store's parse_url_opts takes a `&Url` and does not re-export the type, so a backend-URL config needs it.
url = "2"
utoipa = { version = "5", features = ["actix_extras", "yaml"] }
uuid = { version = "1", features = ["serde", "v4", "v7"] }
wasi-webgpu-wasmtime = "0.2"
wasm-bindgen = "0.2"
wasm-bindgen-futures = "0.4"
wasm-bindgen-test = "0.3"
# 44.0.3 is the floor for the RUSTSEC-2026-0182 fix (fd_renumber leak in WASIp1).
# Keep all three on the same major for ABI compat -- wasmtime-wasi-nn tracks wasmtime's version exactly.
# 47.0.3 is the floor, not a preference: RUSTSEC-2026-0222 (GHSA-hgjw-h833-99q9) is fixed only in
# >=24.0.12 <25, >=36.0.13 <37, >=46.0.2 <47, or >=47.0.3, so the 44.x line this used to pin has no patched
# release at all and 47.0.2 is still affected.
wasmtime = { version = "47.0.3", features = ["async", "component-model"] }
# The generator behind wasmtime's `bindgen!` macro, driven directly by et-int-gen.
# Emitting the runner's host bindings as a checked-in source file keeps ws-wasi-runner self-contained: the
# macro read WIT from `../../generated/specs/wit`, which `cargo package` cannot include, so the crate failed
# to build from its own tarball. Named `internal` upstream, so treat its API as unstable and pinned to the
# wasmtime version above; the drift check catches any change in what it emits.
wasmtime-internal-wit-bindgen = { version = "47.0.4", features = ["async", "component-model-async"] }
wasmtime-wasi = "47.0.3"
wasmtime-wasi-nn = { version = "47", default-features = false, features = ["onnx"] }
web-sys = "0.3"
# wgpu-core/wgpu-types come in via wasi-webgpu-wasmtime's re-exports; only the instance handle is ours.
wgpu-core = { version = "29", default-features = false }
wgpu-types = "29"
# Windows-only feature-unification shim: forces `winapi/std` on for deno_io.
winapi = { version = "0.3", features = ["std"] }
wit-bindgen = "0.62"
wit-encoder = "0.252"
wit-parser = "0.252"

[profile.release.package.et-ws-wasm-agent]
opt-level = "s"

[workspace.lints.rust]
# groups
unused = { level = "deny", priority = -1 }
# specific lints
dead_code = "deny"
let_underscore = { level = "deny", priority = -1 }
macro_use_extern_crate = "deny"
non_ascii_idents = "deny"
# Allowing private_bounds & private_interfaces & unnameable_types reduces the noise of using `visibility` crate.
private_bounds = "allow"
private_interfaces = "allow"
unnameable_types = "allow"

redundant_imports = "deny"
redundant_lifetimes = "deny"
trivial_numeric_casts = "deny"
# raises an error on unmet expect statements so they are easily found and fixed
unfulfilled_lint_expectations = "deny"
unsafe_attr_outside_unsafe = "deny"
unsafe_code = "deny"
unsafe_op_in_unsafe_fn = "deny"
# unused_crate_dependencies fires per test binary.
# Dev-deps declared once but consumed by only a subset of `tests/*.rs` files (each compiled as its
# own crate) are flagged as unused in the sibling test crates that don't import them. Tracked at
# rust-lang/rust#95513; re-enable when rustc gains a workspace-aware view.
# unused_crate_dependencies = "deny"
unused_results = "deny"

[workspace.lints.rustdoc]
private_intra_doc_links = { level = "deny", priority = 8 }

