diff --git a/Cargo.lock b/Cargo.lock
index ee251fe03..aeb714162 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -248,6 +248,7 @@ dependencies = [
  "askalono",
  "bitvec",
  "camino",
+ "cfg-expr",
  "clap",
  "codespan",
  "codespan-reporting",
@@ -261,6 +262,7 @@ dependencies = [
  "insta",
  "krates",
  "log",
+ "memchr",
  "nu-ansi-term",
  "parking_lot",
  "rayon",
@@ -294,29 +296,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "cargo-platform"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "cargo_metadata"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
-dependencies = [
- "camino",
- "cargo-platform",
- "semver",
- "serde",
- "serde_json",
- "thiserror",
-]
-
 [[package]]
 name = "cc"
 version = "1.0.98"
@@ -1783,15 +1762,16 @@ dependencies = [
 
 [[package]]
 name = "krates"
-version = "0.16.10"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcb3baf2360eb25ad31f0ada3add63927ada6db457791979b82ac199f835cb9"
+checksum = "9d0956eb8f64d0353d56c69544657bbf3bc143c3c0f0883cc4fa9ec1b252a404"
 dependencies = [
- "cargo-platform",
- "cargo_metadata",
+ "camino",
  "cfg-expr",
  "petgraph",
  "semver",
+ "serde",
+ "serde_json",
 ]
 
 [[package]]
@@ -2652,9 +2632,9 @@ dependencies = [
 
 [[package]]
 name = "tame-index"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418b7a56dbbf693afbf024c12f90863ac25894fd209d374d4af39cf9e43da36c"
+checksum = "e9632d46ad4e0c6a07d4354fc43c6eae4654a09beef8e9e7c7c899f983185c45"
 dependencies = [
  "bytes",
  "camino",
@@ -2832,9 +2812,9 @@ dependencies = [
 
 [[package]]
 name = "toml-span"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "369db38ce6d1fc320a54ea3f032d07c07a232ca19c40e287246aff06d57c2abe"
+checksum = "ce0e1be49e3b9bf33d1a8077c081a3b7afcfc94e4bc1002c80376784381bc106"
 dependencies = [
  "codespan-reporting",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index a2db36b99..0b5545c0e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -50,6 +50,7 @@ askalono = { version = "0.4", default-features = false }
 bitvec = { version = "1.0", features = ["alloc"] }
 # Much nicer paths
 camino = "1.1"
+cfg-expr = "0.15"
 # Allows us to do eg cargo metadata operations without relying on an external cargo
 #cargo = { version = "0.71", optional = true }
 # Argument parsing, kept aligned with cargo
@@ -75,9 +76,11 @@ goblin = { version = "0.8", default-features = false, features = [
 # We need to figure out HOME/CARGO_HOME in some cases
 home = "0.5"
 # Provides graphs on top of cargo_metadata
-krates = { version = "0.16", features = ["targets"] }
+krates = { version = "0.17", features = ["targets"] }
 # Log macros
 log = "0.4"
+# Faster char searching
+memchr = "2.7"
 # Nicer sync primitives
 parking_lot = "0.12"
 # Moar brrrr
@@ -112,7 +115,7 @@ time = { version = "0.3", default-features = false, features = [
   "macros",
 ] }
 # Deserialization of configuration files and crate manifests
-toml-span = { version = "0.2", features = ["reporting"] }
+toml-span = { version = "0.3", features = ["reporting"] }
 # Small fast hash crate
 twox-hash = { version = "1.5", default-features = false }
 # Url parsing/manipulation
@@ -138,7 +141,7 @@ fs_extra = "1.3"
 insta = { version = "1.21", features = ["json"] }
 tame-index = { version = "0.12", features = ["local-builder"] }
 time = { version = "0.3", features = ["serde"] }
-toml-span = { version = "0.2", features = ["serde"] }
+toml-span = { version = "0.3", features = ["serde"] }
 # We use this for creating fake crate directories for crawling license files on disk
 tempfile = "3.1.0"
 # divan = "0.1"
diff --git a/clippy.toml b/clippy.toml
index da6189cb6..278890147 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -17,3 +17,10 @@ disallowed-types = [
 
     { path = "ring::digest::SHA1_FOR_LEGACY_USE_ONLY", reason = "SHA-1 is cryptographically broken, and we are building new code so should not use it" },
 ]
+disallowed-macros = [
+    "std::print",
+    "std::println",
+    "std::eprint",
+    "std::eprintln",
+    "std::dbg",
+]
diff --git a/examples/06_advisories/Cargo.lock b/examples/06_advisories/Cargo.lock
index fcbc74cac..59b39d43b 100644
--- a/examples/06_advisories/Cargo.lock
+++ b/examples/06_advisories/Cargo.lock
@@ -24,10 +24,10 @@ dependencies = [
  "ammonia 0.7.0",
  "artifact_serde",
  "axum-core",
- "const-cstr",
  "dirs",
  "failure",
  "lettre",
+ "static_type_map",
  "trust-dns-resolver",
 ]
 
@@ -191,12 +191,6 @@ dependencies = [
  "bitflags",
 ]
 
-[[package]]
-name = "const-cstr"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed3d0b5ff30645a68f35ece8cea4556ca14ef8a1651455f789a099a0513532a6"
-
 [[package]]
 name = "core-foundation"
 version = "0.9.1"
@@ -1347,6 +1341,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "static_type_map"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f41d6352756e5e8bfb4dc0ad306fa62f41876dc2229d83669415fb4f56e34732"
+
 [[package]]
 name = "string_cache"
 version = "0.6.2"
diff --git a/examples/06_advisories/Cargo.toml b/examples/06_advisories/Cargo.toml
index 3ab03da89..3e791b1f4 100644
--- a/examples/06_advisories/Cargo.toml
+++ b/examples/06_advisories/Cargo.toml
@@ -24,9 +24,9 @@ dirs = "4.0"
 # Failure has an unsound advisory (and is unmaintained)
 failure = "=0.1.8"
 
-# const-cstr is unmaintained
-# https://github.com/rustsec/advisory-db/blob/463e8405f85bb74eef17149f7e704b07723ce46e/crates/const-cstr/RUSTSEC-2023-0020.md
-const-cstr = "0.3"
+# atty is unmaintained
+# https://github.com/rustsec/advisory-db/blob/8eb99abe8c369b48bbd4ca04133e1f05be22a778/crates/static_type_map/RUSTSEC-2022-0023.md
+static_type_map = "0.3"
 
 # The advisory applies to 0.10.0-alpha.1 >= && < 0.10.0-alpha.4
 # https://github.com/RustSec/advisory-db/blob/c71cfec8c3fe313c9445a9ab0ae9b7faedda850a/crates/lettre/RUSTSEC-2020-0069.md
diff --git a/src/advisories.rs b/src/advisories.rs
index 16a66d7ec..eb62c2f51 100644
--- a/src/advisories.rs
+++ b/src/advisories.rs
@@ -74,10 +74,9 @@ pub fn check<R, S>(
     let mut ignore_yanked_hits: BitVec = BitVec::repeat(false, ctx.cfg.ignore_yanked.len());
 
     // Emit diagnostics for any advisories found that matched crates in the graph
-    for (krate, krate_index, advisory) in &report.advisories {
+    for (krate, advisory) in &report.advisories {
         let diag = ctx.diag_for_advisory(
             krate,
-            *krate_index,
             &advisory.metadata,
             Some(&advisory.versions),
             |index| {
@@ -89,14 +88,9 @@ pub fn check<R, S>(
     }
 
     for (krate, status) in yanked {
-        let Some(ind) = ctx.krates.nid_for_kid(&krate.id) else {
-            log::warn!("failed to locate node id for '{krate}'");
-            continue;
-        };
-
         if let Some(e) = status {
             if ctx.cfg.yanked.value != LintLevel::Allow {
-                sink.push(ctx.diag_for_index_failure(krate, ind, e));
+                sink.push(ctx.diag_for_index_failure(krate, e));
             }
         } else {
             // Check to see if the user has added an ignore for the yanked
@@ -113,7 +107,7 @@ pub fn check<R, S>(
                 sink.push(ctx.diag_for_yanked_ignore(krate, i));
                 ignore_yanked_hits.as_mut_bitslice().set(i, true);
             } else {
-                sink.push(ctx.diag_for_yanked(krate, ind));
+                sink.push(ctx.diag_for_yanked(krate));
             }
         }
     }
diff --git a/src/advisories/cfg.rs b/src/advisories/cfg.rs
index 084d7fb7e..1439ccfbf 100644
--- a/src/advisories/cfg.rs
+++ b/src/advisories/cfg.rs
@@ -198,7 +198,7 @@ impl<'de> Deserialize<'de> for Config {
                                 v.set(ValueInner::String(s));
                             }
                             ValueInner::Table(tab) => {
-                                if tab.contains_key(&"id".into()) {
+                                if tab.contains_key("id") {
                                     v.set(ValueInner::Table(tab));
                                     match IgnoreId::deserialize(&mut v) {
                                         Ok(iid) => u.push(Spanned::with_span(iid, v.span)),
@@ -994,7 +994,7 @@ expansions = [
         let toml_span::value::ValueInner::Table(mut tab) = tv.take() else {
             unreachable!()
         };
-        let mut expansions = tab.remove(&"expansions".into()).unwrap();
+        let mut expansions = tab.remove("expansions").unwrap();
         let toml_span::value::ValueInner::Array(exp) = expansions.take() else {
             unreachable!()
         };
@@ -1002,7 +1002,7 @@ expansions = [
         use toml_span::Deserialize as _;
 
         let mut files = crate::diag::Files::new();
-        let cfg_id = files.add("expansions.toml", toml.into());
+        let cfg_id = files.add("expansions.toml", toml);
 
         let mut output = String::new();
 
diff --git a/src/advisories/diags.rs b/src/advisories/diags.rs
index ac1aaccff..72f5624b2 100644
--- a/src/advisories/diags.rs
+++ b/src/advisories/diags.rs
@@ -70,7 +70,6 @@ impl<'a> crate::CheckCtx<'a, super::cfg::ValidConfig> {
     pub(crate) fn diag_for_advisory<F>(
         &self,
         krate: &crate::Krate,
-        krate_index: krates::NodeId,
         advisory: &Metadata,
         versions: Option<&Versions>,
         mut on_ignore: F,
@@ -179,9 +178,11 @@ impl<'a> crate::CheckCtx<'a, super::cfg::ValidConfig> {
         let diag = pack.push(
             Diagnostic::new(severity)
                 .with_message(advisory.title.clone())
-                .with_labels(vec![self
-                    .krate_spans
-                    .label_for_index(krate_index.index(), message)])
+                .with_labels(vec![Label::primary(
+                    self.krate_spans.lock_id,
+                    self.krate_spans.lock_span(&krate.id).total,
+                )
+                .with_message(message)])
                 .with_code(code)
                 .with_notes(notes),
         );
@@ -193,11 +194,7 @@ impl<'a> crate::CheckCtx<'a, super::cfg::ValidConfig> {
         pack
     }
 
-    pub(crate) fn diag_for_yanked(
-        &self,
-        krate: &crate::Krate,
-        krate_index: krates::NodeId,
-    ) -> Pack {
+    pub(crate) fn diag_for_yanked(&self, krate: &crate::Krate) -> Pack {
         let mut pack = Pack::with_kid(Check::Advisories, krate.id.clone());
         pack.push(
             Diagnostic::new(self.cfg.yanked.value.into())
@@ -206,9 +203,11 @@ impl<'a> crate::CheckCtx<'a, super::cfg::ValidConfig> {
                     krate.name
                 ))
                 .with_code(Code::Yanked)
-                .with_labels(vec![self
-                    .krate_spans
-                    .label_for_index(krate_index.index(), "yanked version")]),
+                .with_labels(vec![Label::primary(
+                    self.krate_spans.lock_id,
+                    self.krate_spans.lock_span(&krate.id).total,
+                )
+                .with_message("yanked version")]),
         );
 
         pack
@@ -229,13 +228,13 @@ impl<'a> crate::CheckCtx<'a, super::cfg::ValidConfig> {
     pub(crate) fn diag_for_index_failure<D: std::fmt::Display>(
         &self,
         krate: &crate::Krate,
-        krate_index: krates::NodeId,
         error: D,
     ) -> Pack {
-        let mut labels = vec![self.krate_spans.label_for_index(
-            krate_index.index(),
-            "crate whose registry we failed to query",
-        )];
+        let mut labels = vec![Label::secondary(
+            self.krate_spans.lock_id,
+            self.krate_spans.lock_span(&krate.id).total,
+        )
+        .with_message("crate whose registry we failed to query")];
 
         // Don't show the config location if it's the default, since it just points
         // to the beginning and confuses users
diff --git a/src/advisories/helpers/db.rs b/src/advisories/helpers/db.rs
index 5a3b433d7..b6cf5e764 100644
--- a/src/advisories/helpers/db.rs
+++ b/src/advisories/helpers/db.rs
@@ -530,7 +530,7 @@ fn fetch_via_cli(url: &str, db_path: &Path) -> anyhow::Result<()> {
 }
 
 pub struct Report<'db, 'k> {
-    pub advisories: Vec<(&'k Krate, krates::NodeId, &'db rustsec::Advisory)>,
+    pub advisories: Vec<(&'k Krate, &'db rustsec::Advisory)>,
     /// For backwards compatibility with cargo-audit, we optionally serialize the
     /// reports to JSON and output them in addition to the normal cargo-deny
     /// diagnostics
@@ -599,7 +599,7 @@ impl<'db, 'k> Report<'db, 'k> {
                                 return None;
                             }
 
-                            Some((km.krate, km.node_id, advisory))
+                            Some((km.krate, advisory))
                         })
                 })
                 .collect();
@@ -608,7 +608,7 @@ impl<'db, 'k> Report<'db, 'k> {
                 let mut warnings = std::collections::BTreeMap::<_, Vec<rustsec::Warning>>::new();
                 let mut vulns = Vec::new();
 
-                for (krate, _nid, advisory) in &db_advisories {
+                for (krate, advisory) in &db_advisories {
                     let package = rustsec::package::Package {
                         // :(
                         name: krate.name.parse().unwrap(),
@@ -687,7 +687,7 @@ impl<'db, 'k> Report<'db, 'k> {
             advisories.append(&mut db_advisories);
         }
 
-        advisories.sort_by(|a, b| a.1.cmp(&b.1));
+        advisories.sort_by(|a, b| a.0.cmp(b.0));
 
