Update EmbarkStudios/cargo-deny-action action to v2#34
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1→v2Release Notes
EmbarkStudios/cargo-deny-action (EmbarkStudios/cargo-deny-action)
v2.0.19: Release 2.0.19 - cargo-deny 0.19.7Compare Source
Changed
v2.0.18: Release 2.0.18 - cargo-deny 0.19.5Compare Source
Fixed
v2.0.17: Release 2.0.17 - cargo-deny 0.19.2Compare Source
Fixed
v2.0.16: Release 2.0.16 - cargo-deny 0.19.1Compare Source
Fixed
--filter-platformwhen collecting cargo metadata if only a single target was requested either in the config or via the command line.--frozenwould not disable fetching of the advisory DB, resolving #759.krateswas updated to resolve two issues with crates being pruned from the graph used when running checks. Resolving these two issues may mean that updating cargo-deny may highlight issues that were previously hidden.libtarget renamed by the package author.Changed
gixin favor of shelling out togit. This massively improves build times and eases maintenance asgixbumps minor versions quite frequently. If cargo-deny is used in an environment that for some reason allows internet access but doesn't havegitavailable, the advisory database would need to be updated before calling cargo-deny.rustsecin favor of manually implemented advisory parsing and checking, with a nightly cron job that checks that the implementation exactly matches rustsec on the official rustsec advisory db.v2.0.15: Release 2.0.15 - cargo-deny 0.19.0Compare Source
Changed
--configbe resolved relative to the current working directory (rather than the resolved manifest path's directory).gix,reqwest, andtame-indexto newer versions. Thereqwest0.13 changes means it is no longer possible to choose the source of root certificates forgix, so that decision is now left torustls-platform-verifier. Thenative-certsfeature has thus been removed, andcargo-denyno longer defaults to usingwebpki-roots.Fixed
--config, resolving #748.Added
[bans.allow-workspace]to allow workspace crates while denying all external crates.[licenses.include-build]to toggle whether build dependencies are included in the license check.[advisories.unused-ignored-advisory]to disable the warning when an advisory is ignored but not encountered in the crate graph.[advisories.unsound]to determine which crates can showunsoundadvisories, similarly to theunmaintainedfield. Defaults toworkspacecrates, ignoringunsoundadvisories for transitive dependencies, resolving #824.v2.0.14: Release 2.0.14 - cargo-deny 0.18.6Compare Source
0.18.5
Changed
Added
--format sarif. The current output for this format is experimental and may change in future updates.0.18.6
Fixed
rustsecto 0.31, resolving #804.licenseexpression.Added
unused-license-exceptionoption to configure the lint level, resolving #806.Changed
gixto 0.75.v2.0.13: Release 2.0.13 - cargo-deny 0.18.4Compare Source
Added
--metadata-pathargument to use a cargo metadata JSON file instead of calling cargo metadata, resolving #777.sources.unused-allow-sourceto allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing #781.Changed
/is no longer corrected toOR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.Fixed
spdxto a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.v2.0.12: Release 2.0.12 - cargo-deny 0.18.3Compare Source
Changed
v2.0.11Compare Source
[0.18.2] - 2025-03-10
Added
advisories.unmaintainedconfig option. See the docs for how it can be used. The default matches the current behavior, which is to error on anyunmaintainedadvisory, but addingunmaintained = "workspace"to the[advisories]table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.[0.18.1] - 2025-02-27
Fixed
kratesto pull in the fix for EmbarkStudios/krates#100.v2.0.10Compare Source
rustup toolchain installifrustup showfailed due to any reasonv2.0.9: Release 2.0.9 - cargo-deny 0.18.0Compare Source
d8395c1removed the rustup update.v2.0.8Compare Source
v2.0.7: Release 2.0.7 - cargo-deny 0.18.0Compare Source
v2.0.6: Release 2.0.6 - cargo-deny 0.18.0Compare Source
Changed
https://github.com/rustsec/advisory-dbwill now be placed in$CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.Fixed
v2.0.5: Release 2.0.5 - cargo-deny 0.17.0Compare Source
Changed
tame-indexto 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.v2.0.4: Release 2.0.4 - cargo-deny 0.16.3Compare Source
v2.0.3: Release 2.0.3 - cargo-deny 0.16.3Compare Source
Changed
rust-versionto 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #720.Fixed
unnecessary-skipdiagnostic, emitted when there is askipconfigured for a crate that only has one version in the graph.v2.0.2: Release 2.0.2 - cargo-deny 0.16.2Compare Source
Fixed
krates-> 0.17.5, fixing an issue wherecargo-denycould panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.Added
--exclude-unpublishedCLI argument or thegraph.exclude-unpublishedconfig field. Thanks @Tastaturtaste!Changed
goblin-> 0.9.2rustsec-> 0.30.v2.0.1: Release 2.0.1 - cargo-deny 0.16.1Compare Source
Fixed
unused-workspace-dependencylint.v2.0.0: Release 2.0.0 - cargo-deny 0.16.0Compare Source
ActionAdded
Changed
v2tag, usingv1will be stable but not follow futurecargo-denyreleases.cargo-denyRemoved
[advisories]The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the
