[package]

name = "suzaku"

version = "2.0.1"

repository = "https://github.com/Yamato-Security/suzaku"

authors = ["Yamato Security @SecurityYamato"]

edition = "2024"

rust-version = "1.97.1"

include = ["src/**/*", "LICENSE.txt", "README.md", "CHANGELOG.md"]

# Dependency versions carry an explicit floor rather than "*". A wildcard accepts any

# future release, including a breaking one, on the next `cargo update` or on any build

# that resolves without Cargo.lock. That is not hypothetical here: #131 was exactly this

# -- a wildcard-pinned cidr-utils shipped a backend that stopped accepting abbreviated

# CIDR, and `--geo-ip` began panicking at startup with nothing in suzaku having changed.

# Six of these are pre-1.0, where every minor is a breaking change under Cargo's semver

# rules, so `maxminddb 0.30 -> 0.31` is as free to break as `1.0 -> 2.0`. (#189)

[dependencies]

bytesize = "2"

chrono = "0.4.*"

clap = {version = "4.6.*", features = ["derive", "env"]}

colored = "3"

comfy-table = "7"

console = "0.16"

const_format = "0.2"

csv = "1"

flate2 = { version = "1", features = ["zlib-rs"], default-features = false }

# Enable the vendored-OpenSSL HTTPS/TLS backend for libgit2. The wildcard

# "*" resolved to a build of libgit2 with no TLS transport, so `update-rules`

# failed with "there is no TLS stream available; class=Ssl (16)". The unix

# target already vendors OpenSSL (see `openssl` below), so this just links

# libgit2's HTTPS support against it. Mirrors the same fix in hayabusa.

git2 = { version = "0.21", features = ["https", "vendored-openssl"] }

hashbrown = "0.17"

indicatif = "0.18"

itertools = "0.15"

libmimalloc-sys = { version = "0.1.49", features = ["extended"] }

maxminddb = "0.30"

mimalloc = { version = "0.1.52", default-features = false }

num-format = "0.4.*"

regex = "1"

serde = { version = "1", features = ["derive"] }

serde_json = "1"

termcolor = "1"

terminal_size = "0.4.*"

ureq = "3"

rayon = "1"

tempfile = "3"

sigma-rust = { git = "https://github.com/Yamato-Security/sigma-rust", tag = "v0.7.1" }

# Parquet input support. Compression codecs cover what CloudTrail-to-Parquet

# pipelines actually emit (Athena/Glue/Firehose): snappy, gzip, zstd, lz4.

# flate2-zlib-rs matches the zlib-rs backend used by our own flate2 dependency.

parquet = { version = "59.1.0", default-features = false, features = ["arrow", "snap", "flate2", "flate2-zlib-rs", "zstd", "lz4"] }

arrow-json = "59.1.0"

# DuckDB output. `bundled` compiles the DuckDB engine into the binary so releases stay

# self-contained (no system libduckdb needed), at the cost of build time / binary size.

# Require >= 1.10504: earlier bundled builds fail on the current Windows CI MSVC toolset

# (14.51), whose STL removed `stdext::checked_array_iterator` that DuckDB's vendored fmt

# used; 1.10504 patches that header and links the Restart Manager lib. (duckdb-rs #786)

duckdb = { version = "1.10504", features = ["bundled"] }

[target.'cfg(unix)'.dependencies] #Mac and Linux

openssl = { version = "0.10", features = ["vendored"] } #vendored is needed to compile statically.