         Self {
             advisories,
diff --git a/src/advisories/helpers/index.rs b/src/advisories/helpers/index.rs
index 8490f18a1..e73128064 100644
--- a/src/advisories/helpers/index.rs
+++ b/src/advisories/helpers/index.rs
@@ -12,13 +12,13 @@ pub enum Entry {
 }
 
 pub struct Indices<'k> {
-    pub indices: Vec<(&'k Source, Result<ComboIndexCache, Error>)>,
+    pub indices: Vec<(&'k Source, Result<Option<ComboIndexCache>, Error>)>,
     pub cache: BTreeMap<(&'k str, &'k Source), Entry>,
 }
 
 impl<'k> Indices<'k> {
     pub fn load(krates: &'k Krates, cargo_home: crate::PathBuf) -> Self {
-        let mut indices = Vec::<(&Source, Result<ComboIndexCache, Error>)>::new();
+        let mut indices = Vec::<(&Source, Result<Option<ComboIndexCache>, Error>)>::new();
 
         for source in krates
             .krates()
@@ -39,7 +39,12 @@ impl<'k> Indices<'k> {
             };
 
             let index = index_url.and_then(|iu| {
+                // // If the registry has been replaced with a local registry just ignore it
+                // if matches!(&iu, IndexUrl::Local(_)) {
+                //     return Ok(None);
+                // };
                 ComboIndexCache::new(IndexLocation::new(iu).with_root(Some(cargo_home.clone())))
+                    .map(Some)
             });
 
             indices.push((source, index));
@@ -82,7 +87,7 @@ impl<'k> Indices<'k> {
                         .find_map(|(url, index)| (src == *url).then_some(index))
                         .ok_or_else(|| "unable to locate index".to_owned())?
                     {
-                        Ok(index) => {
+                        Ok(Some(index)) => {
                             match index.cached_krate(
                                 name.try_into()
                                     .map_err(|e: tame_index::Error| e.to_string())?,
@@ -98,6 +103,9 @@ impl<'k> Indices<'k> {
                                 Err(err) => Entry::Error(format!("{err:#}")),
                             }
                         }
+                        Ok(None) => {
+                            Entry::Error("unable to locate index entry for crate".to_owned())
+                        }
                         Err(err) => Entry::Error(format!("{err:#}")),
                     };
 
diff --git a/src/advisories/snapshots/cargo_deny__advisories__cfg__test__deserializes_advisories_cfg-2.snap b/src/advisories/snapshots/cargo_deny__advisories__cfg__test__deserializes_advisories_cfg-2.snap
index 34ba38944..24682268f 100644
--- a/src/advisories/snapshots/cargo_deny__advisories__cfg__test__deserializes_advisories_cfg-2.snap
+++ b/src/advisories/snapshots/cargo_deny__advisories__cfg__test__deserializes_advisories_cfg-2.snap
@@ -3,7 +3,7 @@ source: src/advisories/cfg.rs
 expression: validated
 ---
 {
-  "file_id": 1,
+  "file_id": 0,
   "db_path": "/home/you/.cargo/advisory-dbs",
   "db_urls": [
     "https://github.com/RustSec/advisory-db"
diff --git a/src/bans.rs b/src/bans.rs
index 14748865a..6abb385a9 100644
--- a/src/bans.rs
+++ b/src/bans.rs
@@ -192,7 +192,6 @@ use crate::diag::{Check, Diag, Pack, Severity};
 pub fn check(
     ctx: crate::CheckCtx<'_, ValidConfig>,
     output_graph: Option<Box<OutputGraph>>,
-    cargo_spans: diag::CargoSpans,
     sink: impl Into<diag::ErrorSink>,
 ) {
     let ValidConfig {
@@ -206,6 +205,8 @@ pub fn check(
         skipped,
         multiple_versions,
         multiple_versions_include_dev,
+        workspace_duplicates,
+        unused_workspace_dependencies,
         highlight,
         tree_skipped,
         wildcards,
@@ -409,18 +410,12 @@ pub fn check(
         let mut kids = smallvec::SmallVec::<[Dupe; 2]>::new();
 
         for dup in multi_detector.dupes.iter().cloned() {
-            let span = &ctx.krate_spans[dup].total;
-
-            if span.start < all_start {
-                all_start = span.start;
-            }
-
-            if span.end > all_end {
-                all_end = span.end;
-            }
-
             let krate = &ctx.krates[dup];
 
+            let span = &ctx.krate_spans.lock_span(&krate.id).total;
+            all_start = all_start.min(span.start);
+            all_end = all_end.max(span.end);
+
             if let Err(i) = kids.binary_search_by(|other| match other.version.cmp(&krate.version) {
                 std::cmp::Ordering::Equal => other.id.cmp(&krate.id),
                 ord => ord,
@@ -440,7 +435,7 @@ pub fn check(
                 krate_name: multi_detector.name,
                 num_dupes: kids.len(),
                 krates_coord: KrateCoord {
-                    file: krate_spans.file_id,
+                    file: krate_spans.lock_id,
                     span: (all_start..all_end).into(),
                 },
                 severity,
@@ -502,7 +497,7 @@ pub fn check(
         }
     }
 
-    let (mut tx, rx) = if let Some(bc) = build {
+    let (mut tx, build_config) = if let Some(bc) = build {
         let (tx, rx) = crossbeam::channel::unbounded();
 
         (Sink::Build(tx), Some((bc, rx)))
@@ -510,8 +505,49 @@ pub fn check(
         (Sink::NoBuild(sink.clone()), None)
     };
 
-    let (_, build_packs) = rayon::join(
-        || {
+    struct BuildCheckCtx {
+        bypasses: parking_lot::Mutex<BitVec>,
+        diag_packs: parking_lot::Mutex<std::collections::BTreeMap<usize, Pack>>,
+        cargo_home: Option<crate::PathBuf>,
+        build_config: ValidBuildConfig,
+    }
+
+    let build_check_ctx = build_config.map(|(build_config, rx)| {
+        // Make all paths reported in build diagnostics be relative to cargo_home
+        let cargo_home = home::cargo_home()
+            .map_err(|err| {
+                log::error!("unable to locate $CARGO_HOME: {err}");
+                err
+            })
+            .ok()
+            .and_then(|pb| {
+                crate::PathBuf::from_path_buf(pb)
+                    .map_err(|pb| {
+                        log::error!("$CARGO_HOME path '{}' is not utf-8", pb.display());
+                    })
+                    .ok()
+            });
+
+        // Keep track of the individual crate configs so we can emit warnings
+        // if they're configured but not actually used
+        let bypasses =
+            parking_lot::Mutex::<BitVec>::new(BitVec::repeat(false, build_config.bypass.len()));
+
+        (
+            BuildCheckCtx {
+                cargo_home,
+                bypasses,
+                diag_packs: parking_lot::Mutex::new(std::collections::BTreeMap::new()),
+                build_config,
+            },
+            rx,
+        )
+    });
+
+    let mut ws_duplicate_packs = Vec::new();
+
+    rayon::scope(|scope| {
+        scope.spawn(|_| {
             let last = ctx.krates.len() - 1;
 
             for (i, krate) in ctx.krates.krates().enumerate() {
@@ -836,42 +872,87 @@ pub fn check(
 
                         multi_detector.dupes.push(i);
 
-                        if wildcards != LintLevel::Allow && !krate.is_git_source() {
-                            let severity = match wildcards {
-                                LintLevel::Warn => Severity::Warning,
-                                LintLevel::Deny => Severity::Error,
-                                LintLevel::Allow => unreachable!(),
-                            };
+                        'wildcards: {
+                            if wildcards != LintLevel::Allow && !krate.is_git_source() {
+                                let severity = match wildcards {
+                                    LintLevel::Warn => Severity::Warning,
+                                    LintLevel::Deny => Severity::Error,
+                                    LintLevel::Allow => unreachable!(),
+                                };
+
+                                let Some(manifest) = ctx.krate_spans.manifest(&krate.id) else {
+                                    break 'wildcards;
+                                };
+                                let is_private = krate.is_private(&[]);
+                                let mut labels = Vec::new();
+                                let mut pack = Pack::with_kid(Check::Bans, krate.id.clone());
 
-                            let mut wildcards: Vec<_> = krate
-                                .deps
-                                .iter()
-                                .filter(|dep| dep.req == VersionReq::STAR)
-                                .collect();
+                                for mdep in manifest.deps(false) {
+                                    if mdep.dep.req != VersionReq::STAR {
+                                        continue;
+                                    }
 
-                            if allow_wildcard_paths {
-                                let is_private = krate.is_private(&[]);
+                                    // Wildcards are allowed for path or git dependencies, if the krate
+                                    // is private, or it's only a dev-dependency
+                                    if allow_wildcard_paths
+                                        && !mdep.krate.is_registry()
+                                        && (is_private
+                                            || mdep.dep.kind == DependencyKind::Development)
+                                    {
+                                        continue;
+                                    }
 
-                                wildcards.retain(|dep| {
-                                    let is_path_or_git = is_path_or_git_dependency(dep);
-                                    if is_private {
-                                        !is_path_or_git
-                                    } else {
-                                        let is_path_non_dev_dependency = is_path_or_git
-                                            && dep.kind != DependencyKind::Development;
-                                        is_path_non_dev_dependency || !is_path_or_git
+                                    labels.push(
+                                        crate::diag::Label::primary(
+                                            manifest.id,
+                                            mdep.version_req
+                                                .as_ref()
+                                                .map_or(mdep.value_span, |vr| vr.span),
+                                        )
+                                        .with_message("wildcard dependency"),
+                                    );
+
+                                    // If the dependency is a workspace dependency we also want to show
+                                    // the bad version requirement for the workspace declaration
+                                    if let Some(workspace) = &mdep.workspace {
+                                        if !workspace.value {
+                                            continue;
+                                        }
+
+                                        if let Some(ws_dep) =
+                                            ctx.krate_spans.workspace_span(&krate.id)
+                                        {
+                                            labels.push(
+                                                crate::diag::Label::secondary(
+                                                    ctx.krate_spans.workspace_id.unwrap(),
+                                                    ws_dep
+                                                        .version
+                                                        .as_ref()
+                                                        .map_or(ws_dep.value, |vr| vr.span),
+                                                )
+                                                .with_message("workspace dependency"),
+                                            );
+                                        } else {
+                                            // This indicates a bug because we were unable to resolve the workspace dependency
+                                            // to an appropriate crate, even though cargo did
+                                            pack.push(diags::UnresolveWorkspaceDependency {
+                                                manifest,
+                                                dep: mdep,
+                                            });
+                                        }
                                     }
-                                });
-                            }
+                                }
 
-                            if !wildcards.is_empty() {
-                                sink.push(diags::Wildcards {
-                                    krate,
-                                    severity,
-                                    wildcards,
-                                    allow_wildcard_paths,
-                                    cargo_spans: &cargo_spans,
-                                });
+                                sink.push(pack);
+
+                                if !labels.is_empty() {
+                                    sink.push(diags::Wildcards {
+                                        krate,
+                                        severity,
+                                        labels,
+                                        allow_wildcard_paths,
+                                    });
+                                }
                             }
                         }
                     }
@@ -885,82 +966,82 @@ pub fn check(
             }
 
             drop(tx);
-        },
-        || {
-            let (build_config, rx) = rx?;
-
-            // Keep track of the individual crate configs so we can emit warnings
-            // if they're configured but not actually used
-            let bcv =
-                parking_lot::Mutex::<BitVec>::new(BitVec::repeat(false, build_config.bypass.len()));
+        });
 
-            // Make all paths reported in build diagnostics be relative to cargo_home
+        scope.spawn(|scope| {
+            let Some((build_ctx, rx)) = &build_check_ctx else {
+                return;
+            };
+            while let Ok((index, krate, mut pack)) = rx.recv() {
+                scope.spawn(move |_s| {
+                    if let Some(bcc) = check_build(
+                        ctx.cfg.file_id,
+                        &build_ctx.build_config,
+                        build_ctx.cargo_home.as_deref(),
+                        krate,
+                        ctx.krates,
+                        &mut pack,
+                    ) {
+                        build_ctx.bypasses.lock().set(bcc, true);
+                    }
 
-            let cargo_home = home::cargo_home()
-                .map_err(|err| {
-                    log::error!("unable to locate $CARGO_HOME: {err}");
-                    err
-                })
-                .ok()
-                .and_then(|pb| {
-                    crate::PathBuf::from_path_buf(pb)
-                        .map_err(|pb| {
-                            log::error!("$CARGO_HOME path '{}' is not utf-8", pb.display());
-                        })
-                        .ok()
+                    if !pack.is_empty() {
+                        build_ctx.diag_packs.lock().insert(index, pack);
+                    }
                 });
+            }
+        });
 
-            let pq = parking_lot::Mutex::new(std::collections::BTreeMap::new());
-            rayon::scope(|s| {
-                let bc = &build_config;
-                let pq = &pq;
-                let bcv = &bcv;
-                let home = cargo_home.as_deref();
-
-                while let Ok((index, krate, mut pack)) = rx.recv() {
-                    s.spawn(move |_s| {
-                        if let Some(bcc) =
-                            check_build(ctx.cfg.file_id, bc, home, krate, ctx.krates, &mut pack)
-                        {
-                            bcv.lock().set(bcc, true);
-                        }
-
-                        if !pack.is_empty() {
-                            pq.lock().insert(index, pack);
-                        }
-                    });
-                }
+        // Check the workspace to detect dependencies that are used more than once
+        // but don't use a shared [workspace.[dev-/build-]dependencies] declaration
+        if workspace_duplicates != LintLevel::Allow {
+            scope.spawn(|_| {
+                check_workspace_duplicates(
+                    ctx.krates,
+                    ctx.krate_spans,
+                    workspace_duplicates,
+                    &mut ws_duplicate_packs,
+                );
             });
+        }
+    });
 
-            let unmatched_exe_configs = {
-                let mut pack = Pack::new(Check::Bans);
+    if let Some((bcc, _)) = build_check_ctx {
+        for bp in bcc.diag_packs.into_inner().into_values() {
+            sink.push(bp);
+        }
 
-                for ve in bcv
-                    .into_inner()
-                    .into_iter()
-                    .zip(build_config.bypass.into_iter())
-                    .filter_map(|(hit, ve)| if !hit { Some(ve) } else { None })
-                {
-                    pack.push(diags::UnmatchedBypass {
-                        unmatched: &ve,
-                        file_id,
-                    });
-                }
+        let mut pack = Pack::new(Check::Bans);
+        for ve in bcc
+            .bypasses
+            .into_inner()
+            .into_iter()
+            .zip(bcc.build_config.bypass.into_iter())
+            .filter_map(|(hit, ve)| if !hit { Some(ve) } else { None })
+        {
+            pack.push(diags::UnmatchedBypass {
+                unmatched: &ve,
+                file_id,
+            });
+        }
 
-                pack
-            };
+        sink.push(pack);
+    }
 
-            Some(
-                pq.into_inner()
-                    .into_values()
-                    .chain(Some(unmatched_exe_configs)),
-            )
-        },
-    );
+    for pack in ws_duplicate_packs {
+        sink.push(pack);
+    }
 
-    if let Some(bps) = build_packs {
-        for bp in bps {
-            sink.push(bp);
+    if unused_workspace_dependencies != LintLevel::Allow {
+        if let Some(id) = krate_spans
+            .workspace_id
+            .filter(|_id| !krate_spans.unused_workspace_deps.is_empty())
+        {
+            sink.push(diags::UnusedWorkspaceDependencies {
+                id,
+                unused: &krate_spans.unused_workspace_deps,
+                level: unused_workspace_dependencies,
+            });
         }
     }
 
@@ -999,11 +1080,13 @@ pub fn check_build(
     krates: &Krates,
     pack: &mut Pack,
 ) -> Option<usize> {
+    use krates::cm::TargetKind;
+
     let build_script_allowed = if let Some(allow_build_scripts) = &config.allow_build_scripts {
         let has_build_script = krate
             .targets
             .iter()
-            .any(|t| t.kind.iter().any(|k| *k == "custom-build"));
+            .any(|t| t.kind.iter().any(|k| *k == TargetKind::CustomBuild));
 
         !has_build_script
             || allow_build_scripts
@@ -1022,7 +1105,7 @@ pub fn check_build(
         krate.targets.iter().any(|t| {
             t.kind
                 .iter()
-                .any(|k| *k == "custom-build" || *k == "proc-macro")
+                .any(|k| matches!(*k, TargetKind::CustomBuild | TargetKind::ProcMacro))
         })
     }
 
@@ -1475,14 +1558,131 @@ fn validate_file_checksum(path: &crate::Path, expected: &cfg::Checksum) -> anyho
     Ok(())
 }
 
