vaultwarden/Cargo.toml

[workspace.package]
edition = "2024"
rust-version = "1.97.1"
license = "AGPL-3.0-only"
repository = "https://github.com/dani-garcia/vaultwarden"
publish = false

[workspace]
members = ["macros"]

[package]
name = "vaultwarden"
version = "1.0.0"
authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
build = "build.rs"
repository.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
publish.workspace = true

[features]
default = [
    # "sqlite",
    # "sqlite_system",
    # "mysql",
    # "postgresql",
]
# Empty to keep compatibility, prefer to set USE_SYSLOG=true
enable_syslog = []
# Please enable at least one of these DB backends.
mysql = ["diesel/mysql", "diesel_migrations/mysql"]
postgresql = ["diesel/postgres", "diesel_migrations/postgres"]
sqlite_system = ["diesel/sqlite", "diesel_migrations/sqlite"] # Dynamically link SQLite
sqlite = ["sqlite_system", "libsqlite3-sys/bundled"] # Statically link SQLite into the binary instead of dynamically.
# Enable to use a vendored and statically linked openssl
vendored_openssl = ["openssl/vendored"]
# Enable MiMalloc memory allocator to replace the default malloc
# This can improve performance for Alpine builds
enable_mimalloc = ["dep:mimalloc"]
s3 = [
    "opendal/services-s3",
    "dep:opendal-http-transport-reqwest",
    "dep:aws-config",
    "dep:aws-credential-types",
    "dep:aws-smithy-runtime-api",
    "dep:http",
    "dep:reqsign-aws-v4",
    "dep:reqsign-core",
]

# OIDC specific features
oidc-accept-rfc3339-timestamps = ["openidconnect/accept-rfc3339-timestamps"]
oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]

# Enable unstable features, requires nightly
# Currently only used to enable rusts official ip support
unstable = []

# Test builds only, never in a release or a deployment: adds a seeder API that creates accounts without any checks,
# for the end-to-end tests (`tools/sdk-live-tests/`)
unsafe_test_mode = ["dep:serde_cbor_2"]

[target."cfg(unix)".dependencies]
nix = { version = "0.31.3", features = ["fs"] }
# Logging
syslog = "7.0.0"

[dependencies]
macros = { path = "./macros" }

# Logging
log = "0.4.35"
fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
# We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
tracing = { version = "0.1.44", features = ["log"] }

# A `dotenv` implementation for Rust
dotenvy = { version = "0.15.7", default-features = false }

# Numerical libraries
num-traits = "0.2.19"
num-derive = "0.5.1"
bigdecimal = "0.4.11"

# Web framework
rocket = { version = "0.5.2", default-features = false, features = ["json", "tls"] }
rocket_ws = { version = "0.1.1" }

# WebSockets libraries
rmpv = "1.3.1" # MessagePack library

# Concurrent HashMap used for WebSocket messaging and favicons
dashmap = "6.2.1"

# Async futures
futures = "0.3.34"
tokio = { version = "1.54.1", features = [
    "fs",
    "io-util",
    "net",
    "parking_lot",
    "rt-multi-thread",
    "signal",
    "time",
] }
tokio-util = { version = "0.7.20", features = ["compat"] }

# A generic serialization/deserialization framework
serde = { version = "1.0.229", features = ["derive"] }
serde_json = "1.0.154"

# A safe, extensible ORM and Query builder
diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
diesel_migrations = "2.3.2"

derive_more = { version = "2.1.1", features = [
    "as_ref",
    "deref",
    "display",
    "from",
    "into",
] }
diesel-derive-newtype = "2.1.3"

# SQLite, statically bundled unless the `sqlite_system` feature is enabled
libsqlite3-sys = { version = "0.38.2", optional = true }

# Crypto-related libraries
rand = "0.10.3"
ring = "0.17.14"
rustls = { version = "0.23.46", features = ["ring", "std"], default-features = false }
subtle = "2.6.1"