[workspace.lints.clippy]
# priority numbers are arbitrary ints; higher overrides lower.
# blanket clippy category rules appear at the top, while sub category lints appear below with priority levels
all = { level = "deny", priority = -1 }
complexity = { level = "deny", priority = -1 }
correctness = { level = "deny", priority = -1 }
implicit_return = { level = "allow", priority = 8 }
nursery = { level = "deny", priority = -1 }
pedantic = { level = "deny", priority = -1 }
perf = { level = "deny", priority = -1 }
restriction = { level = "deny", priority = -1 }
style = { level = "deny", priority = -1 }
suspicious = { level = "deny", priority = -1 }
# blanket_clippy_restriction_lints allows the above blanket deny
blanket_clippy_restriction_lints = { level = "allow", priority = 8 }
# allow lint groups to override priorities
integer_division_remainder_used = { level = "deny", priority = 8 }
lint_groups_priority = { level = "allow", priority = 8 }
# Allowing question_mark_used is an explicit implementation choice.
question_mark_used = { level = "allow", priority = 8 }
# Allowing std_instead_of_alloc as we have no reason yet to choose alloc,core over std
single_call_fn = { level = "deny", priority = 4 }
std_instead_of_alloc = { level = "allow", priority = 8 }
std_instead_of_core = { level = "allow", priority = 8 }
str_to_string = { level = "allow", priority = 4 }
struct_excessive_bools = { level = "allow", priority = 8 }
# Allowing shadow_reuse, shadow_same & shadow_unrelated is an explicit style choice.
# It prefers to allow developers to reuse a name even if its type changes.
semicolon_if_nothing_returned = { level = "deny", priority = 4 }
shadow_reuse = { level = "allow", priority = 4 }
shadow_same = { level = "allow", priority = 4 }
shadow_unrelated = { level = "allow", priority = 4 }
# Block-scoped statements like `{ *guard = ...; }` use the closing brace to drop borrows.
# Moving the `;` outside risks extending MutexGuard lifetimes past the intended scope.
semicolon_outside_block = { level = "allow", priority = 4 }
# Allowing separated_literal_suffix & unseparated_literal_suffix is an explicit style choice.
separated_literal_suffix = { level = "allow", priority = 4 }
unseparated_literal_suffix = { level = "allow", priority = 4 }
# Allowing absolute_paths is an explicit style choice.
absolute_paths = { level = "allow", priority = 4 }
# Allowing pub_use is an explicit style choice to streamline coding.
impl_trait_in_params = { level = "deny", priority = 4 }
pub_use = { level = "allow", priority = 4 }
# Allowing module_name_repetitions & mod_module_files are an explicit code layout choice.
mod_module_files = { level = "allow", priority = 4 }
module_name_repetitions = { level = "allow", priority = 4 }
self_named_module_files = { level = "deny", priority = 4 }
# Allowing missing_docs_in_private_items is an explicit but temporary choice to focus on documentation of public items.
missing_docs_in_private_items = { level = "allow", priority = 2 }
# missing_inline_in_public_items forces use of `#[inline]` on public items, which is not desirable.
missing_inline_in_public_items = { level = "allow", priority = 4 }
# Allowing missing_errors_doc as fixing unwrap's is the more important task.
future_not_send = { level = "deny", priority = 4 }
missing_errors_doc = { level = "allow", priority = 4 }
# pattern_type_mismatch fights with idiomatic match ergonomics.
# Examples: `for (k, v) in &map`, `if let Some(x) = &option`.
pattern_type_mismatch = { level = "allow", priority = 4 }
unused_async = { level = "deny", priority = 2 }
# as_conversions & cast_lossless & cast_possible_wrap should be replaced with safer wrapped conversion
as_conversions = "deny"
cast_lossless = "deny"
cast_possible_wrap = "deny"
clone_on_ref_ptr = { level = "deny", priority = 4 }
infinite_loop = "deny"
too_many_arguments = { level = "deny", priority = 2 }
# Allowing missing_trait_methods to avoid forcing explicit implementation of default trait methods
missing_trait_methods = { level = "allow", priority = 4 }
pub_with_shorthand = { level = "allow", priority = 4 }
pub_without_shorthand = { level = "deny", priority = 4 }
# clippy removing pub(crate) is quite confusing at times
redundant_pub_crate = { level = "allow", priority = 4 }

type_complexity = { level = "deny", priority = 4 }

min_ident_chars = { level = "deny", priority = 4 }

# Allowing arbitrary_source_item_ordering, because strict alphabetical ordering destroys semantic grouping.
# E.g. ClientMessage / ServerMessage variants in connection-lifecycle order, struct fields ordered by importance.
arbitrary_source_item_ordering = { level = "allow", priority = 4 }