-/// Returns true if the dependency has a `path` or `git` source.
-///
-/// TODO: Possibly what we actually care about, where this is used in the wildcard check, is
-/// “is not using any registry source”.
-fn is_path_or_git_dependency(dep: &krates::cm::Dependency) -> bool {
-    dep.path.is_some()
-        || dep
-            .source
-            .as_ref()
-            .is_some_and(|url| url.starts_with("git+"))
+fn check_workspace_duplicates(
+    krates: &Krates,
+    krate_spans: &crate::diag::KrateSpans<'_>,
+    severity: LintLevel,
+    diags: &mut Vec<Pack>,
+) {
+    use crate::diag::Label;
+
+    // Note this will ignore cases where a dependency is used as more than 1 kind etc,
+    // but this check is not really meant for such simple cases
+    if krates.workspace_members().count() <= 1 {
+        return;
+    }
+
+    // Gather any direct dependencies that are declared more than once
+    let mut deps = std::collections::BTreeMap::<
+        _,
+        Vec<(
+            &crate::diag::ManifestDep<'_>,
+            &crate::Krate,
+            crate::diag::FileId,
+        )>,
+    >::new();
+
+    for wsm in krates.workspace_members() {
+        let krates::Node::Krate { id, krate, .. } = wsm else {
+            continue; /* unreachable */
+        };
+
+        let Some(man) = krate_spans.manifest(id) else {
+            continue;
+        };
+
+        for mdep in man.deps(true) {
+            deps.entry(&mdep.krate.id)
+                .or_default()
+                .push((mdep, krate, man.id));
+        }
+    }
+
+    // Strip out any direct dependencies that aren't referenced multiple times in the workspace
+    // Note this will retain in cases where the dependency is only used
+    // by 1 crate, but as different dependency kinds, which is still useful
+    // to catch
+    deps.retain(|_, parents| parents.len() > 1);
+
+    for (kid, parents) in deps {
+        let total = parents.len();
+        let mut labels = Vec::new();
+
+        if let Some((ws_span, ws_id)) = krate_spans
+            .workspace_span(kid)
+            .zip(krate_spans.workspace_id)
+        {
+            labels.push(Label::primary(ws_id, ws_span.key).with_message(format!(
+                "{}workspace dependency",
+                if ws_span.patched.is_some() {
+                    "patched "
+                } else {
+                    ""
+                }
+            )));
+
+            if let Some(patched) = ws_span.patched {
+                labels.push(
+                    Label::secondary(ws_id, patched)
+                        .with_message("note this is the original dependency that is patched"),
+                );
+            }
+
+            if let Some(rename) = &ws_span.rename {
+                labels.push(
+                    Label::secondary(ws_id, rename.span)
+                        .with_message("note the workspace dependency is renamed"),
+                );
+            }
+        }
+
+        let llen = labels.len();
+        let has_workspace_declaration = llen != 0;
+
+        for (mdep, _parent, id) in parents {
+            // Unfortunately cargo doesn't allow `workspace = false`, so if
+            // there are situations where the user wants to explicitly opt out
+            // of the lint for a specific crate/crates/manifest they need to use
+            // [package.metadata.cargo-deny.workspace-duplicates]
+            if mdep.workspace.is_some() {
+                continue;
+            }
+
+            labels.push(Label::secondary(id, mdep.key_span));
+
+            if let Some(rename) = &mdep.rename {
+                labels.push(
+                    Label::secondary(id, rename.span)
+                        .with_message("note the dependency is renamed"),
+                );
+            }
+        }
+
+        if llen >= labels.len() {
+            continue;
+        }
+
+        let Some(duplicate) = krates.node_for_kid(kid) else {
+            log::error!("failed to find node for {kid}");
+            continue;
+        };
+
+        let krates::Node::Krate {
+            krate: duplicate, ..
+        } = duplicate
+        else {
+            log::error!("{kid} pointed a crate feature, this should be impossible");
+            continue;
+        };
+
+        let mut pack = Pack::with_kid(Check::Bans, duplicate.id.clone());
+        pack.push(diags::WorkspaceDuplicate {
+            duplicate,
+            labels,
+            severity,
+            has_workspace_declaration,
+            total_uses: total,
+        });
+        diags.push(pack);
+    }
 }
diff --git a/src/bans/cfg.rs b/src/bans/cfg.rs
index e892eda5c..27c8e0c42 100644
--- a/src/bans/cfg.rs
+++ b/src/bans/cfg.rs
@@ -333,6 +333,11 @@ pub struct Config {
     /// How to handle multiple versions of the same crate
     pub multiple_versions: LintLevel,
     pub multiple_versions_include_dev: bool,
+    /// How to handle workspace dependencies on the same crate that aren't declared
+    /// in `[workspace.dependencies]`
+    pub workspace_duplicates: LintLevel,
+    /// How to handle [`workspace.dependencies`] that are not used
+    pub unused_workspace_dependencies: LintLevel,
     /// How the duplicate graphs are highlighted
     pub highlight: GraphHighlight,
     /// The crates that will cause us to emit failures
@@ -373,6 +378,8 @@ impl Default for Config {
         Self {
             multiple_versions: LintLevel::Warn,
             multiple_versions_include_dev: false,
+            workspace_duplicates: LintLevel::Warn,
+            unused_workspace_dependencies: LintLevel::Allow,
             highlight: GraphHighlight::All,
             deny: Vec::new(),
             allow: Vec::new(),
@@ -397,6 +404,12 @@ impl<'de> Deserialize<'de> for Config {
         let multiple_versions_include_dev = th
             .optional("multiple-versions-include-dev")
             .unwrap_or_default();
+        let workspace_duplicates = th
+            .optional("workspace-duplicates")
+            .unwrap_or(LintLevel::Warn);
+        let unused_workspace_dependencies = th
+            .optional("unused-workspace-dependencies")
+            .unwrap_or(LintLevel::Allow);
         let highlight = th.optional("highlight").unwrap_or_default();
         let deny = th.optional("deny").unwrap_or_default();
         let allow = th.optional("allow").unwrap_or_default();
@@ -415,6 +428,8 @@ impl<'de> Deserialize<'de> for Config {
         Ok(Self {
             multiple_versions,
             multiple_versions_include_dev,
+            workspace_duplicates,
+            unused_workspace_dependencies,
             highlight,
             deny,
             allow,
@@ -722,6 +737,8 @@ impl crate::cfg::UnvalidatedConfig for Config {
             file_id: ctx.cfg_id,
             multiple_versions: self.multiple_versions,
             multiple_versions_include_dev: self.multiple_versions_include_dev,
+            workspace_duplicates: self.workspace_duplicates,
+            unused_workspace_dependencies: self.unused_workspace_dependencies,
             highlight: self.highlight,
             denied,
             denied_multiple_versions,
@@ -894,6 +911,8 @@ pub struct ValidConfig {
     pub file_id: FileId,
     pub multiple_versions: LintLevel,
     pub multiple_versions_include_dev: bool,
+    pub workspace_duplicates: LintLevel,
+    pub unused_workspace_dependencies: LintLevel,
     pub highlight: GraphHighlight,
     pub(crate) denied: Vec<ValidKrateBan>,
     pub(crate) denied_multiple_versions: Vec<PackageSpec>,
diff --git a/src/bans/diags.rs b/src/bans/diags.rs
index 59a3f5a75..f7d982969 100644
--- a/src/bans/diags.rs
+++ b/src/bans/diags.rs
@@ -51,6 +51,9 @@ pub enum Code {
     UnmatchedPathBypass,
     UnmatchedGlob,
     UnusedWrapper,
+    WorkspaceDuplicate,
+    UnresolvedWorkspaceDependency,
+    UnusedWorkspaceDependency,
 }
 
 impl From<Code> for String {
@@ -171,24 +174,13 @@ impl<'a> From<Skipped<'a>> for Diag {
 pub(crate) struct Wildcards<'a> {
     pub(crate) krate: &'a Krate,
     pub(crate) severity: Severity,
-    pub(crate) wildcards: Vec<&'a krates::cm::Dependency>,
+    pub(crate) labels: Vec<Label>,
     pub(crate) allow_wildcard_paths: bool,
-    pub(crate) cargo_spans: &'a crate::diag::CargoSpans,
 }
 
 impl<'a> From<Wildcards<'a>> for Pack {
     fn from(wc: Wildcards<'a>) -> Self {
-        let (file_id, map) = &wc.cargo_spans[&wc.krate.id];
-
-        let labels: Vec<_> = wc
-            .wildcards
-            .into_iter()
-            .map(|dep| {
-                Label::primary(*file_id, map[&dep.name].clone())
-                    .with_message("wildcard crate entry")
-            })
-            .collect();
-
+        let labels = wc.labels;
         let diag = Diag::new(
             Diagnostic::new(wc.severity)
                 .with_message(format!(
@@ -849,3 +841,99 @@ impl<'a> From<UnmatchedGlob<'a>> for Diag {
             .into()
     }
 }
+
+pub(crate) struct WorkspaceDuplicate<'k> {
+    pub(crate) duplicate: &'k Krate,
+    pub(crate) labels: Vec<Label>,
+    pub(crate) severity: crate::LintLevel,
+    pub(crate) has_workspace_declaration: bool,
+    pub(crate) total_uses: usize,
+}
+
+impl<'k> From<WorkspaceDuplicate<'k>> for Diag {
+    fn from(wd: WorkspaceDuplicate<'k>) -> Self {
+        Diagnostic::new(wd.severity.into())
+            .with_message(format!(
+                "crate {} is used {} times in the workspace, {}",
+                wd.duplicate,
+                wd.total_uses,
+                if wd.has_workspace_declaration {
+                    "but not all declarations use the shared workspace dependency"
+                } else {
+                    "and there was no shared workspace dependency for it"
+                }
+            ))
+            .with_code(Code::WorkspaceDuplicate)
+            .with_labels(wd.labels)
+            .into()
+    }
+}
+
+pub(crate) struct UnresolveWorkspaceDependency<'m, 'k> {
+    pub(crate) manifest: &'m crate::diag::Manifest<'k>,
+    pub(crate) dep: &'m crate::diag::ManifestDep<'k>,
+}
+
+#[allow(clippy::fallible_impl_from)]
+impl<'m, 'k> From<UnresolveWorkspaceDependency<'m, 'k>> for Diag {
+    fn from(uwd: UnresolveWorkspaceDependency<'m, 'k>) -> Self {
+        Diagnostic::bug()
+            .with_code(Code::UnresolvedWorkspaceDependency)
+            .with_message("failed to resolve a workspace dependency")
+            .with_labels(vec![
+                Label::primary(
+                    uwd.manifest.id,
+                    uwd.dep.workspace.as_ref().map(|ws| ws.span).unwrap(),
+                )
+                .with_message("usage of workspace dependency"),
+                Label::secondary(uwd.manifest.id, uwd.dep.value_span),
+            ])
+            .into()
+    }
+}
+
+pub(crate) struct UnusedWorkspaceDependencies<'u> {
+    pub(crate) unused: &'u [crate::diag::UnusedWorkspaceDep],
+    pub(crate) level: crate::LintLevel,
+    pub(crate) id: FileId,
+}
+
+impl<'u> From<UnusedWorkspaceDependencies<'u>> for Pack {
+    fn from(uwd: UnusedWorkspaceDependencies<'u>) -> Self {
+        let mut pack = Pack::new(Check::Bans);
+
+        for unused in uwd.unused {
+            let mut labels = vec![Label::primary(uwd.id, unused.key).with_message(format!(
+                "unused {}workspace dependency",
+                if unused.patched.is_some() {
+                    "and patched "
+                } else {
+                    ""
+                }
+            ))];
+
+            if let Some(patched) = unused.patched {
+                labels.push(
+                    Label::secondary(uwd.id, patched)
+                        .with_message("note this is the original dependency that is patched"),
+                );
+            }
+
+            if let Some(rename) = &unused.rename {
+                labels.push(
+                    Label::secondary(uwd.id, rename.span)
+                        .with_message("note the dependency is renamed"),
+                );
+            }
+
+            pack.push(
+                Diagnostic::new(uwd.level.into())
+                    .with_code(Code::UnusedWorkspaceDependency)
+                    .with_message("workspace dependency is declared, but unused")
+                    .with_labels(labels),
+            );
+        }
+
+        pack
+    }
+}
diff --git a/src/bans/snapshots/cargo_deny__bans__cfg__test__deserializes_ban_cfg.snap b/src/bans/snapshots/cargo_deny__bans__cfg__test__deserializes_ban_cfg.snap
index 1808d59a6..d7cafb1f1 100644
--- a/src/bans/snapshots/cargo_deny__bans__cfg__test__deserializes_ban_cfg.snap
+++ b/src/bans/snapshots/cargo_deny__bans__cfg__test__deserializes_ban_cfg.snap
@@ -3,9 +3,11 @@ source: src/bans/cfg.rs
 expression: validated
 ---
 {
-  "file_id": 1,
+  "file_id": 0,
   "multiple_versions": "deny",
   "multiple_versions_include_dev": false,
+  "workspace_duplicates": "warn",
+  "unused_workspace_dependencies": "allow",
   "highlight": "SimplestPath",
   "denied": [
     {
diff --git a/src/cargo-deny/check.rs b/src/cargo-deny/check.rs
index b368ce89d..e9ffbbb74 100644
--- a/src/cargo-deny/check.rs
+++ b/src/cargo-deny/check.rs
@@ -4,7 +4,7 @@ use crate::{
 };
 use cargo_deny::{
     advisories, bans,
-    diag::{CargoSpans, DiagnosticCode, DiagnosticOverrides, ErrorSink, Files, Severity},
+    diag::{DiagnosticCode, DiagnosticOverrides, ErrorSink, Files, Severity},
     licenses, sources, CheckCtx, PathBuf,
 };
 use log::error;
@@ -170,7 +170,6 @@ pub(crate) fn cmd(
     let mut krates = None;
     let mut license_store = None;
     let mut advisory_dbs = None;
-    let mut krate_spans = None;
 
     // Create an override structure that remaps specific codes
     let overrides = {
@@ -237,13 +236,7 @@ pub(crate) fn cmd(
                 log::info!("fetched crates in {:?}", start.elapsed());
             }
 
-            let gathered = krate_ctx.gather_krates(graph.targets, graph.exclude);
-
-            if let Ok(krates) = &gathered {
-                krate_spans = Some(cargo_deny::diag::KrateSpans::synthesize(krates));
-            }
-
-            krates = Some(gathered);
+            krates = Some(krate_ctx.gather_krates(graph.targets, graph.exclude));
         });
 
         if check_advisories {
@@ -280,22 +273,11 @@ pub(crate) fn cmd(
         None
     };
 
-    let (krate_spans, cargo_spans) = krate_spans
-        .map(|(spans, contents, raw_cargo_spans)| {
-            let id = files.add(krates.workspace_root().join("Cargo.lock"), contents);
-
-            let mut cargo_spans = CargoSpans::new();
-            for (key, val) in raw_cargo_spans {
-                let cargo_id = files.add(val.0, val.1);
-                cargo_spans.insert(key, (cargo_id, val.2));
-            }
-
-            (
-                cargo_deny::diag::KrateSpans::with_spans(spans, id),
-                cargo_spans,
-            )
-        })
-        .unwrap();
+    let krate_spans = cargo_deny::diag::KrateSpans::synthesize(
+        &krates,
+        krates.workspace_root().as_str(),
+        &mut files,
+    );
 
     let license_summary = if check_licenses {
         let store = license_store.unwrap()?;
@@ -345,6 +327,8 @@ pub(crate) fn cmd(
 
     let log_level = log_ctx.log_level;
 