# UUID generation
uuid = { version = "1.29.0", features = ["v4"] }

# Date and time libraries
chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
chrono-tz = "0.10.4"
time = "0.3.55"

# Job scheduler
job_scheduler_ng = "2.5.0"

# Data encoding library Hex/Base32/Base64
data-encoding = "2.11.1"

# JWT library
jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }

# TOTP library
totp-lite = "2.0.1"

# Yubico Library
yubico_ng = { version = "1.0.0", default-features = false }

# WebAuthn libraries
# danger-allow-state-serialisation is needed to save the state in the db
# danger-credential-internals is needed to support U2F to Webauthn migration
webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
webauthn-rs-proto = "0.5.5"
webauthn-rs-core = "0.5.5"
# Only for `unsafe_test_mode`, to read the algorithm of a COSE key; already used by webauthn-rs
serde_cbor_2 = { version = "0.13.0", optional = true }

# Handling of URL's for WebAuthn and favicons
url = "2.5.8"

# Email libraries
lettre = { version = "0.11.23", default-features = false, features = [
    # Misc
    "tracing",
    "serde",
    "builder",
    "hostname",
    # TLS/Security
    "ring",
    "rustls-native-certs",
    "tokio1-rustls",
    # Transport
    "smtp-transport",
    "sendmail-transport",
] }
percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
email_address = "0.2.9"

# HTML Template library
handlebars = { version = "6.4.4", features = ["dir_source"] }

# HTTP client (Used for favicons, version check, DUO and HIBP API)
reqwest = { version = "0.13.5", default-features = false, features = [
    # Misc
    "charset",
    "cookies",
    "http2",
    "json",
    "form",
    "rustls-no-provider",
    "stream",
    # Compression
    "brotli",
    "deflate",
    "gzip",
    "zstd",
    # Proxy
    "socks",
    "system-proxy",
] }
hickory-resolver = "0.26.3"

# Favicon extraction libraries
html5gum = "0.9.0"
regex = { version = "1.13.1", default-features = false, features = [
    "perf",
    "std",
    "unicode-perl",
] }
data-url = "0.3.2"
bytes = "1.12.1"
svg-hush = "0.9.7"

# Cache function results (Used for version check and favicon fetching)
cached = { version = "4.1.0", features = ["async"] }

# Used for custom short lived cookie jar during favicon extraction
cookie = "0.18.2"
cookie_store = "0.22.1"

# Used by U2F, JWT and PostgreSQL
openssl = "0.10.81"

# CLI argument parsing
pico-args = "0.5.0"

# Macro ident concatenation
pastey = "0.2.3"
governor = "0.10.4"

# CIDR parsing for the trusted proxies of the client IP header
ipnet = "2.12.2"

# OIDC for SSO
openidconnect = { version = "4.1.0", default-features = false }
moka = { version = "0.12.16", features = ["future"] }

# Check client versions for specific features.
semver = "1.0.28"

# Allow overriding the default memory allocator
# Mainly used for the musl builds, since the default musl malloc is very slow
mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }

which = "8.0.6"

# Argon2 library with support for the PHC format
argon2 = "0.6.0"

# Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
rpassword = "7.5.4"

# Loading a dynamic CSS Stylesheet
grass_compiler = { version = "0.13.4", default-features = false }

# File are accessed through Apache OpenDAL
opendal = { version = "0.59.5", default-features = false, features = ["services-fs"] }
opendal-http-transport-reqwest = { version = "0.59.5", default-features = false, features = ["rustls-no-provider"], optional = true }

# For retrieving AWS credentials, including temporary SSO credentials
aws-config = { version = "1.13.0", optional = true, default-features = false, features = [
    "behavior-version-latest",
    "credentials-process",
    "rt-tokio",
    "sso",
] }
aws-credential-types = { version = "1.3.1", optional = true }
aws-smithy-runtime-api = { version = "1.19.2", optional = true }
http = { version = "1.5.0", optional = true }
reqsign-aws-v4 = { version = "3.3.1", optional = true }
reqsign-core = { version = "3.3.2", optional = true }