ignorefield can be used as before.vulnerability- Vulnerability advisories are nowdenyby defaultunmaintained- Unmaintained advisories are nowdenyby defaultunsound- Unsound advisories are nowdenyby defaultnotice- Notice advisories are nowdenyby defaultseverity-threshold- The severity of vulnerabilities is now irrelevant[licenses]The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either
alloworexceptions.unlicensed- Crates whose license(s) cannot be confidently determined are now always errors. Theclarifyfield can be used to help cargo-deny determine the license.allow-osi-fsf-free- The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed.copyleft- The copyleft attribute is now irrelevant, only whether it is explicitly allowed.default- The default is nowdeny.deny- All licenses are now denied by default, this field added nothing.Changed
bans.workspace-dependenciessection. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, but makes it so that if not specified workspace duplicates are nowdenyinstead ofwarn.Fixed
include-path-dependenciesfield, allowing path dependencies to be ignored if it isfalse.v2Compare Source
v1.6.3: Release 1.6.3 - cargo-deny 0.14.21Compare Source
Fixed
cfg()/tripletargets could cause features to be resolved incorrectly and thus crates to be not pulled into the graph used for checking.[0.14.20] - 2024-03-23
Fixed
gix-transport(and its unique dependencies) to 0.41.2 as a workaround forcargo installnot using the lockfile. See this issue for more information.v1.6.2: Release 1.6.2 - cargo-deny 0.14.19Compare Source
Changed
--locked.[0.14.18] - 2024-03-21
Fixed
krates.[0.14.17] - 2024-03-17
Changed
gix-> 0.60.v1.6.1Compare Source
Fixed
v1.6.0Compare Source
action changes
0.14.15
Added
infoor higher to make the diagnostic clearer by default.0.14.14
Fixed
0.14.13
Fixed
bansdiagnostic codes could not have their lint level changed via the CLI. It also introduced thedeprecateddiagnostic code.0.14.12
Changed
targets,exclude,all-features,features,no-default-features, andexcludeinto the[graph]table.feature-depthinto the[output]table.Added
advisories.db-path, which expands support beyond just~to include environment variable expansion.Fixed
tomlandserdewithtoml-span.name = "<crate_name>", version = "<requirements>"used to target specific crates into either a plain package spec string or the simplercrate = "<package spec>".reason = "<reason>"field to many fields within the configuration that are provided in diagnostics.[bans.deny]also has an additionaluse-instead = "<url/crate_name>". PR#610 did this for theadvisories.ignorefield.[advisories.ignore]array.Deprecated
[advisories]vulnerabilityunmaintainedunsoundnoticeseverity-threshold[licenses]unlicensedallow-osi-fsf-freecopyleftdefaultdenyv1.5.15: Release 1.5.15 - cargo-deny 0.14.11Compare Source
Fixed
v1.5.14: Release 1.5.14 - cargo-deny 0.14.11Compare Source
Added
manifest-pathkey as a shorthand for doingarguments: --manifest-path <path>v1.5.13: Release 1.5.13 - cargo-deny 0.14.11Compare Source
Fixed
v1.5.12: Release 1.5.12 - cargo-deny 0.14.10Compare Source
Fixed
kratesagain to pull in krates#77.v1.5.11: Release 1.5.11 - cargo-deny 0.14.9Compare Source
Fixed
kratesagain to pull in krates#75.v1.5.10: Release 1.5.10 - cargo-deny 0.14.8Compare Source
Fixed
kratesagain to pull in krates#73.v1.5.9: Release 1.5.9 - cargo-deny 0.14.7Compare Source
Fixed
kratesagain to pull in krates#71.v1.5.8: Release 1.5.8 - cargo-deny 0.14.6Compare Source
Fixed
kratesto fix an issue with crates that directly have a dependency on 2 or more versions of the same crate.Added
wrappercrate for a banned crate does not have a dependency on that crate.Changed
gixandtame-index.v1.5.7: Release 1.5.7 - cargo-deny 0.14.5Compare Source
Fixed
v1.5.6: Release 1.5.6 - cargo-deny 0.14.4Compare Source
Fixed
v1.5.5: Release 1.5.5 - cargo-deny 0.14.2Compare Source
Added
bans.buildconfiguration option, opting in to checking for file extensions, native executables, and interpreted scripts. This resolved #43.Changed
dev-dependenciesare handled. By default, crates that are only used as dev-dependencies (ie, there are no normal nor build dependency edges linking them to other crates) will no longer be considered when checking formultiple-versionsviolations. This can be re-enabled via thebans.multiple-versions-include-devconfig field. Additionally, licenses are no longer checked fordev-dependencies, but can be re-enabled vialicenses.include-devthe config field.dev-dependenciescan also be completely disabled altogether, but this applies to all checks, includingadvisoriesandsources, so is not enabled by default. This behavior can be enabled by using theexclude-devfield, or the--exclude-devcommand line flag. This change resolved #322, #329, #413 and #497.Fixed
native-certsfeature flag that can enable the OS native certificate store.Deprecated
bans.allow-build-scriptstobans.build.allow-build-scripts.bans.allow-build-scriptsis still supported, but emits a warning.v1.5.4: Release 1.5.4 - cargo-deny 0.14.0Compare Source
Updated the cargo version to 1.71.0 which should give significant improvements to run times due to using the crates.io sparse index instead of the old git index.