+    let files = &files;
+
     rayon::scope(|s| {
         // Asynchronously displays messages sent from the checks
         s.spawn(|_| {
@@ -375,6 +359,7 @@ pub(crate) fn cmd(
                 serialize_extra,
                 colorize,
                 log_level,
+                files,
             };
 
             s.spawn(move |_| {
@@ -425,12 +410,13 @@ pub(crate) fn cmd(
                 serialize_extra,
                 colorize,
                 log_level,
+                files,
             };
 
             s.spawn(|_| {
                 log::info!("checking bans...");
                 let start = Instant::now();
-                bans::check(ctx, output_graph, cargo_spans, bans_sink);
+                bans::check(ctx, output_graph, bans_sink);
 
                 log::info!("bans checked in {}ms", start.elapsed().as_millis());
             });
@@ -449,6 +435,7 @@ pub(crate) fn cmd(
                 serialize_extra,
                 colorize,
                 log_level,
+                files,
             };
 
             s.spawn(|_| {
@@ -473,6 +460,7 @@ pub(crate) fn cmd(
                 serialize_extra,
                 colorize,
                 log_level,
+                files,
             };
 
             s.spawn(move |_| {
@@ -511,6 +499,7 @@ pub(crate) fn cmd(
                 log::info!("checking advisories...");
                 let start = Instant::now();
 
+                #[allow(clippy::disallowed_macros)]
                 let audit_reporter = if audit_compatible_output {
                     Some(|val: serde_json::Value| {
                         println!("{val}");
@@ -534,7 +523,7 @@ fn print_diagnostics(
     rx: crossbeam::channel::Receiver<cargo_deny::diag::Pack>,
     log_ctx: crate::common::LogContext,
     krates: Option<&cargo_deny::Krates>,
-    files: Files,
+    files: &Files,
     stats: &mut AllStats,
     feature_depth: Option<u32>,
 ) {
@@ -561,7 +550,7 @@ fn print_diagnostics(
         }
 
         if let Some(mut lock) = dp.as_ref().map(|dp| dp.lock()) {
-            lock.print_krate_pack(pack, &files);
+            lock.print_krate_pack(pack, files);
         }
     }
 }
diff --git a/src/cargo-deny/common.rs b/src/cargo-deny/common.rs
index 5760fdaaa..9249339f3 100644
--- a/src/cargo-deny/common.rs
+++ b/src/cargo-deny/common.rs
@@ -23,10 +23,6 @@ pub struct KrateContext {
     pub frozen: bool,
     pub locked: bool,
     pub offline: bool,
-    /// If true, allows using the crates.io git index, otherwise the sparse index
-    /// is assumed to be the only index
-    #[allow(dead_code)]
-    pub allow_git_index: bool,
     pub exclude_dev: bool,
 }
 
diff --git a/src/cargo-deny/main.rs b/src/cargo-deny/main.rs
index 1c959da41..b654bece7 100644
--- a/src/cargo-deny/main.rs
+++ b/src/cargo-deny/main.rs
@@ -295,7 +295,6 @@ fn real_main() -> Result<(), Error> {
         frozen: args.ctx.frozen,
         locked: args.ctx.locked,
         offline: args.ctx.offline,
-        allow_git_index: args.ctx.allow_git_index,
         exclude_dev: args.ctx.exclude_dev,
     };
 
diff --git a/src/cargo-deny/stats.rs b/src/cargo-deny/stats.rs
index c66a8a48a..0eb5f41bf 100644
--- a/src/cargo-deny/stats.rs
+++ b/src/cargo-deny/stats.rs
@@ -46,6 +46,7 @@ pub(crate) fn print_stats(
                 write_min_stats(&mut summary, &stats, color);
             }
 
+            #[allow(clippy::disallowed_macros)]
             if !summary.is_empty() {
                 print!("{summary}");
             }
diff --git a/src/cfg/package_spec.rs b/src/cfg/package_spec.rs
index a035f9971..0e3f108ce 100644
--- a/src/cfg/package_spec.rs
+++ b/src/cfg/package_spec.rs
@@ -67,7 +67,7 @@ impl<'de> Deserialize<'de> for PackageSpec {
             ValueInner::Table(tab) => {
                 let mut th = TableHelper::from((tab, value.span));
 
-                if let Some(mut val) = th.table.remove(&"crate".into()) {
+                if let Some(mut val) = th.table.remove("crate") {
                     let s = val.take_string(Some("a crate spec"))?;
                     th.finalize(Some(value))?;
 
diff --git a/src/diag.rs b/src/diag.rs
index e9fdd6a81..f4f685b9a 100644
--- a/src/diag.rs
+++ b/src/diag.rs
@@ -5,23 +5,174 @@ mod sink;
 pub use grapher::{cs_diag_to_json, diag_to_json, write_graph_as_text, InclusionGrapher};
 pub use sink::{DiagnosticOverrides, ErrorSink};
 
-use std::{collections::HashMap, ops::Range};
+use std::{collections::BTreeMap, ops::Range};
 
-use crate::{Kid, Krates, Span};
+use crate::{Kid, Krate, Krates, PathBuf, Span};
 pub use codespan_reporting::diagnostic::Severity;
 
-pub use codespan::FileId;
+pub type FileId = usize;
 
+pub type FilesErr = codespan_reporting::files::Error;
 pub type Diagnostic = codespan_reporting::diagnostic::Diagnostic<FileId>;
 pub type Label = codespan_reporting::diagnostic::Label<FileId>;
-pub type Files = codespan::Files<String>;
-// Map of crate id => (path to cargo.toml, synthetic cargo.toml content, map(cratename => crate span))
-pub type RawCargoSpans = HashMap<Kid, (krates::Utf8PathBuf, String, HashMap<String, Range<usize>>)>;
-// Same as RawCargoSpans but path to cargo.toml and cargo.toml content replaced with FileId
-pub type CargoSpans = HashMap<Kid, (FileId, HashMap<String, Range<usize>>)>;
+
 /// Channel type used to send diagnostics from checks
 pub type PackChannel = crossbeam::channel::Sender<Pack>;
 
+struct File {
+    name: PathBuf,
+    source: String,
+    line_starts: Vec<u32>,
+}
+
+use codespan_reporting::files::Files as _;
+
+/// Implementation of [`codespan_reporting::files::Files`], which can also query
+/// [`FileId`] by path
+pub struct Files {
+    files: Vec<File>,
+    /// Since we hand out ids we keep a mapping of path -> id for faster searching
+    map: BTreeMap<PathBuf, FileId>,
+}
+
+impl Files {
+    #[inline]
+    #[allow(clippy::new_without_default)]
+    pub fn new() -> Self {
+        Self {
+            files: Vec::new(),
+            map: Default::default(),
+        }
+    }
+
+    #[inline]
+    pub fn source_by_path(&self, path: &crate::Path) -> Option<&str> {
+        self.id_for_path(path)
+            .map(|id| self.files[id].source.as_str())
+    }
+
+    #[inline]
+    pub fn id_for_path(&self, path: &crate::Path) -> Option<FileId> {
+        self.map.get(path).copied()
+    }
+
+    #[inline]
+    pub fn add(&mut self, path: impl Into<crate::PathBuf>, source: impl Into<String>) -> FileId {
+        let name = path.into();
+
+        if let Some(id) = self.id_for_path(&name) {
+            panic!("path {name}({id}) is already present");
+        }
+
+        let id = self.files.len();
+        self.map.insert(name.clone(), id);
+        self.files.push(File {
+            name,
+            source: String::new(),
+            line_starts: Vec::new(),
+        });
+
+        self.update(id, source);
+        id
+    }
+
+    #[inline]
+    pub fn update(&mut self, id: FileId, source: impl Into<String>) {
+        let file = &mut self.files[id];
+
+        let source = source.into();
+
+        let mut line_starts = Vec::new();
+        line_starts.push(0);
+        line_starts.extend(memchr::memchr_iter(b'\n', source.as_bytes()).map(|i| (i + 1) as u32));
+
+        file.source = source;
+        file.line_starts = line_starts;
+    }
+
+    pub fn location(&self, id: FileId, byte_index: u32) -> Result<codespan::Location, FilesErr> {
+        let given = byte_index as usize;
+        let line_index = self.line_index(id, given)?;
+
+        let file = &self.files[id];
+        let line_start = file.line_starts[line_index] as usize;
+
+        let line_src = file.source.get(line_start..given).ok_or_else(|| {
+            let max = file.source.len() - 1;
+            if given > max {
+                FilesErr::IndexTooLarge { given, max }
+            } else {
+                FilesErr::InvalidCharBoundary { given }
+            }
+        })?;
+
+        Ok(codespan::Location {
+            line: (line_index as u32).into(),
+            column: (line_src.chars().count() as u32).into(),
+        })
+    }
+
+    #[inline]
+    pub fn source(&self, id: FileId) -> &str {
+        &self.files[id].source
+    }
+}
+
+impl<'f> codespan_reporting::files::Files<'f> for Files {
+    type FileId = FileId;
+    type Name = &'f crate::Path;
+    type Source = &'f str;
+
+    fn source(&'f self, id: Self::FileId) -> Result<Self::Source, FilesErr> {
+        self.files
+            .get(id)
+            .map(|f| f.source.as_str())
+            .ok_or(FilesErr::FileMissing)
+    }
+
+    fn name(&'f self, id: Self::FileId) -> Result<Self::Name, FilesErr> {
+        self.files
+            .get(id)
+            .map(|f| f.name.as_path())
+            .ok_or(FilesErr::FileMissing)
+    }
+
+    fn line_index(&'f self, id: Self::FileId, byte_index: usize) -> Result<usize, FilesErr> {
+        let file = self.files.get(id).ok_or(FilesErr::FileMissing)?;
+
+        let byte_index: u32 = byte_index
+            .try_into()
+            .map_err(|_e| FilesErr::IndexTooLarge {
+                given: byte_index,
+                max: file.line_starts.last().map_or(u32::MAX as _, |ls| *ls as _),
+            })?;
+
+        Ok(match file.line_starts.binary_search(&byte_index) {
+            Ok(line) => line,
+            Err(next_line) => next_line - 1,
+        })
+    }
+
+    fn line_range(&'f self, id: Self::FileId, line_index: usize) -> Result<Range<usize>, FilesErr> {
+        let file = self.files.get(id).ok_or(FilesErr::FileMissing)?;
+
+        let start = *file
+            .line_starts
+            .get(line_index)
+            .ok_or_else(|| FilesErr::LineTooLarge {
+                given: line_index,
+                max: file.line_starts.len(),
+            })?;
+        let end = if line_index + 1 < file.line_starts.len() {
+            file.line_starts[line_index + 1]
+        } else {
+            file.source.len() as _
+        };
+
+        Ok(start as _..end as _)
+    }
+}
+
 impl From<crate::LintLevel> for Severity {
     fn from(ll: crate::LintLevel) -> Self {
         match ll {
@@ -144,43 +295,356 @@ where
     }
 }
 
-pub struct KrateSpan {
-    pub total: Span,
-    pub source: usize,
+#[derive(Debug)]
+pub struct ManifestDep<'k> {
+    /// The dependency declaration
+    pub dep: &'k krates::cm::Dependency,
+    /// The crate the dependency resolved to
+    pub krate: &'k Krate,
+    /// Span for the dependency key
+    pub key_span: toml_span::Span,
+    /// Span for the overall dependency value
+    pub value_span: toml_span::Span,
+    /// Span for the `version` key, if present
+    pub version_req: Option<toml_span::Spanned<semver::VersionReq>>,
+    /// Span for the `workspace` key, if present
+    pub workspace: Option<toml_span::Spanned<bool>>,
+    /// Span for the `package` key, if present
+    pub rename: Option<toml_span::Spanned<String>>,
 }
 
-pub struct KrateSpans {
-    spans: Vec<KrateSpan>,
-    pub file_id: FileId,
+/// A parsed crate manifest
+#[derive(Debug)]
+pub struct Manifest<'k> {
+    /// Id for the cargo manifest file for the krate
+    pub id: FileId,
+    /// The parsed krate
+    pub krate: &'k Krate,
+    /// The resolved dependencies for the krate
+    deps: Vec<ManifestDep<'k>>,
+    ignore: u8,
 }
 
-impl std::ops::Index<usize> for KrateSpans {
-    type Output = KrateSpan;
+const NORMAL: u8 = 0x1;
+const DEV: u8 = 0x2;
+const BUILD: u8 = 0x4;
 