# Force use of #[expect(..)] instead of #[allow(..)]
allow_attributes = { level = "deny", priority = 4 }
# This lint also covers #[expect] without a reason, so allow this to prevent silly reason values.
allow_attributes_without_reason = { level = "allow", priority = 4 }

let_underscore_must_use = { level = "deny", priority = 4 }
let_underscore_untyped = { level = "deny", priority = 4 }
missing_panics_doc = { level = "allow", priority = 4 }

[workspace.metadata.unmaintained]
ignore = [
  # No `repository` declared. Pulled by deno_node_crypto for AES-GCM.
  "aead-gcm-stream",
  # actix-web-thiserror-derive still uses syn v1
  "actix-web-thiserror-derive",
  # Archived upstream (servo/bincode).
  # Pulled by deno_core for snapshot serialisation; will move when Deno upgrades to bincode 2.
  "bincode",
  # Upstream contain-rs/bit-set is unmaintained; the newer 0.9.1 is flagged too.
  # Pulled by the Deno stack (deno_core, and naga/wgpu-core via deno_webgpu).
  "bit-set",
  # Unmaintained upstream at bitvecto-rs/bitvec.
  # Pulled by sourcemap (via swc tooling under deno_ast).
  "bitvec",
  # Unmaintained upstream at dsherret/capacity_builder.
  # Pulled by deno_ast.
  "capacity_builder",
  # Unmaintained upstream at jethrogb/rust-cexpr.
  # Pulled by bindgen (build-time only via aws-lc-sys / ort-sys).
  "cexpr",
  # Archived upstream at rust-lang/cfg-if, and the newer release the scanner points at is archived too.
  # 1.0.4 is current, and the crate is a leaf of most of the graph; there is nothing to move to.
  "cfg-if",
  # Unmaintained upstream at dajoha/color-print.
  # Pulled by deno_node via color-print.
  "color-print-proc-macro",
  # Upstream 9999years/command-error has been quiet for a year, which is what trips the age heuristic.
  # The scanner also notes its `process-wrap ^8` against a current 10. 0.8.0 is the latest release, so there
  # is no upgrade to take, and this is a direct dependency the repo adopts deliberately -- a lint rule of its
  # own holds every `Command` to it.
  "command-error",
  # Archived upstream at matklad/countme.
  "countme",
  # Unmaintained upstream at denoland/deno_native_certs.
  # Pulled by deno_node + deno_tls.
  "deno_native_certs",
  # No `repository` declared. Pulled by deno_node for `os.userInfo()`.
  "deno_whoami",
  # Unmaintained upstream at xdg-rs/dirs.
  "dirs-sys-next",
  # Unmaintained upstream at faradayio/exec-rs.
  # Pulled by Deno's `node_shim` (process re-exec on Node compatibility shim).
  "exec",
  # cargo-unmaintained can't find a crate of this name in the denoland/deno monorepo its `repository` field names.
  # It is a workspace member there, so the "not in <repo>" heuristic misfires. Pulled by the Deno registry stack.
  "fast-registry-json",
  # Upstream integritychain/fips203 has been quiet for a year, with dependency bounds left behind.
  # Its rand_core ^0.6.4 / sha3 ^0.10.2 requirements now trail the current releases. Pulled by deno_crypto for
  # the ML-KEM WebCrypto algorithms. Nothing to upgrade to on either side: 0.4.3 is the newest published
  # fips203, and every deno_crypto through 0.272.0 requires exactly ^0.4.3, so neither bumping deno nor the
  # crate itself clears this.
  "fips203",
  # Same upstream, same story as fips203, for SLH-DSA: quiet a year, stale rand_core / sha2 / sha3 bounds.
  # 0.4.1 is the newest published, and every deno_crypto through 0.272.0 pins ^0.4.1.
  "fips205",
