From 1282454b8dfc2e271693311178941d49de743678 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jpmschweitzer@gmail.com>
Date: Sun, 19 Apr 2026 13:12:23 +0200
Subject: [PATCH] feat(engine): configure cargo-deny and remove unused bincode
 dep (#726, #636)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

deny.toml: license allowlist + RUSTSEC advisory checking. econ-sim excluded
from graph (path dep, no license). Bincode v1 removed — never imported in
source, RUSTSEC-2025-0141 advisory resolved by deletion.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore        |  4 ++++
 server/Cargo.lock | 12 +-----------
 server/Cargo.toml |  2 +-
 server/audit.toml |  6 ------
 server/deny.toml  | 41 +++++++++++++++++++++++++++++++++++++++++
 5 files changed, 47 insertions(+), 18 deletions(-)
 create mode 100644 server/deny.toml

diff --git a/.gitignore b/.gitignore
index 8128fc939..0c363ef0c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -70,6 +70,10 @@ Thumbs.db
 *.swp
 *.swo
 
+# Generated economics pipeline artifacts (re-created by make economy-db)
+wiki/economics/corporations/generated_brands.toml
+wiki/economics/corporations/generated_corporations.toml
+
 # Claude Code internals (plans, session transcripts)
 # Note: .claude/agents/, .claude/skills/, and .claude/settings.json ARE tracked
 .claude/plans/
diff --git a/server/Cargo.lock b/server/Cargo.lock
index d15f9473c..b2f78ecbe 100644
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -325,15 +325,6 @@ dependencies = [
  "thread_local",
 ]
 
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "bitflags"
 version = "2.10.0"
@@ -1303,12 +1294,11 @@ dependencies = [
 
 [[package]]
 name = "settled-reach-server"
-version = "0.1.34"
+version = "0.1.35"
 dependencies = [
  "bevy_app",
  "bevy_ecs",
  "bevy_tasks",
- "bincode",
  "clap",
  "crossbeam-channel",
  "econ-sim",
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 61cc8cc9f..b9b94759e 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -2,6 +2,7 @@
 name = "settled-reach-server"
 version = "0.1.35"
 edition = "2021"
+publish = false
 
 [dependencies]
 bevy_ecs = "0.18"
@@ -16,7 +17,6 @@ serde = { version = "1", features = ["derive"] }
 serde_yaml = "0.9"
 ron = "0.8"
 rmp-serde = "1"
-bincode = "1"
 rand = "0.9"
 rand_chacha = "0.9"
 pathfinding = "4.11"
diff --git a/server/audit.toml b/server/audit.toml
index cb6504099..b82c06c11 100644
--- a/server/audit.toml
+++ b/server/audit.toml
@@ -1,9 +1,3 @@
 # cargo audit configuration for settled-reach-server.
 # Known advisories that are tracked but not yet resolved are listed here.
 # New advisories NOT in this list will fail CI.
-
-[advisories]
-# RUSTSEC-2025-0141: bincode v1.3.3 is unmaintained.
-# Migration to bincode v2 or an alternative is tracked in ticket #636.
-# This ignore can be removed once #636 is resolved.
-ignore = ["RUSTSEC-2025-0141"]
diff --git a/server/deny.toml b/server/deny.toml
new file mode 100644
index 000000000..46dc2059a
--- /dev/null
+++ b/server/deny.toml
@@ -0,0 +1,41 @@
+# cargo deny configuration for settled-reach-server.
+# Enforces license allowlist, RUSTSEC advisory checks, and duplicate detection.
+# Run: cargo deny check (from server/)
+
+# econ-sim is an internal path dependency with no license declaration.
+# Excluding it skips only econ-sim itself — its dependencies are still checked
+# because they are shared with settled-reach-server's own dep tree.
+[graph]
+exclude = ["econ-sim"]
+
+[advisories]
+version = 2
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    # Needed for wasip2/wit-bindgen (WASM support crates via bevy_tasks).
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unlicense",
+    "Zlib",
+    "CC0-1.0",
+    # Required by unicode-ident: "(MIT OR Apache-2.0) AND Unicode-3.0".
+    "Unicode-3.0",
+    # Required by ryu: "Apache-2.0 OR BSL-1.0".
+    "BSL-1.0",
+]
+# settled-reach-server has publish = false and carries no license declaration.
+[licenses.private]
+ignore = true
+
+[bans]
+multiple-versions = "warn"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"