# Strip debuginfo from the release builds
# The debug symbols are to provide better panic traces
# Also enable fat LTO and use 1 codegen unit for optimizations
[profile.release]
strip = "debuginfo"
lto = "fat"
codegen-units = 1
debug = false

# Optimize for size
[profile.release-micro]
inherits = "release"
strip = "symbols"
opt-level = "z"
panic = "abort"

# Profile for systems with low resources
# It will use less resources during build
[profile.release-low]
inherits = "release"
strip = "symbols"
lto = "thin"
codegen-units = 16

# Used for profiling and debugging like valgrind or heaptrack
# Inherits release to be sure all optimizations have been done
[profile.dbg]
inherits = "release"
strip = "none"
split-debuginfo = "off"
debug = "full"

# A little bit of a speedup for generic building
[profile.dev]
split-debuginfo = "unpacked"
debug = "line-tables-only"

# Used for CI builds to improve compile time
[profile.ci]
inherits = "dev"
debug = false
debug-assertions = false
strip = "symbols"
panic = "abort"

# Always build argon2 using opt-level 3
# This is a huge speed improvement during testing
[profile.dev.package.argon2]
opt-level = 3

# Linting config
# https://doc.rust-lang.org/rustc/lints/groups.html
[workspace.lints.rust]
# Forbid
unsafe_code = "forbid"
non_ascii_idents = "forbid"

# Deny
warnings = "deny" # Explicitly deny all warnings since we deny all warnings in the end

# Deny lint groups
deprecated_safe = { level = "deny", priority = -1 }
future_incompatible = { level = "deny", priority = -1 }
keyword_idents = { level = "deny", priority = -1 }
let_underscore = { level = "deny", priority = -1 }
nonstandard_style = { level = "deny", priority = -1 }
refining_impl_trait = { level = "deny", priority = -1 }
rust_2018_idioms = { level = "deny", priority = -1 }
rust_2021_compatibility = { level = "deny", priority = -1 }
rust_2024_compatibility = { level = "deny", priority = -1 }
unused = { level = "deny", priority = -1 }

# Deny individual lints
closure_returning_async_block = "deny"
deprecated_in_future = "deny"
single_use_lifetimes = "deny"
trivial_casts = "deny"
trivial_numeric_casts = "deny"
unused_import_braces = "deny"
unused_lifetimes = "deny"
unused_qualifications = "deny"
variant_size_differences = "deny"

# https://rust-lang.github.io/rust-clippy/stable/index.html
[workspace.lints.clippy]
# Warn only so you can still use these during development, but not in the final code
dbg_macro = "warn"
todo = "warn"

# Ignore/Allow
result_large_err = "allow"

# Warn on these lint group (Some might be warn by default already though)
# Will be denied during CI!
complexity = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
perf = { level = "warn", priority = -1 }
style = { level = "warn", priority = -1 }
suspicious = { level = "warn", priority = -1 }

# Deny individual lints
branches_sharing_code = "deny"
clone_on_ref_ptr = "deny"
equatable_if_let = "deny"
float_cmp_const = "deny"
iter_on_empty_collections = "deny"
iter_on_single_items = "deny"
mem_forget = "deny"
needless_collect = "deny"
redundant_clone = "deny"
unnecessary_self_imports = "deny"
useless_let_if_seq = "deny"
verbose_file_reads = "deny"
str_to_string = "deny"

# Pedantic Opt-Outs
inline_always = "allow" # We use this sparsely
struct_field_names = "allow" # Noisy and some items are Bitwarden controlled
large_futures = "allow" # Causes a fail in some Rocket macro's, since we experience no issues, allow it
too_many_lines = "allow" # For now, allow this, good to enable in the future and see if we can refactor
unnecessary_wraps = "allow" # Too much false positives because of Rocket integrations
# We do not use these doc items
doc_link_with_quotes = "allow"
doc_markdown = "allow"
missing_errors_doc = "allow"
missing_panics_doc = "allow"

[lints]
workspace = true