-    #[inline]
-    fn index(&self, i: usize) -> &Self::Output {
-        &self.spans[i]
+impl<'k> Manifest<'k> {
+    pub fn parse(krate: &'k Krate, krates: &'k Krates, contents: &str) -> anyhow::Result<Self> {
+        use anyhow::Context as _;
+        use krates::cm::DependencyKind;
+
+        let root = toml_span::parse(contents)?;
+        let mut pointer = String::new();
+        let mut deps = Vec::new();
+
+        let nid = krates
+            .nid_for_kid(&krate.id)
+            .with_context(|| format!("unable to find krate {}", krate.id))?;
+
+        // Unfortunately cargo will "helpfully" prettify cfg expressions in the
+        // metadata output, but this makes it impossible to just directly map back
+        // to the location in the toml manifest since non-normalized cfg expressions
+        // will just fail the pointer path, so we build a mapping of expressions
+        // to pointers. Note that we need to account for cases where the manifest is
+        // inconsistent, eg. `cfg(target_os="windows")`, `cfg(windows)`, and
+        // `cfg(target_os = "windows")` are all equivalent
+        struct Target<'m> {
+            /// The cfg string as it appears in the manifest
+            original: &'m str,
+            expr: Option<cfg_expr::Expression>,
+        }
+
+        let targets = root.pointer("/target").map_or(Vec::new(), |targets| {
+            let Some(table) = targets.as_table() else {
+                return Vec::new();
+            };
+
+            table
+                .keys()
+                .map(|cfg| {
+                    let original = cfg.name.as_ref();
+                    let expr = if !cfg.name.starts_with("cfg(") {
+                        None
+                    } else {
+                        cfg_expr::Expression::parse(&cfg.name).ok()
+                    };
+
+                    Target { original, expr }
+                })
+                .collect()
+        });
+
+        let get_dep_value =
+            |dep: &krates::cm::Dependency,
+             pointer: &mut String|
+             -> Option<(&toml_span::value::Key<'_>, &toml_span::Value<'_>)> {
+                pointer.clear();
+                pointer.push('/');
+
+                let name = dep.rename.as_ref().unwrap_or(&dep.name);
+
+                let push_kind = |pointer: &mut String| {
+                    let dep_kind = match dep.kind {
+                        DependencyKind::Development => "dev-",
+                        DependencyKind::Build => "build-",
+                        DependencyKind::Normal => "",
+                    };
+
+                    pointer.push_str(dep_kind);
+                    pointer.push_str("dependencies");
+                };
+
+                // If the dependency has a cfg/platform it is in `targets.<>.<kind>` so
+                // we need a pointer to that first
+                if let Some(cfg) = &dep.target {
+                    pointer.push_str("target/");
+
+                    let expr = cfg
+                        .starts_with("cfg(")
+                        .then(|| cfg_expr::Expression::parse(cfg).ok())
+                        .flatten();
+
+                    for target in &targets {
+                        pointer.truncate(8 /* /target/ */);
+
+                        match (&target.expr, &expr) {
+                            (None, None) => {
+                                pointer.push_str(target.original);
+                            }
+                            (Some(a), Some(b)) => {
+                                if !a.predicates().zip(b.predicates()).all(|(a, b)| a == b) {
+                                    continue;
+                                }
+
+                                pointer.push_str(target.original);
+                            }
+                            _ => continue,
+                        }
+
+                        pointer.push('/');
+
+                        push_kind(pointer);
+
+                        let Some(dep_table) = root.pointer(pointer) else {
+                            continue;
+                        };
+
+                        let Some(table) = dep_table.as_table() else {
+                            log::warn!(
+                                "{pointer} for manifest '{}' is not a valid toml table",
+                                krate.manifest_path
+                            );
+                            continue;
+                        };
+
+                        if let Some(kv) = table.get_key_value(name.as_str()) {
+                            return Some(kv);
+                        }
+                    }
+
+                    None
+                } else {
+                    push_kind(pointer);
+
+                    let dep_table = root.pointer(pointer)?;
+
+                    let Some(table) = dep_table.as_table() else {
+                        log::warn!(
+                            "{pointer} for manifest '{}' is not a valid toml table",
+                            krate.manifest_path
+                        );
+                        return None;
+                    };
+
+                    table.get_key_value(name.as_str())
+                }
+            };
+
+        for (i, dep) in krate.deps.iter().enumerate() {
+            // Get the krate that was resolved for the dependency declaration, this
+            // can be None if it was pruned via cfg etc
+            let Some(dep_krate) = krates.resolved_dependency(nid, i) else {
+                continue;
+            };
+
+            let Some((key, dep_value)) = get_dep_value(dep, &mut pointer) else {
+                log::warn!(
+                    "unable to locate {krate} - ({}) -> {}@{} in manifest '{}' (path: {pointer})",
+                    dep.kind,
+                    dep.name,
+                    dep.req,
+                    krate.manifest_path
+                );
+                continue;
+            };
+
+            let (workspace, version_req, rename) = if let Some(table) = dep_value.as_table() {
+                let workspace = table.get("workspace").and_then(|v| {
+                    v.as_bool()
+                        .map(|b| toml_span::Spanned::with_span(b, v.span))
+                });
+                let version = table.get("version").and_then(|v| {
+                    v.as_str().and_then(|vr| {
+                        match vr.parse() {
+                            Ok(vreq) => Some(toml_span::Spanned::with_span(vreq, v.span)),
+                            Err(err) => {
+                                log::error!("version requirement '{vr}' for {krate} -> {dep_krate} could not be parsed: {err:#}");
+                                None
+                            }
+                        }
+                    })
+                });
+                let rename = table.get("package").and_then(|v| {
+                    v.as_str()
+                        .map(|rn| toml_span::Spanned::with_span(rn.to_owned(), v.span))
+                });
+
+                (workspace, version, rename)
+            } else if let Some(version) = dep_value.as_str() {
+                (None, version.parse().map_err(|err| {
+                    log::error!("version requirement '{version}' for {krate} -> {dep_krate} could not be parsed: {err:#}");
+                    err
+                }).ok().map(|vr| toml_span::Spanned::with_span(vr, dep_value.span)), None)
+            } else {
+                log::error!("dependency {krate} -> {dep_krate} is not a string nor table, this should be invalid...");
+                (None, None, None)
+            };
+
+            deps.push(ManifestDep {
+                dep,
+                krate: dep_krate,
+                key_span: key.span,
+                value_span: dep_value.span,
+                workspace,
+                version_req,
+                rename,
+            });
+        }
+
+        let ignore = if krates.workspace_members().any(|wm| {
+            let krates::Node::Krate { id, .. } = wm else {
+                return false;
+            };
+            id == &krate.id
+        }) {
+            let mut ignore = 0;
+
+            if let Some(val) = root
+                .pointer("/package/metadata/cargo-deny/workspace-duplicates")
+                .and_then(|arr| arr.as_array())
+            {
+                ignore = NORMAL | DEV | BUILD;
+
+                for v in val {
+                    let Some(s) = v.as_str() else {
+                        continue;
+                    };
+                    match s {
+                        "" => ignore &= !NORMAL,
+                        "dev" => ignore &= !DEV,
+                        "build" => ignore &= !BUILD,
+                        _ => {}
+                    }
+                }
+            }
+
+            ignore
+        } else {
+            0
+        };
+
+        Ok(Self {
+            deps,
+            krate,
+            id: 0,
+            ignore,
+        })
     }
-}
 
-impl KrateSpans {
-    pub fn with_spans(spans: Vec<KrateSpan>, id: FileId) -> Self {
-        Self { spans, file_id: id }
+    /// Retrieves the dependencies from the manifest.
+    ///
+    /// If `filter` is true, the dependencies that the manifest itself states it
+    /// wants to ignore via metadata are not yielded
+    pub fn deps(&self, filter: bool) -> impl Iterator<Item = &ManifestDep<'k>> {
+        self.deps.iter().filter(move |dep| {
+            !filter
+                || (match dep.dep.kind {
+                    krates::cm::DependencyKind::Normal => NORMAL,
+                    krates::cm::DependencyKind::Development => DEV,
+                    krates::cm::DependencyKind::Build => BUILD,
+                } & self.ignore)
+                    == 0
+        })
     }
+}
+
+pub struct LockSpan {
+    /// The total span for the lock entry, which includes the name, version, and source
+    pub total: Span,
+    /// The span that covers only the source portion of the entry
+    pub source: Span,
+}
+
+/// The span locations for a workspace dependency
+pub struct WorkspaceSpan<'k> {
+    pub krate: &'k Krate,
+    pub key: Span,
+    pub value: Span,
+    pub version: Option<toml_span::Spanned<semver::VersionReq>>,
+    pub rename: Option<toml_span::Spanned<String>>,
+    /// If this dependency was patched, this it the span of the original key
+    pub patched: Option<toml_span::Span>,
+}
+
+pub struct UnusedWorkspaceDep {
+    pub key: Span,
+    pub value: Span,
+    pub version: Option<toml_span::Spanned<semver::VersionReq>>,
+    pub rename: Option<toml_span::Spanned<String>>,
+    pub patched: Option<toml_span::Span>,
+}
+
+pub struct Spans<'k> {
+    pub lock: LockSpan,
+    pub workspace: Option<WorkspaceSpan<'k>>,
+    pub manifest: Option<Manifest<'k>>,
+}
+
+pub struct KrateSpans<'k> {
+    spans: BTreeMap<&'k Kid, Spans<'k>>,
+    /// The ID of the workspace manifest
+    pub workspace_id: Option<FileId>,
+    /// The ID of the (synthesized) lockfile
+    pub lock_id: FileId,
+    /// `[workspace.dependencies]` that are not actually used in the graph
+    pub unused_workspace_deps: Vec<UnusedWorkspaceDep>,
+}
 
-    pub fn synthesize(krates: &Krates) -> (Vec<KrateSpan>, String, RawCargoSpans) {
-        use std::fmt::Write;
+impl<'k> KrateSpans<'k> {
+    pub fn synthesize(krates: &'k Krates, lock_name: &str, files: &mut Files) -> Self {
+        use anyhow::Context as _;
+        use std::fmt::Write as _;
 
         let mut sl = String::with_capacity(4 * 1024);
-        let mut spans = Vec::with_capacity(krates.len());
-        let mut cargo_spans = RawCargoSpans::new();
-
-        let mut krates: Vec<_> = krates.krates().collect();
-        // [Krates::krates] guarantees the krates to be ordered by name but we
-        // want the outputs of diagnostics to also be stable in regards to
-        // their version, so we do an additional sort for that here.
-        krates.sort_unstable_by_key(|a| (&a.name, &a.version));
-        for krate in krates {
+        //let mut lock_spans = Vec::with_capacity(krates.len());
+
+        let mut okrates: Vec<_> = krates
+            .krates()
+            .map(|krate| {
+                (
+                    krate,
+                    LockSpan {
+                        total: Default::default(),
+                        source: Default::default(),
+                    },
+                )
+            })
+            .collect();
+        // [Krates::krates] only guarantees that krates are in the same order that cargo metadata
+        // serializes them in, but we want to be stable across the full id
+        okrates.sort_unstable_by_key(|(k, _s)| (&k.name, &k.version));
+        for (krate, span) in &mut okrates {
             let span_start = sl.len();
             let source = if krate.source.is_some() {
                 krate.id.source()
@@ -192,44 +656,550 @@ impl KrateSpans {
                 .expect("unable to synthesize lockfile");
 
             let total = span_start..sl.len() - 1;
-            let source = total.end - source.len();
-            spans.push(KrateSpan {
-                total: total.into(),
-                source,
-            });
+            span.source = (total.end - source.len()..total.end).into();
+            span.total = total.into();
+        }
+
+        let lock_id = files.add(format!("{lock_name}/Cargo.lock"), sl);
+
+        let mut manifests = Vec::with_capacity(krates.len());
+        use rayon::iter::{IndexedParallelIterator, IntoParallelRefIterator, ParallelIterator};
+        okrates
+            .par_iter()
+            .map(
+                |(krate, _)| -> anyhow::Result<Option<(Manifest<'_>, String)>> {
+                    // If the krate's source is not a local path we aren't really concerned with
+                    // its contents (for now)
+                    if krate.source.is_some() {
+                        return Ok(None);
+                    }
+
+                    let contents =
+                        std::fs::read_to_string(&krate.manifest_path).with_context(|| {
+                            format!("failed to read manifest {}", krate.manifest_path)
+                        })?;
+                    let manifest = Manifest::parse(krate, krates, &contents)?;
+                    Ok(Some((manifest, contents)))
+                },
+            )
+            .collect_into_vec(&mut manifests);
+
+        let mut spans = okrates
+            .into_iter()
+            .zip(manifests)
+            .map(|((krate, lock), res)| {
+                let manifest = match res {
+                    Ok(Some((mut manifest, contents))) => {
+                        manifest.id = files.add(krate.manifest_path.clone(), contents);
+                        Some(manifest)
+                    }
+                    Ok(None) => None,
+                    Err(err) => {
+                        log::error!("unable to parse manifest for {krate}: {err:#}");
+                        None
+                    }
+                };
 
-            let mut sl2 = String::with_capacity(4 * 1024);
-            let mut deps_map = HashMap::new();
+                (
+                    &krate.id,
+                    Spans {
+                        lock,
+                        workspace: None,
+                        manifest,
+                    },
+                )
+            })
+            .collect();
 
-            for dep in &krate.deps {
-                let span_start = sl2.len();
-                writeln!(sl2, "{} = '{}'", dep.name, dep.req)
-                    .expect("unable to synthesize Cargo.toml");
-                let span_end = sl2.len() - 1;
-                deps_map.insert(dep.name.clone(), span_start..span_end);
+        // Add the root workspace toml if needed
+        let workspace_root = krates.workspace_root().join("Cargo.toml");
+
+        let workspace_id = if let Some(wid) = files.id_for_path(&workspace_root) {
+            Some(wid)
+        } else {
+            match std::fs::read_to_string(&workspace_root) {
+                Ok(contents) => Some(files.add(workspace_root, contents)),
+                Err(err) => {
+                    log::error!("failed to read workspace root '{workspace_root}': {err:#}");
+                    None
+                }
             }
+        };
 
-            cargo_spans.insert(
-                krate.id.clone(),
-                (krate.manifest_path.clone(), sl2, deps_map),
-            );
+        let unused_workspace_deps = if let Some(wid) = workspace_id {
+            let workspace_root = files.source(wid);
+            match read_workspace_deps(workspace_root, krates, &mut spans) {
+                Ok(unused) => unused,
+                Err(err) => {
+                    log::error!(
+                        "failed to resolve [workspace.dependencies] from '{}': {err:#}",
+                        krates.workspace_root().join("Cargo.toml")
+                    );
+                    Vec::new()
+                }
+            }
+        } else {
+            Vec::new()
+        };
+
+        Self {
+            lock_id,
+            workspace_id,
+            spans,
+            unused_workspace_deps,
         }
+    }
 
-        (spans, sl, cargo_spans)
+    #[inline]
+    pub fn lock_span(&self, kid: &Kid) -> &LockSpan {
+        &self.spans[kid].lock
     }
 
     #[inline]
-    pub fn label_for_index(&self, krate_index: usize, msg: impl Into<String>) -> Label {
-        Label::secondary(self.file_id, self.spans[krate_index].total).with_message(msg)
+    pub fn manifest(&self, kid: &Kid) -> Option<&Manifest<'k>> {
+        self.spans[kid].manifest.as_ref()
     }
 
