schema_version = 1

[[components]]
name = "rust"
kind = "toolchain"
source = "https://static.rust-lang.org"
version = "1.97.1"
license = "Apache-2.0 OR MIT"
owner = "project maintainers"
update_policy = "explicit pull request after release and security review"
release_profile = false

[[components]]
name = "serde"
kind = "runtime-library"
source = "https://crates.io/crates/serde"
version = "1.0.228"
license = "MIT OR Apache-2.0"
owner = "project maintainers"
update_policy = "explicit contract change after changelog, license, and audit review"
release_profile = true

[[components]]
name = "serde_json"
kind = "runtime-library"
source = "https://crates.io/crates/serde_json"
version = "1.0.150"
license = "MIT OR Apache-2.0"
owner = "project maintainers"
update_policy = "explicit contract change after changelog, license, and audit review"
release_profile = true

[[components]]
name = "uuid"
kind = "runtime-library"
source = "https://crates.io/crates/uuid"
version = "1.24.0"
license = "MIT OR Apache-2.0"
features = ["serde", "v4"]
owner = "project maintainers"
update_policy = "explicit identity-contract change after changelog, license, and audit review"
release_profile = true

[[components]]
name = "toml"
kind = "runtime-library"
source = "https://crates.io/crates/toml"
version = "1.1.3+spec-1.1.0"
license = "MIT OR Apache-2.0"
owner = "project maintainers"
update_policy = "explicit configuration-contract change after changelog, license, and audit review"
release_profile = true

# Transitive crate versions, sources, and checksums are pinned in Cargo.lock. Their
# licenses and sources are enforced by cargo-deny before release.

[[components]]
name = "cargo-deny"
kind = "development-audit-tool"
source = "https://crates.io/crates/cargo-deny"
version = "0.20.2"
license = "Apache-2.0 OR MIT"
owner = "project maintainers"
update_policy = "explicit pull request after release, changelog, and config review"
release_profile = false