Merge branch 'ban-more-unwanted-crates'

1 files changed, 11 insertions, 2 deletions

diff --git a/deny.toml b/deny.toml
index 9ed9d3b5c6..d08fbc068b 100644
--- a/deny.toml
+++ b/deny.toml
@@ -75,13 +75,22 @@ wildcards = "warn"
 highlight = "all"
 
 deny = [
-    # We are using Rustls for TLS. We don't want to accidentally pull in
-    # anything OpenSSL related
+    ## Alternative ecosystems that we don't want to accidentally pull in.
+    ## Having multiple large ecosystems solving the same problem can often be problematic,
+    ## and also expensive from a compile time/binary size/supply chain security perspective.
+
+    # We are using Rustls, so we want to avoid OpenSSL
     { name = "openssl-sys" },
     { name = "openssl-src" },
     { name = "openssl-probe" },
+    # We are using tokio, so we want to avoid async-std
+    { name = "async-std" },
+
+    ## Older versions of crates where we only want to use the newer variants
     { name = "clap", version = "2" },
     { name = "clap", version = "3" },
+    { name = "hyper", version = "0" },
+    { name = "tokio", version = "0" },
     { name = "time", version = "0.1"},
 ]