     #[inline]
-    pub fn get_coord(&self, krate_index: usize) -> KrateCoord {
-        KrateCoord {
-            file: self.file_id,
-            span: self.spans[krate_index].total,
+    pub fn workspace_span(&self, kid: &Kid) -> Option<&WorkspaceSpan<'k>> {
+        self.spans[kid].workspace.as_ref()
+    }
+}
+
+pub struct WsDep<'k> {
+    pub key_span: toml_span::Span,
+    pub value_span: toml_span::Span,
+    pub rename: Option<toml_span::Spanned<String>>,
+    pub krate: &'k Krate,
+}
+
+use std::borrow::Cow;
+
+#[derive(Debug)]
+enum GitSpec<'t> {
+    None,
+    Branch(Cow<'t, str>),
+    Tag(Cow<'t, str>),
+    Rev(Cow<'t, str>),
+}
+
+#[derive(Debug)]
+enum Source<'t> {
+    Registry { registry: Option<Cow<'t, str>> },
+    Path(Cow<'t, str>),
+    Git { repo: url::Url, spec: GitSpec<'t> },
+}
+
+#[derive(Debug)]
+struct PackageSource<'t> {
+    source: Source<'t>,
+    version: Option<toml_span::Spanned<semver::VersionReq>>,
+    rename: Option<toml_span::Spanned<Cow<'t, str>>>,
+}
+
+use anyhow::Context as _;
+use toml_span::value::ValueInner;
+
+impl<'t> PackageSource<'t> {
+    fn parse(
+        section: &str,
+        (key, mut val): (&toml_span::value::Key<'t>, toml_span::Value<'t>),
+    ) -> anyhow::Result<Self> {
+        fn take_string<'de>(
+            section: &str,
+            name: &str,
+            (key, mut val): (toml_span::value::Key<'de>, toml_span::Value<'de>),
+        ) -> anyhow::Result<Cow<'de, str>> {
+            match val.take() {
+                ValueInner::String(s) => Ok(s),
+                other => {
+                    anyhow::bail!(
+                        "[{section}.{name}] `{}` was a {} instead of a string",
+                        key.name,
+                        other.type_str()
+                    );
+                }
+            }
+        }
+
+        let this = match val.take() {
+            ValueInner::Table(mut dt) => {
+                let rename = dt.remove_entry("package").and_then(|v| {
+                    let span = v.1.span;
+                    take_string(section, &key.name, v)
+                        .ok()
+                        .map(|v| toml_span::Spanned::with_span(v, span))
+                });
+
+                let name = rename
+                    .as_ref()
+                    .map_or(key.name.as_ref(), |v| v.value.as_ref());
+
+                let version = if let Some(version) = dt.remove_entry("version") {
+                    let span = version.1.span;
+                    let req_s = take_string(section, name, version)?;
+
+                    let vr = req_s.parse::<semver::VersionReq>().with_context(|| {
+                        format!("[{section}.{key}].version '{req_s}' could not be parsed")
+                    })?;
+                    Some(toml_span::Spanned::with_span(vr, span))
+                } else {
+                    None
+                };
+
+                // cargo _currently_ allows dependencies to be declared without a version/path/git field, but will
+                // make it an error in the future, we'll just discard them because this lint is new
+                let source = if let Some(registry) = dt.remove_entry("registry") {
+                    let registry = take_string(section, name, registry)?;
+
+                    Source::Registry {
+                        registry: Some(registry),
+                    }
+                } else if let Some(path) = dt.remove_entry("path") {
+                    Source::Path(take_string(section, name, path)?)
+                } else if let Some(repo) = dt.remove_entry("git") {
+                    let repo = url::Url::parse(&take_string(section, name, repo)?)?;
+                    let spec = if let Some(rev) = dt.remove_entry("rev") {
+                        GitSpec::Rev(take_string(section, name, rev)?)
+                    } else if let Some(branch) = dt.remove_entry("branch") {
+                        GitSpec::Branch(take_string(section, name, branch)?)
+                    } else if let Some(tag) = dt.remove_entry("tag") {
+                        GitSpec::Tag(take_string(section, name, tag)?)
+                    } else {
+                        GitSpec::None
+                    };
+
+                    Source::Git { repo, spec }
+                } else if version.is_some() {
+                    Source::Registry { registry: None }
+                } else {
+                    anyhow::bail!("[{section}.{key}] did not have a version, git, nor path field");
+                };
+
+                Self {
+                    source,
+                    version,
+                    rename,
+                }
+            }
+            ValueInner::String(req) => {
+                let version = req
+                    .parse()
+                    .with_context(|| format!("[{section}].{key} '{req}' could not be parsed"))?;
+                let version = Some(toml_span::Spanned::with_span(version, val.span));
+
+                Self {
+                    source: Source::Registry { registry: None },
+                    version,
+                    rename: None,
+                }
+            }
+            other => anyhow::bail!(
+                "[{section}.{key}] was a '{}' instead of a table or version string",
+                other.type_str()
+            ),
+        };
+
+        Ok(this)
+    }
+}
+
+/// Gather the crates declared in the `[workspace.dependencies]` section
+fn read_workspace_deps<'k>(
+    root_toml: &str,
+    krates: &'k Krates,
+    map: &mut BTreeMap<&'k Kid, Spans<'k>>,
+) -> anyhow::Result<Vec<UnusedWorkspaceDep>> {
+    use toml_span::value::ValueInner;
+
+    let config_root = krates.workspace_root();
+    let mut root = toml_span::parse(root_toml)?;
+
+    struct RegistryUrlCache {
+        urls: Vec<(String, Option<url::Url>)>,
+    }
+
+    impl RegistryUrlCache {
+        fn get(&mut self, name: &str, config_root: &crate::Path) -> Option<&url::Url> {
+            let i = match self.urls.binary_search_by(|(rn, _)| rn.as_str().cmp(name)) {
+                Ok(i) => i,
+                Err(i) => {
+                    let url = match tame_index::IndexUrl::for_registry_name(
+                        Some(config_root.into()),
+                        None,
+                        name,
+                    ) {
+                        Ok(url) => url::Url::parse(url.as_str())
+                            .map_err(|err| {
+                                log::warn!(
+                                    "unable to parse url '{}' for registry '{name}': {err}",
+                                    url.as_str()
+                                );
+                                err
+                            })
+                            .ok(),
+                        Err(err) => {
+                            log::warn!("unable to retrieve url for registry '{name}': {err}");
+                            None
+                        }
+                    };
+                    self.urls.insert(i, (name.into(), url));
+                    i
+                }
+            };
+
+            self.urls[i].1.as_ref()
+        }
+    }
+
+    let mut reg_cache = RegistryUrlCache {
+        urls: Default::default(),
+    };
+    reg_cache.urls.push((
+        "crates-io".into(),
+        tame_index::IndexUrl::crates_io(Some(config_root.into()), None, None)
+            .map_err(|err| {
+                log::warn!("unable to retrieve crates.io url: {err}");
+                err
+            })
+            .ok()
+            .and_then(|iu| url::Url::parse(iu.as_str()).ok()),
+    ));
+
+    // Grab any patches first, as they override the source information for any workspace dependencies
+    // For now we only support [patch.crates-io] as that is the only patch that
+    // a vast majority of workspaces will use, and honestly patching a git dependency
+    // or custom registry seems kinda pointless to me
+    let mut patches = match read_patches(&mut root) {
+        Ok(p) => p,
+        Err(err) => {
+            log::error!("failed to read [patch.crates-io] table: {err}");
+            Default::default()
+        }
+    };
+
+    enum WsDep<'k> {
+        Resolved(WorkspaceSpan<'k>),
+        Unresolved(UnusedWorkspaceDep),
+    }
+
+    let Some(dep_table) = root.pointer_mut("/workspace/dependencies").and_then(|v| {
+        let ValueInner::Table(table) = v.take() else {
+            return None;
+        };
+        Some(table)
+    }) else {
+        log::info!("no workspace dependencies were declared");
+        return Ok(Vec::new());
+    };
+
+    // Just as with normal package dependency tables, the workspace.dependencies can
+    // use package = "<real_name>" to rename the dependency, and when
+    // setting workspace = true in workspace member tables, they _must_
+    // use the same name, ie, foo = { workspace = true, package = "bar" } will
+    // only match [workspace.dependencies.foo], not [workspace.dependencies.bar]
+    let dependencies = dep_table.into_iter().filter_map(|(mut key, dep)| {
+        let value = dep.span;
+        let mut ws_src = match PackageSource::parse("workspace.dependencies", (&key, dep)) {
+            Ok(psrc) => psrc,
+            Err(err) => {
+                log::error!("failed to read source for [workspace.dependencies.{key}: {err:#}");
+                return None;
+            }
+        };
+
+        let mut patched = None;
+        // If the dependency is patched, use its source information instead as it is what
+        // will actually be present in the graph
+        if matches!(&ws_src.source, Source::Registry { registry: None }) {
+            if let Some((pkey, psrc)) = patches.remove_entry(&key) {
+                patched = Some(key.span);
+                key = pkey;
+                ws_src = psrc;
+            }
+        }
+
+        let krate_name = ws_src
+            .rename
+            .as_ref()
+            .map_or(key.name.as_ref(), |r| r.value.as_ref());
+
+        let Some(krate) = krates.krates_by_name(krate_name).find_map(|km| {
+            match (&km.krate.source, &ws_src.source) {
+                (
+                    Some(crate::Source::Git {
+                        url,
+                        spec,
+                        spec_value,
+                    }),
+                    Source::Git { repo, spec: dspec },
+                ) => {
+                    if url.host_str() != repo.host_str() || url.path() != repo.path() {
+                        return None;
+                    }
+
+                    let sv = spec_value.as_deref();
+
+                    match (spec, dspec) {
+                        (crate::GitSpec::Any, GitSpec::None) => {}
+                        (crate::GitSpec::Branch, GitSpec::None) if sv == Some("master") => {}
+                        (crate::GitSpec::Branch, GitSpec::Branch(branch)) if sv == Some(branch) => {
+                        }
+                        (crate::GitSpec::Tag, GitSpec::Tag(tag)) if sv == Some(tag) => {}
+                        (crate::GitSpec::Rev, GitSpec::Rev(rev)) if sv == Some(rev) => {}
+                        _ => return None,
+                    }
+                }
+                (None, Source::Path(path)) => {
+                    // Paths should always be workspace relative, but we still need to
+                    // account for parent paths to handle overly complicated nested workspace
+                    // situations
+                    let dir = km.krate.manifest_path.parent()?;
+                    let path = crate::Path::new(path);
+                    if path.as_str().contains("..") {
+                        let mut pb = krates.workspace_root().to_owned();
+                        for comp in path.components() {
+                            match comp {
+                                camino::Utf8Component::CurDir => {}
+                                camino::Utf8Component::Normal(comp) => pb.push(comp),
+                                camino::Utf8Component::ParentDir => {
+                                    if !pb.pop() {
+                                        break;
+                                    }
+                                }
+                                camino::Utf8Component::RootDir
+                                | camino::Utf8Component::Prefix(_) => {
+                                    // We _could_ warn here, because absolute paths are
+                                    // a terrible idea, but whatever
+                                    if dir != path {
+                                        return None;
+                                    }
+
+                                    break;
+                                }
+                            }
+                        }
+                    } else if dir
+                        .strip_prefix(krates.workspace_root())
+                        .map_or(false, |dir| dir != path)
+                    {
+                        return None;
+                    }
+                }
+                (Some(reg_src), Source::Registry { registry }) => {
+                    let urls = reg_cache.get(
+                        registry.as_ref().map_or("crates-io", |r| r.as_ref()),
+                        config_root,
+                    )?;
+                    match reg_src {
+                        crate::Source::CratesIo(is_sparse) => {
+                            let crates_io = if *is_sparse {
+                                tame_index::index::sparse::CRATES_IO_HTTP_INDEX
+                            } else {
+                                tame_index::index::git::CRATES_IO_INDEX
+                            };
+
+                            if urls.as_str() != crates_io {
+                                return None;
+                            }
+                        }
+                        crate::Source::Registry(url) | crate::Source::Sparse(url) => {
+                            if urls != url {
+                                return None;
+                            }
+                        }
+                        crate::Source::Git { .. } => return None,
+                    }
+
+                    if let Some(req) = &ws_src.version {
+                        if !req.value.matches(&km.krate.version) {
+                            return None;
+                        }
+                    } else {
+                        log::warn!(
+                            "[workspace.dependencies.{krate_name}] did not specify a version"
+                        );
+                    }
+                }
+                _ => return None,
+            }
+
+            Some(km.krate)
+        }) else {
+            return Some(WsDep::Unresolved(UnusedWorkspaceDep {
+                key: key.span,
+                value,
+                version: ws_src.version,
+                rename: ws_src.rename.map(|s| s.map()),
+                patched,
+            }));
+        };
+
+        Some(WsDep::Resolved(WorkspaceSpan {
+            krate,
+            key: key.span,
+            value,
+            version: ws_src.version,
+            patched,
+            rename: ws_src.rename.map(|s| s.map()),
+        }))
+    });
+
+    let mut ur = Vec::new();
+    for ws_dep in dependencies {
+        match ws_dep {
+            WsDep::Resolved(ws_dep) => {
+                if let Some(ws) = map.get_mut(&ws_dep.krate.id) {
+                    ws.workspace = Some(ws_dep);
+                } else {
+                    let name = ws_dep
+                        .rename
+                        .as_ref()
+                        .map_or(&ws_dep.krate.name, |r| r.as_ref());
+                    log::error!("[workspace.dependencies.{name}] was resolved to {}...which wasn't in the list of available crates. This should be impossible", ws_dep.krate.id);
+                }
+            }
+            WsDep::Unresolved(unresolved) => {
+                ur.push(unresolved);
+            }
         }
     }
+
+    Ok(ur)
+}
+
+fn read_patches<'de>(
+    root: &mut toml_span::Value<'de>,
+) -> anyhow::Result<std::collections::BTreeMap<toml_span::value::Key<'de>, PackageSource<'de>>> {
+    let Some(patches) = root.pointer_mut("/patch/crates-io") else {
+        return Ok(Default::default());
+    };
+
+    let patches = match patches.take() {
+        ValueInner::Table(table) => table,
+        other => {
+            anyhow::bail!(
+                "[patch.crates-io] was not a table but a {}",
+                other.type_str()
+            );
+        }
+    };
+
+    let mut map = std::collections::BTreeMap::new();
+    for (key, value) in patches {
+        match PackageSource::parse("patch.crates-io", (&key, value)) {
+            Ok(psrc) => {
+                map.insert(key, psrc);
+            }
+            Err(err) => {
+                log::error!(
+                    "failed to read source information for [patch.crates-io].{key}: {err:#}"
+                );
+            }
+        }
+    }
+
+    Ok(map)
 }
 
 pub type KrateCoord = Coord;
diff --git a/src/lib.rs b/src/lib.rs
index f87fb3e89..168f8425d 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -80,8 +80,12 @@ pub enum Source {
     /// crates.io, the boolean indicates whether it is a sparse index
     CratesIo(bool),
     /// A remote git patch
-    Git { spec: GitSpec, url: Url },
-    /// A remote git index
+    Git {
+        spec: GitSpec,
+        url: Url,
+        spec_value: Option<String>,
+    },
+    /// A remote non-sparse registry index
     Registry(Url),
     /// A remote sparse index
     Sparse(Url),
@@ -143,9 +147,13 @@ impl Source {
             }
             "git" => {
                 let mut url = Url::parse(url_str).context("failed to parse url")?;
-                let spec = normalize_git_url(&mut url);
+                let (spec, spec_value) = normalize_git_url(&mut url);
 
-                Ok(Self::Git { url, spec })
+                Ok(Self::Git {
+                    url,
+                    spec,
+                    spec_value,
+                })
             }
             unknown => anyhow::bail!("unknown source spec '{unknown}' for url {urls}"),
         }
@@ -335,11 +343,12 @@ impl From<cm::Package> for Krate {
             license_file: pkg.license_file,
             description: pkg.description,
             manifest_path: pkg.manifest_path,
-            deps: {
-                let mut deps = pkg.dependencies;
-                deps.sort_by(|a, b| a.name.cmp(&b.name));
-                deps
-            },
+            deps: pkg.dependencies,
+            // {
+            //     let mut deps = pkg.dependencies;
+            //     deps.sort_by(|a, b| a.name.cmp(&b.name));
+            //     deps
+            // },
             features: pkg.features,
             publish: pkg.publish,
         }
@@ -392,6 +401,11 @@ impl Krate {
     pub(crate) fn is_git_source(&self) -> bool {
         self.source.as_ref().map_or(false, |src| src.is_git())
     }
+
+    #[inline]
+    pub(crate) fn is_registry(&self) -> bool {
+        self.source.as_ref().map_or(false, |src| src.is_registry())
+    }
 }
 
 impl fmt::Display for Krate {
@@ -439,7 +453,7 @@ pub struct CheckCtx<'ctx, T> {
     /// The krates graph to check
     pub krates: &'ctx Krates,
     /// The spans for each unique crate in a synthesized "lock file"
-    pub krate_spans: &'ctx diag::KrateSpans,
+    pub krate_spans: &'ctx diag::KrateSpans<'ctx>,
     /// Requests for additional information the check can provide to be
     /// serialized to the diagnostic
     pub serialize_extra: bool,
@@ -448,6 +462,8 @@ pub struct CheckCtx<'ctx, T> {
     /// Log level specified by the user, may be used by checks to determine what
     /// information to emit in diagnostics
     pub log_level: log::LevelFilter,
+    /// Files that can show span information in diagnostics
+    pub files: &'ctx diag::Files,
 }
 
 /// Checks if a version satisfies the specifies the specified version requirement.
@@ -464,12 +480,14 @@ pub fn match_krate(krate: &Krate, pid: &cfg::PackageSpec) -> bool {
 
 use sources::cfg::GitSpec;
 
+/// Normalizes the URL so that different representations can be compared to each other.
+///
+/// At the moment we just remove a tailing `.git` but there are more possible optimisations.
+///
+/// See <https://github.com/rust-lang/cargo/blob/1f6c6bd5e7bbdf596f7e88e6db347af5268ab113/src/cargo/util/canonical_url.rs#L31-L57>
+/// for what cargo does
 #[inline]
-pub(crate) fn normalize_git_url(url: &mut Url) -> GitSpec {
-    // Normalizes the URL so that different representations can be compared to each other.
-    // At the moment we just remove a tailing `.git` but there are more possible optimisations.
-    // See https://github.com/rust-lang/cargo/blob/1f6c6bd5e7bbdf596f7e88e6db347af5268ab113/src/cargo/util/canonical_url.rs#L31-L57
-    // for what cargo does
+pub(crate) fn normalize_git_url(url: &mut Url) -> (GitSpec, Option<String>) {
     const GIT_EXT: &str = ".git";
 
     let needs_chopping = url.path().ends_with(&GIT_EXT);
@@ -486,14 +504,17 @@ pub(crate) fn normalize_git_url(url: &mut Url) -> GitSpec {
     }
 
     let mut spec = GitSpec::Any;
+    let mut spec_value = None;
 
