chore(deps): update embarkstudios/cargo-deny-action action to v2#56
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update embarkstudios/cargo-deny-action action to v2#56renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/embarkstudios-cargo-deny-action-2.x
branch
from
94dfce7 to
32bce5d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1→v2Release Notes
EmbarkStudios/cargo-deny-action (EmbarkStudios/cargo-deny-action)
v2.0.20: Release 2.0.20 - cargo-deny 0.19.8Compare Source
Fixed
^and~with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.v2.0.19: Release 2.0.19 - cargo-deny 0.19.7Compare Source
Changed
v2.0.18: Release 2.0.18 - cargo-deny 0.19.5Compare Source
Fixed
v2.0.17: Release 2.0.17 - cargo-deny 0.19.2Compare Source
Fixed
v2.0.16: Release 2.0.16 - cargo-deny 0.19.1Compare Source
Fixed
--filter-platformwhen collecting cargo metadata if only a single target was requested either in the config or via the command line.--frozenwould not disable fetching of the advisory DB, resolving #759.krateswas updated to resolve two issues with crates being pruned from the graph used when running checks. Resolving these two issues may mean that updating cargo-deny may highlight issues that were previously hidden.libtarget renamed by the package author.Changed
gixin favor of shelling out togit. This massively improves build times and eases maintenance asgixbumps minor versions quite frequently. If cargo-deny is used in an environment that for some reason allows internet access but doesn't havegitavailable, the advisory database would need to be updated before calling cargo-deny.rustsecin favor of manually implemented advisory parsing and checking, with a nightly cron job that checks that the implementation exactly matches rustsec on the official rustsec advisory db.v2.0.15: Release 2.0.15 - cargo-deny 0.19.0Compare Source
Changed
--configbe resolved relative to the current working directory (rather than the resolved manifest path's directory).gix,reqwest, andtame-indexto newer versions. Thereqwest0.13 changes means it is no longer possible to choose the source of root certificates forgix, so that decision is now left torustls-platform-verifier. Thenative-certsfeature has thus been removed, andcargo-denyno longer defaults to usingwebpki-roots.Fixed
--config, resolving #748.Added
[bans.allow-workspace]to allow workspace crates while denying all external crates.[licenses.include-build]to toggle whether build dependencies are included in the license check.[advisories.unused-ignored-advisory]to disable the warning when an advisory is ignored but not encountered in the crate graph.[advisories.unsound]to determine which crates can showunsoundadvisories, similarly to theunmaintainedfield. Defaults toworkspacecrates, ignoringunsoundadvisories for transitive dependencies, resolving #824.v2.0.14: Release 2.0.14 - cargo-deny 0.18.6Compare Source
0.18.5
Changed
Added
--format sarif. The current output for this format is experimental and may change in future updates.0.18.6
Fixed
rustsecto 0.31, resolving #804.licenseexpression.Added
unused-license-exceptionoption to configure the lint level, resolving #806.Changed
gixto 0.75.v2.0.13: Release 2.0.13 - cargo-deny 0.18.4Compare Source
Added
--metadata-pathargument to use a cargo metadata JSON file instead of calling cargo metadata, resolving #777.sources.unused-allow-sourceto allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing #781.Changed
/is no longer corrected toOR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.Fixed
spdxto a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.v2.0.12: Release 2.0.12 - cargo-deny 0.18.3Compare Source
Changed
v2.0.11Compare Source
[0.18.2] - 2025-03-10
Added
advisories.unmaintainedconfig option. See the docs for how it can be used. The default matches the current behavior, which is to error on anyunmaintainedadvisory, but addingunmaintained = "workspace"to the[advisories]table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.[0.18.1] - 2025-02-27
Fixed
kratesto pull in the fix for EmbarkStudios/krates#100.v2.0.10Compare Source
rustup toolchain installifrustup showfailed due to any reasonv2.0.9: Release 2.0.9 - cargo-deny 0.18.0Compare Source
d8395c1removed the rustup update.v2.0.8Compare Source
v2.0.7: Release 2.0.7 - cargo-deny 0.18.0Compare Source
v2.0.6: Release 2.0.6 - cargo-deny 0.18.0Compare Source
Changed
https://github.com/rustsec/advisory-dbwill now be placed in$CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.Fixed
v2.0.5: Release 2.0.5 - cargo-deny 0.17.0Compare Source
Changed
tame-indexto 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.v2.0.4: Release 2.0.4 - cargo-deny 0.16.3Compare Source
v2.0.3: Release 2.0.3 - cargo-deny 0.16.3Compare Source
Changed
rust-versionto 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #720.Fixed
unnecessary-skipdiagnostic, emitted when there is askipconfigured for a crate that only has one version in the graph.v2.0.2: Release 2.0.2 - cargo-deny 0.16.2Compare Source
Fixed
krates-> 0.17.5, fixing an issue wherecargo-denycould panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.Added
--exclude-unpublishedCLI argument or thegraph.exclude-unpublishedconfig field. Thanks @Tastaturtaste!Changed
goblin-> 0.9.2rustsec-> 0.30.v2.0.1: Release 2.0.1 - cargo-deny 0.16.1Compare Source
Fixed
unused-workspace-dependencylint.v2.0.0: Release 2.0.0 - cargo-deny 0.16.0Compare Source
ActionAdded
Changed
v2tag, usingv1will be stable but not follow futurecargo-denyreleases.cargo-denyRemoved
[advisories]The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the
ignorefield can be used as before.vulnerability- Vulnerability advisories are nowdenyby defaultunmaintained- Unmaintained advisories are nowdenyby defaultunsound- Unsound advisories are nowdenyby defaultnotice- Notice advisories are nowdenyby defaultseverity-threshold- The severity of vulnerabilities is now irrelevant[licenses]The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either
alloworexceptions.unlicensed- Crates whose license(s) cannot be confidently determined are now always errors. Theclarifyfield can be used to help cargo-deny determine the license.allow-osi-fsf-free- The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed.copyleft- The copyleft attribute is now irrelevant, only whether it is explicitly allowed.default- The default is nowdeny.deny- All licenses are now denied by default, this field added nothing.Changed
bans.workspace-dependenciessection. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, but makes it so that if not specified workspace duplicates are nowdenyinstead ofwarn.Fixed
include-path-dependenciesfield, allowing path dependencies to be ignored if it isfalse.v2Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.