v1.5.3: Release 1.5.3 - cargo-deny 0.14.0Compare Source
Changed
git2andopenssl. This was done by transitioning fromgit2->gixfor all git operations, both directly in this crate, as well as replacingcrates-indexwithtame-index.1.65.0->1.70.0cargo update -p <crate_name>)" when an advisory is detected for a crate. Thanks @Victor-N-Suadicani!Fixed
git2togix.osiandfsfoptions tolicenses.allow-osi-fsf-free. Thanks @zkxs!gix's file-based locking to ensure that only one process has mutable access to an advisory database repo at a time.Removed
standalone. This is due to cargo still being in transition fromgit2->gixand having no way to compiled without OpenSSL. Once cargo is a better state with regards to this we can add back that feature.v1.5.2: Release 1.5.2 - cargo-deny 0.13.9Compare Source
Fixed
atty(unmaintained) withis-terminal. Thanks @tottoto!v1.5.1: Release 1.5.1 - cargo-deny 0.13.8Compare Source
Added
deny-multiple-versionsfield tobans.denyentries, allowing specific crates to deny multiple versions while allowing/warning on them more generally. Thanks @leops!.cargo. Thanks @DJMcNab!Fixed
v1.5.0: Release 1.5.0 - cargo-deny 0.13.7Compare Source
Update from cargo-deny 0.13.5 to 0.13.7, apparently I missed two releases, that's embarrassing.
0.13.7
Fixed
0.13.6
Changed
clap,cargo, andgit2Added
SECURITY.mdfor more details.allow-wildcard-paths, fixing #488 by allowing wildcards to be denied, but allowing them for internal, private crates. Thanks @sribich!Fixed
branch=masterwould be incorrectly categorized as not specifying the branch (ie use HEAD of default branch).v1.4.0: Release 1.4.0 - cargo-deny 0.13.5Compare Source
Changed
v1.3.2: - cargo-deny 0.12.1Compare Source
Added
credentialsparameter for passing in a private access token to allow cargo to fetch private github repositories. Thanks @danielhaap83!v1.3.1: - cargo-deny 0.12.1Compare Source
Fixed
httpsandsshURLs for advisory databases. Thanks @jbg!Changed
v1.3.0: - cargo-deny 0.12.0Compare Source
Removed
fixsubcommand. This functionality was far too complicated for far too little benefit.Fixed
gitCLI. Thanks @danielhaap83!git2, as well as removing the usage ofrustsec'sgitfeature so that we now usegit2 v0.14, resolving a crash issue in newlibgit2versions available in eg. rolling release distros such as Arch. This should also make it easier to update and improve git related functionality since more of it is inside cargo-deny itself now.v1.2.17: - cargo-deny 0.11.4Compare Source
Changed
v1.2.16: - cargo-deny 0.11.4Compare Source
Added
command-argumentsoption to the action. Thanks @ryo33!v1.2.15: - cargo-deny 0.11.3Compare Source
Fixed
v1.2.14: - cargo-deny 0.11.3Compare Source
Added
gitto the image, resolving #40v1.2.13: - cargo-deny 0.11.3Compare Source
Changed
rust-versiongithub actions variable, allowing you to specify a specific cargo version to use when running cargo-deny, including nightly, or other unstable versions.v1.2.12: - cargo-deny 0.11.3Compare Source
Fixed
v1.2.11Compare Source
v1.2.10: - cargo-deny 0.11.1Compare Source
Added
[licenses.ignore-sources]to ignore license checking for crates sourced from 1 or more specified registries. Thanks @ShellWowza!.deny.tomlin addition todeny.tomlif a config file is not specified.Changed
Fixed
*.[bans.skip-tree].v1.2.9: - cargo-deny 0.11.0Compare Source
Fixed image to use proper tag.
v1.2.8: - cargo-deny 0.11.0Compare Source
Updated the cargo version in the image to 1.57.0 to allow for the use of custom profiles.
v1.2.7: v1.2.6 - cargo-deny 0.11.0Compare Source
[0.11.0] - 2021-12-06
Changed
[0.10.3] - 2021-11-22
Changed
askalonowhich got rid of thefailuredependency, which was pulling in a lot of additional crates that are now gone.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.