-    for (k, _v) in url.query_pairs() {
+    for (k, v) in url.query_pairs() {
         spec = match k.as_ref() {
             "branch" | "ref" => GitSpec::Branch,
             "tag" => GitSpec::Tag,
             "rev" => GitSpec::Rev,
             _ => continue,
         };
+
+        spec_value = Some(v.into_owned());
     }
 
     if url
@@ -513,12 +534,13 @@ pub(crate) fn normalize_git_url(url: &mut Url) -> GitSpec {
                 write!(&mut nq, "{k}={v}&").unwrap();
             }
 
+            // pop trailing &
             nq.pop();
             url.set_query(Some(&nq));
         }
     }
 
-    spec
+    (spec, spec_value)
 }
 
 /// Helper function to convert a std `PathBuf` to a camino one
diff --git a/src/licenses.rs b/src/licenses.rs
index 3682d15c4..5d1db366e 100644
--- a/src/licenses.rs
+++ b/src/licenses.rs
@@ -21,8 +21,8 @@ use crate::{
     LintLevel,
 };
 use cfg::BlanketAgreement;
-pub use gather::{Gatherer, LicenseInfo, LicenseStore};
-use gather::{KrateLicense, LicenseExprInfo, LicenseExprSource, Summary};
+pub use gather::{Gatherer, LicenseInfo, LicenseStore, Summary};
+use gather::{KrateLicense, LicenseExprInfo, LicenseExprSource};
 
 pub use diags::Code;
 
diff --git a/src/licenses/gather.rs b/src/licenses/gather.rs
index 298f3287d..81f3016c3 100644
--- a/src/licenses/gather.rs
+++ b/src/licenses/gather.rs
@@ -807,6 +807,7 @@ impl Gatherer {
 #[cfg(test)]
 mod test {
     #[test]
+    #[allow(clippy::disallowed_macros)]
     fn normalizes_line_endings() {
         let pf = super::get_file_source(
             crate::Path::new("./tests/"),
diff --git a/src/licenses/snapshots/cargo_deny__licenses__cfg__test__deserializes_licenses_cfg-2.snap b/src/licenses/snapshots/cargo_deny__licenses__cfg__test__deserializes_licenses_cfg-2.snap
index 3f1abe8ed..8468309c0 100644
--- a/src/licenses/snapshots/cargo_deny__licenses__cfg__test__deserializes_licenses_cfg-2.snap
+++ b/src/licenses/snapshots/cargo_deny__licenses__cfg__test__deserializes_licenses_cfg-2.snap
@@ -3,7 +3,7 @@ source: src/licenses/cfg.rs
 expression: validated
 ---
 {
-  "file_id": 1,
+  "file_id": 0,
   "private": {
     "ignore": true,
     "ignore_sources": [],
@@ -45,7 +45,7 @@ expression: validated
       "allowed": [
         "Zlib"
       ],
-      "file_id": 1
+      "file_id": 0
     }
   ],
   "ignore_sources": [],
diff --git a/src/snapshots/cargo_deny__diag__test__codes_unique.snap b/src/snapshots/cargo_deny__diag__test__codes_unique.snap
index 54be5a0f9..ec0cc7fb2 100644
--- a/src/snapshots/cargo_deny__diag__test__codes_unique.snap
+++ b/src/snapshots/cargo_deny__diag__test__codes_unique.snap
@@ -52,10 +52,13 @@ expression: unique
     "unmatched-skip-root",
     "unmatched-source",
     "unmatched-wrapper",
+    "unresolved-workspace-dependency",
     "unsound",
+    "unused-workspace-dependency",
     "unused-wrapper",
     "vulnerability",
     "wildcard",
+    "workspace-duplicate",
     "yanked",
     "yanked-ignored",
     "yanked-not-detected",
diff --git a/src/sources.rs b/src/sources.rs
index 988168406..41c08b0ce 100644
--- a/src/sources.rs
+++ b/src/sources.rs
@@ -37,7 +37,7 @@ pub fn check(ctx: crate::CheckCtx<'_, ValidConfig>, sink: impl Into<ErrorSink>)
         )
     });
 
-    for (i, krate) in ctx.krates.krates().enumerate() {
+    for krate in ctx.krates.krates() {
         let source = match &krate.source {
             Some(source) => source,
             None => continue,
@@ -47,9 +47,8 @@ pub fn check(ctx: crate::CheckCtx<'_, ValidConfig>, sink: impl Into<ErrorSink>)
 
         let mut sl = None;
         let label = || {
-            let span = &ctx.krate_spans[i];
-            Label::primary(ctx.krate_spans.file_id, span.source..span.total.end)
-                .with_message("source")
+            let span = ctx.krate_spans.lock_span(&krate.id);
+            Label::primary(ctx.krate_spans.lock_id, span.source).with_message("source")
         };
 
         // get allowed list of sources to check
diff --git a/src/sources/cfg.rs b/src/sources/cfg.rs
index ac1db8aab..aea6da2f5 100644
--- a/src/sources/cfg.rs
+++ b/src/sources/cfg.rs
@@ -48,11 +48,10 @@ impl<'de> Deserialize<'de> for Orgs {
 )]
 #[strum(serialize_all = "kebab-case")]
 pub enum GitSpec {
-    /// Specifies the HEAD of the `master` branch, though eventually this might
-    /// change to the default branch
+    /// Specifies the `HEAD` of the remote
     #[default]
     Any,
-    /// Specifies the HEAD of a particular branch
+    /// Specifies the `HEAD` of a particular branch
     Branch,
     /// Specifies the commit pointed to by a particular tag
     Tag,
diff --git a/src/sources/snapshots/cargo_deny__sources__cfg__test__deserializes_sources_cfg-2.snap b/src/sources/snapshots/cargo_deny__sources__cfg__test__deserializes_sources_cfg-2.snap
index bbb0b31a2..8d0a78dad 100644
--- a/src/sources/snapshots/cargo_deny__sources__cfg__test__deserializes_sources_cfg-2.snap
+++ b/src/sources/snapshots/cargo_deny__sources__cfg__test__deserializes_sources_cfg-2.snap
@@ -3,9 +3,7 @@ source: src/sources/cfg.rs
 expression: validated
 ---
 ValidConfig {
-    file_id: FileId(
-        1,
-    ),
+    file_id: 0,
     unknown_registry: Allow,
     unknown_git: Deny,
     allowed_sources: [
diff --git a/src/test_utils.rs b/src/test_utils.rs
index 1e809ba50..467b84514 100644
--- a/src/test_utils.rs
+++ b/src/test_utils.rs
@@ -1,6 +1,6 @@
 use crate::{
     cfg::ValidationContext,
-    diag::{self, CargoSpans, ErrorSink, FileId, Files, KrateSpans, PackChannel},
+    diag::{self, ErrorSink, FileId, Files, KrateSpans, PackChannel},
     CheckCtx, PathBuf,
 };
 
@@ -117,7 +117,7 @@ impl<T> ConfigData<T>
 where
     T: toml_span::DeserializeOwned,
 {
-    pub fn load_str(name: impl Into<std::ffi::OsString>, contents: impl Into<String>) -> Self {
+    pub fn load_str(name: impl Into<crate::PathBuf>, contents: impl Into<String>) -> Self {
         let contents: String = contents.into();
 
         let res = {
@@ -219,39 +219,36 @@ pub fn gather_diagnostics<C, VC, R>(
 where
     C: crate::UnvalidatedConfig<ValidCfg = VC>,
     VC: Send,
-    R: FnOnce(CheckCtx<'_, VC>, CargoSpans, PackChannel, &mut Files) + Send,
+    R: FnOnce(CheckCtx<'_, VC>, PackChannel) + Send,
 {
-    gather_diagnostics_with_files(krates, test_name, cfg, Files::new(), runner)
+    let ctx = setup(krates, test_name, cfg);
+    run_gather(ctx, runner)
 }
 
-pub fn gather_diagnostics_with_files<C, VC, R>(
-    krates: &crate::Krates,
+pub struct GatherCtx<'k, VC> {
+    pub krates: &'k crate::Krates,
+    pub files: crate::diag::Files,
+    pub valid_cfg: VC,
+    spans: crate::diag::KrateSpans<'k>,
+}
+
+pub fn setup<'k, C, VC>(
+    krates: &'k crate::Krates,
     test_name: &str,
     cfg: Config<C>,
-    mut files: Files,
-    runner: R,
-) -> Vec<serde_json::Value>
+) -> GatherCtx<'k, VC>
 where
     C: crate::UnvalidatedConfig<ValidCfg = VC>,
     VC: Send,
-    R: FnOnce(CheckCtx<'_, VC>, CargoSpans, PackChannel, &mut Files) + Send,
 {
-    let (spans, content, hashmap) = KrateSpans::synthesize(krates);
-
-    let spans_id = files.add(format!("{test_name}/Cargo.lock"), content);
-    let spans = KrateSpans::with_spans(spans, spans_id);
+    let mut files = crate::diag::Files::new();
+    let spans = KrateSpans::synthesize(krates, test_name, &mut files);
 
     let config = cfg.deserialized;
     let cfg_id = files.add(format!("{test_name}.toml"), cfg.config);
 
-    let mut newmap = CargoSpans::new();
-    for (key, val) in hashmap {
-        let cargo_id = files.add(val.0, val.1);
-        newmap.insert(key, (cargo_id, val.2));
-    }
-
     let mut cfg_diags = Vec::new();
-    let cfg = config.validate(crate::cfg::ValidationContext {
+    let valid_cfg = config.validate(crate::cfg::ValidationContext {
         cfg_id,
         files: &mut files,
         diagnostics: &mut cfg_diags,
@@ -264,21 +261,35 @@ where
         panic!("encountered errors validating config: {cfg_diags:#?}");
     }
 
+    GatherCtx {
+        krates,
+        files,
+        valid_cfg,
+        spans,
+    }
+}
+
+pub fn run_gather<VC, R>(ctx: GatherCtx<'_, VC>, runner: R) -> Vec<serde_json::Value>
+where
+    VC: Send,
+    R: FnOnce(CheckCtx<'_, VC>, PackChannel) + Send,
+{
     let (tx, rx) = crossbeam::channel::unbounded();
 
-    let grapher = diag::InclusionGrapher::new(krates);
+    let grapher = diag::InclusionGrapher::new(ctx.krates);
 
     let (_, gathered) = rayon::join(
         || {
-            let ctx = crate::CheckCtx {
-                krates,
-                krate_spans: &spans,
-                cfg,
+            let cctx = crate::CheckCtx {
+                krates: ctx.krates,
+                krate_spans: &ctx.spans,
+                cfg: ctx.valid_cfg,
                 serialize_extra: true,
                 colorize: false,
                 log_level: log::LevelFilter::Info,
+                files: &ctx.files,
             };
-            runner(ctx, newmap, tx, &mut files);
+            runner(cctx, tx);
         },
         || {
             let mut diagnostics = Vec::new();
@@ -309,7 +320,7 @@ where
     gathered
         .unwrap()
         .into_iter()
-        .map(|d| diag::diag_to_json(d, &files, Some(&grapher)))
+        .map(|d| diag::diag_to_json(d, &ctx.files, Some(&grapher)))
         .collect()
 }
 
@@ -364,8 +375,8 @@ pub fn gather_bans(
     let krates = kg.gather();
     let cfg = cfg.into();
 
-    gather_diagnostics::<crate::bans::cfg::Config, _, _>(&krates, name, cfg, |ctx, cs, tx, _| {
-        crate::bans::check(ctx, None, cs, tx);
+    gather_diagnostics::<crate::bans::cfg::Config, _, _>(&krates, name, cfg, |ctx, tx| {
+        crate::bans::check(ctx, None, tx);
     })
 }
 
@@ -379,11 +390,10 @@ pub fn gather_bans_with_overrides(
     let krates = kg.gather();
     let cfg = cfg.into();
 
-    gather_diagnostics::<crate::bans::cfg::Config, _, _>(&krates, name, cfg, |ctx, cs, tx, _| {
+    gather_diagnostics::<crate::bans::cfg::Config, _, _>(&krates, name, cfg, |ctx, tx| {
         crate::bans::check(
             ctx,
             None,
-            cs,
             ErrorSink {
                 overrides: Some(std::sync::Arc::new(overrides)),
                 channel: tx,
diff --git a/tests/advisories.rs b/tests/advisories.rs
index 610a52802..1bfa83d61 100644
--- a/tests/advisories.rs
+++ b/tests/advisories.rs
@@ -68,7 +68,7 @@ fn detects_vulnerabilities() {
     let cfg = tu::Config::new("vulnerability = 'deny'");
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -91,7 +91,7 @@ fn detects_unmaintained() {
     let cfg = tu::Config::new("unmaintained = 'warn'");
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -113,7 +113,7 @@ fn detects_unsound() {
     let cfg = tu::Config::new("unsound = 'warn'");
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -144,7 +144,7 @@ ignore = [
     );
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -214,11 +214,8 @@ fn detects_yanked() {
             cache: indices.cache.clone(),
         };
 
-        let diags = tu::gather_diagnostics::<cfg::Config, _, _>(
-            &krates,
-            func_name!(),
-            cfg,
-            |ctx, _, tx, _| {
+        let diags =
+            tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
                 advisories::check(
                     ctx,
                     &dbs,
@@ -226,8 +223,7 @@ fn detects_yanked() {
                     Some(indices),
                     tx,
                 );
-            },
-        );
+            });
 
         let diags: Vec<_> = diags
             .into_iter()
@@ -256,11 +252,8 @@ vulnerability = "allow"
 "#,
         );
 
-        let diags = tu::gather_diagnostics::<cfg::Config, _, _>(
-            &krates,
-            func_name!(),
-            cfg,
-            |ctx, _, tx, _| {
+        let diags =
+            tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
                 advisories::check(
                     ctx,
                     &dbs,
@@ -268,8 +261,7 @@ vulnerability = "allow"
                     Some(indices),
                     tx,
                 );
-            },
-        );
+            });
 
         let diags: Vec<_> = diags
             .into_iter()
@@ -316,7 +308,7 @@ fn warns_on_index_failures() {
     };
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -347,7 +339,7 @@ fn warns_on_ignored_and_withdrawn() {
     );
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -520,6 +512,7 @@ fn validate_fetch(fetch: Fetch) {
 /// Validates we can fetch advisory db updates with gix
 #[test]
 fn fetches_with_gix() {
+    #[allow(clippy::disallowed_macros)]
     if std::env::var_os("CI").is_some() && cfg!(target_os = "macos") {
         println!("consistently times out, so tired");
         return;
@@ -531,6 +524,7 @@ fn fetches_with_gix() {
 /// Validates we can fetch advisory db updates with git
 #[test]
 fn fetches_with_git() {
+    #[allow(clippy::disallowed_macros)]
     if std::env::var_os("CI").is_some() && cfg!(target_os = "macos") {
         println!("consistently times out, so tired");
         return;
@@ -692,7 +686,7 @@ fn crates_io_source_replacement() {
     let dbs = advisories::DbSet { dbs: Vec::new() };
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
@@ -802,7 +796,7 @@ fn crates_io_source_replacement() {
     let cfg = tu::Config::new("yanked = 'deny'\nunmaintained = 'allow'\nvulnerability = 'allow'");
 
     let diags =
-        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, _, tx, _| {
+        tu::gather_diagnostics::<cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
             advisories::check(
                 ctx,
                 &dbs,
diff --git a/tests/bans.rs b/tests/bans.rs
index 18fcf577e..c12335a71 100644
--- a/tests/bans.rs
+++ b/tests/bans.rs
@@ -183,14 +183,13 @@ multiple-versions-include-dev = true
     let dup_graphs = std::sync::Arc::new(parking_lot::Mutex::new(Vec::new()));
 
     let duped_graphs = dup_graphs.clone();
-    gather_diagnostics::<bans::cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, cs, tx, _f| {
+    gather_diagnostics::<bans::cfg::Config, _, _>(&krates, func_name!(), cfg, |ctx, tx| {
         bans::check(
             ctx,
             Some(Box::new(move |dg| {
                 duped_graphs.lock().push(dg);
                 Ok(())
             })),
-            cs,
             tx,
         );
     });
@@ -271,3 +270,24 @@ deny = [
 
     insta::assert_json_snapshot!(diags);
 }
+
+/// Ensures that duplicate workspace items are found and linted
+#[test]
+fn deny_duplicate_workspace_items() {
+    let diags = gather_bans(
+        func_name!(),
+        KrateGather {
+            name: "workspace",
+            no_default_features: true,
+            targets: &["x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"],
+            ..Default::default()
+        },
+        r#"
+multiple-versions = 'allow'
+workspace-duplicates = 'deny'
+unused-workspace-dependencies = 'warn'
+"#,
+    );
+
+    insta::assert_json_snapshot!(diags);
+}
diff --git a/tests/cfg/bans.toml b/tests/cfg/bans.toml
index cf7143d83..35e6450c1 100644
--- a/tests/cfg/bans.toml
+++ b/tests/cfg/bans.toml
@@ -1,5 +1,6 @@
 [bans]
 multiple-versions = "deny"
+workspace-duplicates = "warn"
 wildcards = "deny"
 allow-wildcard-paths = true
 highlight = "simplest-path"
diff --git a/tests/licenses.rs b/tests/licenses.rs
index 2fd8f9536..5ccabd2d2 100644
--- a/tests/licenses.rs
+++ b/tests/licenses.rs
@@ -19,6 +19,24 @@ fn store() -> Arc<licenses::LicenseStore> {
     }
 }
 
