Release notes from cargo-deny-action

Release 2.0.4 - cargo-deny 0.16.3

2024-12-03T22:49:57Z

Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes

v2

2024-12-03T22:48:32Z

Release 2.0.4 - cargo-deny 0.16.3

Release 2.0.3 - cargo-deny 0.16.3

2024-11-28T13:37:02Z

Changed

PR#721 updated rust-version to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #720.
PR#722 updated the SPDX license list to 3.25.0.

Fixed

PR#726 resolved #725 by adding the unnecessary-skip diagnostic, emitted when there is a skip configured for a crate that only has one version in the graph.

Release 2.0.2 - cargo-deny 0.16.2

2024-11-21T08:27:51Z

Fixed

PR#703 resolved #696 by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in PR#611.
PR#719 updated to krates -> 0.17.5, fixing an issue where cargo-deny could panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.
PR#719 resolved #706 by removing a warning issued when users use ignored scheme modifiers for source urls.
PR#719 resolved #718 by updating the book with missing arguments.

Added

PR#715 resolved #714 by adding support for Edition 2024. Thanks @kpcyrd!
PR#710 resolved #708 by allowing for unpublished workspace crates to be excluded from the dependency graph that checks are run against, either via the --exclude-unpublished CLI argument or the graph.exclude-unpublished config field. Thanks @Tastaturtaste!

Changed

PR#711 updated goblin -> 0.9.2
PR#713 updated various crates, notably rustsec -> 0.30.

Release 2.0.1 - cargo-deny 0.16.1

2024-08-05T11:18:03Z

Fixed

PR#691 fixed an issue where workspace dependencies that used the current dir '.' path component would incorrectly trigger the unused-workspace-dependency lint.

Release 2.0.0 - cargo-deny 0.16.0

2024-08-02T12:38:26Z

`Action`

Added

PR#78 added SSH support, thanks @nagua!

Changed

This release includes breaking changes in cargo-deny, so this release begins the v2 tag, using v1 will be stable but not follow future cargo-deny releases.

`cargo-deny`

Removed

PR#681 finished the deprecation introduced in PR#611, making the usage of the deprecated fields into errors.

`[advisories]`

The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the ignore field can be used as before.

vulnerability - Vulnerability advisories are now deny by default
unmaintained - Unmaintained advisories are now deny by default
unsound - Unsound advisories are now deny by default
notice - Notice advisories are now deny by default
severity-threshold - The severity of vulnerabilities is now irrelevant

`[licenses]`

The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either allow or exceptions.

unlicensed - Crates whose license(s) cannot be confidently determined are now always errors. The clarify field can be used to help cargo-deny determine the license.
allow-osi-fsf-free - The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed.
copyleft - The copyleft attribute is now irrelevant, only whether it is explicitly allowed.
default - The default is now deny.
deny - All licenses are now denied by default, this field added nothing.

Changed

PR#685 follows up on PR#673, moving the fields that were added to their own separate bans.workspace-dependencies section. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, but makes it so that if not specified workspace duplicates are now deny instead of warn.

Fixed

PR#685 resolved #682 by adding the include-path-dependencies field, allowing path dependencies to be ignored if it is false.

v1

2024-08-02T12:31:37Z

Release 1.6.3 - cargo-deny 0.14.21

2024-04-22T15:17:00Z

Fixed

PR#643 resolved #629 by making the hosted git (github, gitlab, bitbucket) org/user name comparison case-insensitive. Thanks @pmnlla!
PR#649 fixed an issue where depending on the same crate multiple times by using different cfg()/triple targets could cause features to be resolved incorrectly and thus crates to be not pulled into the graph used for checking.

[0.14.20] - 2024-03-23

Fixed

PR#642 resolved #641 by pinning gix-transport (and its unique dependencies) to 0.41.2 as a workaround for cargo install not using the lockfile. See this issue for more information.

Release 1.6.2 - cargo-deny 0.14.19

2024-03-22T09:42:40Z

Changed

PR#639 updated tame-index to avoid an error if you don't used --locked.

[0.14.18] - 2024-03-21

Fixed

PR#638 resolved #636 by updating krates.

[0.14.17] - 2024-03-17

Changed

PR#631 improved the diagnostic for when the yank check fails due to some issue with retrieving or reading the index information.
PR#633 updated gix -> 0.60.

v1.6.1

2024-03-06T10:31:03Z

Fixed

PR#626 resolved #625 by explicitly checking that a license identified as Pixar was actually (probably) the Pixar license, instead of a normal Apache-2.0 license.