[licenses]

allow = [

"0BSD",

"Apache-2.0",

"BSD-2-Clause",

"BSD-3-Clause",

"BSL-1.0",

"CC0-1.0",

"CDLA-Permissive-2.0",

"ISC",

"MIT",

"MIT-0",

"BlueOak-1.0.0",

"OpenSSL",

"Unicode-3.0",

"Unicode-DFS-2016",

"Zlib"

]

private = { ignore = true }

exceptions = [

# MPL-2.0 are added case-by-case to make sure we are in compliance. To be in

# compliance we cannot be modifying the source files.

{ allow = ["MPL-2.0"], name = "colored", version = "*" },

{ allow = ["MPL-2.0"], name = "webpki-roots", version = "*" },

{ allow = ["MPL-2.0"], name = "vector-common-macros", version = "*" },

{ allow = ["MPL-2.0"], name = "vector-config-common", version = "*" },

{ allow = ["MPL-2.0"], name = "vector-config-macros", version = "*" },

{ allow = ["MPL-2.0"], name = "vrl", version = "*" },

]

[[licenses.clarify]]

name = "ring"

version = "*"

expression = "MIT AND ISC AND OpenSSL"

license-files = [

{ path = "LICENSE", hash = 0xbd0eed23 }

]

[advisories]

ignore = [

{ id = "RUSTSEC-2023-0071", reason = "rsa marvin attack - unpatched upstream (https://github.com/vectordotdev/vector/issues/19262)" },

{ id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained (https://github.com/vectordotdev/vector/issues/24940)" },

{ id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is unmaintained with no patched release; used by serde_yaml and VRL's serde_yaml_ng, whose backend migration is pending upstream (https://github.com/acatton/serde-yaml-ng/issues/5)" },

{ id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained - unpatched crate (https://github.com/bytebeamio/rumqtt/issues/1010) & tonic/reqwest upgrade (https://github.com/vectordotdev/vector/issues/19179)" },

{ id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 is unmaintained - transitive dep via mlua_derive v0.11.0; unblocked when mlua upgrades its derive macro" },

{ id = "RUSTSEC-2026-0235", reason = "rkyv 0.7 is vulnerable but unmaintained; upgrading vector-buffers to rkyv 0.8 requires a breaking serialization migration" },

{ id = "RUSTSEC-2026-0258", reason = "h2 0.3 via hyper 0.14 and reqwest 0.11 - legacy HTTP upgrade (https://github.com/vectordotdev/vector/issues/19179)" },

{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5 via elliptic-curve 0.13, p256/p384 0.13, and openidconnect 4 (pulsar auth-oauth2), which only uses openidconnect for provider discovery; unblocked when openidconnect moves to p256/p384 0.14 (https://github.com/ramosbugs/openidconnect-rs/pull/244)" },

{ id = "RUSTSEC-2026-0391", reason = "zstd 0.13 via tonic, pulsar, arrow-ipc 58/59, parquet 59, vrl, and Vector's own zstd use; none call the affected stream::raw with_context constructors. Fixed only in zstd 0.14; Vector's bump needs vector-common's CappedDecoder to borrow its DecoderDictionary" },

{ id = "RUSTSEC-2026-0403", reason = "zstd-safe 7 via zstd 0.13 (same dependents as RUSTSEC-2026-0391), which only decompress through stream::read::Decoder, decode_all, and bulk, which the advisory lists as unaffected; async-compression's streaming decoder uses the fixed zstd-safe 8.2. Fixed only in zstd-safe 8" },

]