  # fs-set-times has a long-stale upstream (bytecodealliance/fs-set-times) that cargo-unmaintained flags.
  # Its 0.20.3 (the latest release) still requires io-lifetimes ^2.0.0 (uses 2.0.4, latest 3.0.1); pulled by
  # cap-primitives (cap-std / cap-fs-ext) via the version-pinned wasmtime-wasi 47, so it can't be bumped out.
  # io-lifetimes 2.x is not a defect -- its I/O-safety types were upstreamed into std, leaving it frozen.
  "fs-set-times",
  # Unmaintained upstream at HdrHistogram/HdrHistogram_rust.
  # Pulled by deno_node (perf hooks).
  "hdrhistogram",
  # Unmaintained upstream at xacrimon/dashmap.
  # Pulled by deno_maybe_sync. (Marked stable / feature-complete by upstream.)
  "dashmap",
  # jni-sys requirement ^0.3.0 (used 0.3.1, latest 0.4.1); pulled by ndk-sys, an Android-only dep.
  # Reached via wgpu-hal (deno_webgpu -> wgpu); never compiled on our target platforms.
  "jni-sys",
  # Unmaintained upstream at rust-lang-nursery/lazy-static.rs.
  # Pulled by actix-web-thiserror-derive (build proc-macro).
  "lazy_static",
  # ndk-sys unmaintained upstream; Android-only, reached via wgpu-hal (deno_webgpu -> wgpu).
  # Never compiled on our target platforms.
  "ndk-sys",
  # Unmaintained upstream at rust-num/num-complex.
  # Pulled by nalgebra (via wgpu / naga). Stable foundational math crate.
  "num-complex",
  # Unmaintained upstream at SSheldon/rust-objc.
  # Pulled by `metal` (macOS GPU bindings via wgpu).
  "objc",
  # Not in declared repo (RustCrypto/utils).
  # Pulled by ghash (via aead-gcm-stream above) and other RustCrypto crates as a tiny helper.
  # Effectively dormant but functional.
  "opaque-debug",
  # cargo-unmaintained doesn't follow `hg` repositories.
  "oorandom",
  # Unmaintained upstream at hjiayz/p12.
  # Pulled by deno_node_crypto for PKCS#12 cert bundles.
  "p12",
  # Archived upstream at dtolnay/paste.
  # Pulled by macro_rules_attribute via wgpu. Compile-time only.
  "paste",
  # Both unmaintained.
  # GnomedDev/proc-macro-error-2 (the maintained fork of the original proc-macro-error) is archived.
  # Pulled by getset via neli via local-ip-address. Compile-time only.
  "proc-macro-error-attr2",
  "proc-macro-error2",
  # Unmaintained upstream at timvisee/qr2term-rs.
  "qr2term",
  # False positive.
  # rand_chacha lives in rust-random/rand as a workspace subdir (rand_chacha/).
  # But cargo-unmaintained looks only at the repo root and reports "not in".
  "rand_chacha",
  # Unmaintained upstream at gitlab redox-os/users; its getrandom (^0.2) and thiserror (^1.0) pins lag latest.
  # Redox-OS-only code, pulled via the version-pinned wasmtime 47's cache stack (wasmtime-internal-cache ->
  # directories-next -> dirs-sys-next, the same family as the dirs-sys-next entry above); never compiled on
  # our target platforms.
  "redox_users",
  # Unmaintained upstream at rust-analyzer/rowan (rust-analyzer moved its syntax trees in-tree).
  # Its hashbrown (^0.14.3) and rustc-hash (^1.0.1) pins lag latest. Both lock versions are transitive: 0.15
  # via deno_resolver's yaml_parser, 0.16 via pretty_yaml (et-int-gen's YAML emitter). Its helper crates
  # countme + text-size carry entries above/below for the same reason.
  "rowan",
  # Archived upstream at rustls/pemfile. Pulled by deno_native_certs.
  # rustls itself has moved to inline pemfile parsing.
  "rustls-pemfile",
  # Unmaintained upstream at denoland/rustls-tokio-stream.
  # Its derive-io (=0.4.1) and socket2 (^0.5) requirements lag latest; pulled by the Deno net/TLS stack
  # (deno_net -> deno_runtime).
  "rustls-tokio-stream",
  # Unmaintained upstream at arcnmx/serde-value.
  # Pulled by deno_ffi.
  "serde-value",
  # Unmaintained upstream at TedDriggs/serde_default; its `darling` requirement lags the latest release.
  # A direct dependency of edge-toolkit for the serde-attribute `Default` derive.
  "serde_default",
  # Archived upstream at bodil/smartstring.
  # Pulled by swc_ecma_lexer via deno_ast.
  "smartstring",
  # https://github.com/rustsec/advisory-db/issues/2132
  "serde_yaml",
  # spin's upstream is archived (mvdnes/spin-rs); the newer 0.10.1 is from the same archived repo, not a fix.
  # Both versions are pulled transitively -- 0.9.9 via lazy_static, 0.10.1 via crc-fast (object_store) -- so
  # neither can be bumped out to a maintained release.
  "spin",
  # Unmaintained upstream at dalek-cryptography/subtle.
  "subtle",
  # Unmaintained upstream at hucsmn/suffix_array; its `bincode` requirement lags the latest release.
  # Pulled by qbsdiff (binary diffing) via deno_runtime.
  "suffix_array",
  # Archived upstream at rust-analyzer/text-size.
  "text-size",
  # Declared repository toml-rs/toml hosts `toml_writer` (with the `r`), not `toml_write`.
  # The crate is effectively orphaned upstream.
  "toml_write",
  # https://github.com/rustsec/advisory-db/issues/2132
  "unsafe-libyaml",
  # Archived upstream at SimonSapin/rust-utf8.
  "utf-8",
  # Declared repository alacritty/vte is a single-crate repo with no `utf8parse` member.
  # The crate is effectively orphaned upstream.
  "utf8parse",
  # Unmaintained upstream at daxpedda/web-time.
  "web-time",
  # Not in declared repo (gfx-rs/wgpu): a per-platform helper crate from the wgpu monorepo.
  # cargo-unmaintained can't find the individual member at the repo root -- false positive; pulled by wgpu-core.
  "wgpu-core-deps-windows-linux-android",
  # windows-targets and the windows_* import-library crates are sunset false positives, not abandonment.
  # They declare `repository = https://github.com/microsoft/windows-rs`, but Microsoft deleted them from that
  # repo on 2026-07-20 (commit 201b9eaa7, "windows-targets" #4722), superseding them with `windows-link`.
  # The final 0.52.x/0.53.x versions stay published on crates.io; since the declared repo no longer holds a
  # Cargo.toml for them, cargo-unmaintained's "package in repo" heuristic reports "not in" -- a false positive
  # for deliberately-sunset, still-functional crates, not abandonment.
  #
  # These can't be bumped out of the lock: they are pulled only transitively, via older windows-sys majors
  # (0.52/0.59/0.60, all pre-windows-link) that upstream crates hard-require -- `ring` 0.17.14 pins
  # windows-sys `^0.52` (via rcgen -> et-ws-server) and `notify` 8.2.0 pins `^0.60.1` (via deno_runtime), and
  # neither has a windows-link-based release yet, so `cargo update` refuses windows-sys 0.61. Bumping
  # windows-targets itself is futile -- no version of it exists in the repo any more. Delete these entries once
  # the upstream stack adopts windows-link and the crates drop out of the lock.
  "windows-targets",
  "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
  "windows_i686_gnu",
  "windows_i686_gnullvm",
  "windows_i686_msvc",
  "windows_x86_64_gnu",
  "windows_x86_64_gnullvm",
  "windows_x86_64_msvc",
  # Declared repository WebAssembly/WASI is spec-only (no `crates/` tree).
  # The crate is effectively orphaned upstream.
  "witx",
  # Archived upstream at SimonSapin/rust-wtf8.
  # Pulled by v8_valueserializer via deno_core.
  # UTF-8 / WTF-8 conversions for V8's structured-clone serializer.
  "wtf8",
  # Not in declared repo (kornelski/xml-rs).
  # Pulled by gl_generator (build-time only, OpenGL bindings via wgpu).
  "xml-rs",
]