+fn setup<'k>(
+    krates: &'k crate::Krates,
+    name: &str,
+    cfg: tu::Config<Config>,
+) -> (
+    tu::GatherCtx<'k, licenses::cfg::ValidConfig>,
+    licenses::Summary<'k>,
+) {
+    let mut ctx = tu::setup(krates, name, cfg);
+
+    let gatherer = licenses::Gatherer::default()
+        .with_store(store())
+        .with_confidence_threshold(0.8);
+
+    let summary = gatherer.gather(ctx.krates, &mut ctx.files, Some(&ctx.valid_cfg));
+    (ctx, summary)
+}
+
 #[inline]
 pub fn gather_licenses_with_overrides(
     name: &str,
@@ -34,29 +52,18 @@ pub fn gather_licenses_with_overrides(
         .build_with_metadata(md, krates::NoneFilter)
         .unwrap();
 
-    let gatherer = licenses::Gatherer::default()
-        .with_store(store())
-        .with_confidence_threshold(0.8);
-
-    let cfg = cfg.into();
-
-    tu::gather_diagnostics_with_files::<Config, _, _>(
-        &krates,
-        name,
-        cfg,
-        codespan::Files::new(),
-        |ctx, _cs, tx, files| {
-            let summary = gatherer.gather(ctx.krates, files, Some(&ctx.cfg));
-            crate::licenses::check(
-                ctx,
-                summary,
-                diag::ErrorSink {
-                    overrides: overrides.map(Arc::new),
-                    channel: tx,
-                },
-            );
-        },
-    )
+    let (ctx, summary) = setup(&krates, name, cfg.into());
+
+    tu::run_gather(ctx, |ctx, tx| {
+        crate::licenses::check(
+            ctx,
+            summary,
+            diag::ErrorSink {
+                overrides: overrides.map(Arc::new),
+                channel: tx,
+            },
+        );
+    })
 }
 
 #[test]
@@ -158,32 +165,23 @@ fn lax_fallback() {
         .build(cmd, krates::NoneFilter)
         .unwrap();
 
-    let gatherer = licenses::Gatherer::default()
-        .with_store(store())
-        .with_confidence_threshold(0.8);
-
     let cfg = tu::Config::<Config>::new(
         "allow = ['GPL-2.0', 'LGPL-3.0']
     unlicensed = 'deny'",
     );
 
-    let diags = tu::gather_diagnostics_with_files::<Config, _, _>(
-        &krates,
-        "lax_fallback",
-        cfg,
-        codespan::Files::new(),
-        |ctx, _cs, tx, files| {
-            let summary = gatherer.gather(ctx.krates, files, Some(&ctx.cfg));
-            crate::licenses::check(
-                ctx,
-                summary,
-                diag::ErrorSink {
-                    overrides: None,
-                    channel: tx,
-                },
-            );
-        },
-    );
+    let (ctx, summary) = setup(&krates, func_name!(), cfg);
+
+    let diags = tu::run_gather(ctx, |ctx, tx| {
+        crate::licenses::check(
+            ctx,
+            summary,
+            diag::ErrorSink {
+                overrides: None,
+                channel: tx,
+            },
+        );
+    });
 
     insta::assert_json_snapshot!(diags);
 }
@@ -198,10 +196,6 @@ fn clarifications() {
         .build(cmd, krates::NoneFilter)
         .unwrap();
 
-    let gatherer = licenses::Gatherer::default()
-        .with_store(store())
-        .with_confidence_threshold(0.8);
-
     let cfg = tu::Config::<Config>::new(
         r#"
 allow = ["MIT", "Apache-2.0", "ISC"]
@@ -233,23 +227,18 @@ license-files = [
 "#,
     );
 
-    let diags = tu::gather_diagnostics_with_files::<Config, _, _>(
-        &krates,
-        "clarifications",
-        cfg,
-        codespan::Files::new(),
-        |ctx, _cs, tx, files| {
-            let summary = gatherer.gather(ctx.krates, files, Some(&ctx.cfg));
-            crate::licenses::check(
-                ctx,
-                summary,
-                diag::ErrorSink {
-                    overrides: None,
-                    channel: tx,
-                },
-            );
-        },
-    );
+    let (ctx, summary) = setup(&krates, func_name!(), cfg);
+
+    let diags = tu::run_gather(ctx, |ctx, tx| {
+        crate::licenses::check(
+            ctx,
+            summary,
+            diag::ErrorSink {
+                overrides: None,
+                channel: tx,
+            },
+        );
+    });
 
     insta::assert_json_snapshot!(diags);
 }
@@ -285,33 +274,24 @@ fn forces_apache_over_pixar() {
         .build(cmd, krates::NoneFilter)
         .unwrap();
 
-    let gatherer = licenses::Gatherer::default()
-        .with_store(store())
-        .with_confidence_threshold(0.8);
-
     let cfg = tu::Config::new(
         r#"
     allow = ['Apache-2.0']
     "#,
     );
 
-    let diags = tu::gather_diagnostics_with_files::<Config, _, _>(
-        &krates,
-        func_name!(),
-        cfg,
-        codespan::Files::new(),
-        |ctx, _cs, tx, files| {
-            let summary = gatherer.gather(ctx.krates, files, Some(&ctx.cfg));
-            crate::licenses::check(
-                ctx,
-                summary,
-                diag::ErrorSink {
-                    overrides: None,
-                    channel: tx,
-                },
-            );
-        },
-    );
+    let (ctx, summary) = setup(&krates, func_name!(), cfg);
+
+    let diags = tu::run_gather(ctx, |ctx, tx| {
+        crate::licenses::check(
+            ctx,
+            summary,
+            diag::ErrorSink {
+                overrides: None,
+                channel: tx,
+            },
+        );
+    });
 
     insta::assert_json_snapshot!(diags);
 }
diff --git a/tests/snapshots/bans__allow_path_wildcards_public_package.snap b/tests/snapshots/bans__allow_path_wildcards_public_package.snap
index 6fc6f47f6..9a391c953 100644
--- a/tests/snapshots/bans__allow_path_wildcards_public_package.snap
+++ b/tests/snapshots/bans__allow_path_wildcards_public_package.snap
@@ -16,10 +16,10 @@ expression: diags
       ],
       "labels": [
         {
-          "column": 1,
-          "line": 1,
-          "message": "wildcard crate entry",
-          "span": "wildcards-test-allow-paths-dependency = '*'"
+          "column": 41,
+          "line": 9,
+          "message": "wildcard dependency",
+          "span": "{ path = \"../allow-paths-dependency\" }"
         }
       ],
       "message": "found 1 wildcard dependency for crate 'wildcards-test-allow-paths-public'. allow-wildcard-paths is enabled, but does not apply to public crates as crates.io disallows path dependencies.",
diff --git a/tests/snapshots/bans__deny_duplicate_workspace_items.snap b/tests/snapshots/bans__deny_duplicate_workspace_items.snap
new file mode 100644
index 000000000..84bd3fa4a
--- /dev/null
+++ b/tests/snapshots/bans__deny_duplicate_workspace_items.snap
@@ -0,0 +1,567 @@
+---
+source: tests/bans.rs
+expression: diags
+---
+[
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "crate-two",
+            "version": "0.1.0"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "kind": "build",
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 23,
+          "message": "workspace dependency",
+          "span": "crate-two"
+        },
+        {
+          "column": 1,
+          "line": 16,
+          "message": "",
+          "span": "crate-two"
+        }
+      ],
+      "message": "crate crate-two = 0.1.0 is used 2 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "member-one",
+            "version": "0.1.0"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "kind": "build",
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  }
+                }
+              ]
+            },
+            {
+              "Krate": {
+                "name": "root",
+                "version": "0.1.0"
+              },
+              "repeat": true
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 20,
+          "message": "workspace dependency",
+          "span": "member-one"
+        },
+        {
+          "column": 1,
+          "line": 20,
+          "message": "",
+          "span": "member"
+        },
+        {
+          "column": 47,
+          "line": 20,
+          "message": "note the dependency is renamed",
+          "span": "member-one"
+        }
+      ],
+      "message": "crate member-one = 0.1.0 is used 2 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "spdx",
+            "version": "0.10.6"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "kind": "dev",
+                "name": "member-one",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "kind": "build",
+                    "name": "member-two",
+                    "version": "0.1.0"
+                  },
+                  "parents": [
+                    {
+                      "Krate": {
+                        "name": "root",
+                        "version": "0.1.0"
+                      }
+                    }
+                  ]
+                },
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  },
+                  "repeat": true
+                }
+              ]
+            },
+            {
+              "Krate": {
+                "kind": "dev",
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "repeat": true
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 15,
+          "message": "workspace dependency",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 7,
+          "message": "",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 14,
+          "message": "",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 13,
+          "message": "",
+          "span": "spdx"
+        }
+      ],
+      "message": "crate spdx = 0.10.6 is used 3 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "spdx",
+            "version": "0.6.0"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "kind": "build",
+                "name": "member-one",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "kind": "build",
+                    "name": "member-two",
+                    "version": "0.1.0"
+                  },
+                  "parents": [
+                    {
+                      "Krate": {
+                        "name": "root",
+                        "version": "0.1.0"
+                      }
+                    }
+                  ]
+                },
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  },
+                  "repeat": true
+                }
+              ]
+            },
+            {
+              "Krate": {
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "repeat": true
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 35,
+          "message": "patched workspace dependency",
+          "span": "spdx-very-old"
+        },
+        {
+          "column": 1,
+          "line": 18,
+          "message": "note this is the original dependency that is patched",
+          "span": "spdx-very-old"
+        },
+        {
+          "column": 92,
+          "line": 35,
+          "message": "note the workspace dependency is renamed",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 19,
+          "message": "",
+          "span": "spdx-very-old"
+        },
+        {
+          "column": 109,
+          "line": 19,
+          "message": "note the dependency is renamed",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 7,
+          "message": "",
+          "span": "spdx-very-old"
+        },
+        {
+          "column": 109,
+          "line": 7,
+          "message": "note the dependency is renamed",
+          "span": "spdx"
+        }
+      ],
+      "message": "crate spdx = 0.6.0 is used 2 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "spdx",
+            "version": "0.7.0"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "kind": "dev",
+                "name": "member-one",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "kind": "build",
+                    "name": "member-two",
+                    "version": "0.1.0"
+                  },
+                  "parents": [
+                    {
+                      "Krate": {
+                        "name": "root",
+                        "version": "0.1.0"
+                      }
+                    }
+                  ]
+                },
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  },
+                  "repeat": true
+                }
+              ]
+            },
+            {
+              "Krate": {
+                "kind": "dev",
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "repeat": true
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 19,
+          "message": "workspace dependency",
+          "span": "spdx-git"
+        },
+        {
+          "column": 87,
+          "line": 19,
+          "message": "note the workspace dependency is renamed",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 15,
+          "message": "",
+          "span": "spdx-git"
+        },
+        {
+          "column": 87,
+          "line": 15,
+          "message": "note the dependency is renamed",
+          "span": "spdx"
+        }
+      ],
+      "message": "crate spdx = 0.7.0 is used 2 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "spdx",
+            "version": "0.9.0"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "kind": "build",
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  }
+                }
+              ]
+            },
+            {
+              "Krate": {
+                "name": "root",
+                "version": "0.1.0"
+              },
+              "repeat": true
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 17,
+          "message": "workspace dependency",
+          "span": "spdx-old"
+        },
+        {
+          "column": 42,
+          "line": 17,
+          "message": "note the workspace dependency is renamed",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 19,
+          "message": "",
+          "span": "spdx"
+        },
+        {
+          "column": 1,
+          "line": 7,
+          "message": "",
+          "span": "spdx"
+        }
+      ],
+      "message": "crate spdx = 0.9.0 is used 2 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "workspace-duplicate",
+      "graphs": [
+        {
+          "Krate": {
+            "name": "wildcards-test-allow-git",
+            "version": "0.1.0"
+          },
+          "parents": [
+            {
+              "Krate": {
+                "name": "member-one",
+                "version": "0.1.0"
+              },
+              "parents": [
+                {
+                  "Krate": {
+                    "kind": "build",
+                    "name": "member-two",
+                    "version": "0.1.0"
+                  },
+                  "parents": [
+                    {
+                      "Krate": {
+                        "name": "root",
+                        "version": "0.1.0"
+                      }
+                    }
+                  ]
+                },
+                {
+                  "Krate": {
+                    "name": "root",
+                    "version": "0.1.0"
+                  },
+                  "repeat": true
+                }
+              ]
+            },
+            {
+              "Krate": {
+                "kind": "build",
+                "name": "member-two",
+                "version": "0.1.0"
+              },
+              "repeat": true
+            }
+          ]
+        }
+      ],
+      "labels": [
+        {
+          "column": 1,
+          "line": 27,
+          "message": "workspace dependency",
+          "span": "wildcards-test-allow-git"
+        },
+        {
+          "column": 1,
+          "line": 8,
+          "message": "",
+          "span": "wildcards-test-allow-git"
+        }
+      ],
+      "message": "crate wildcards-test-allow-git = 0.1.0 is used 2 times in the workspace, but not all declarations use the shared workspace dependency",
+      "severity": "error"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "unused-workspace-dependency",
+      "graphs": [],
+      "labels": [
+        {
+          "column": 1,
+          "line": 36,
+          "message": "unused and patched workspace dependency",
+          "span": "non-existent"
+        },
+        {
+          "column": 1,
+          "line": 29,
+          "message": "note this is the original dependency that is patched",
+          "span": "non-existent"
+        },
+        {
+          "column": 90,
+          "line": 36,
+          "message": "note the dependency is renamed",
+          "span": "tinyvec"
+        }
+      ],
+      "message": "workspace dependency is declared, but unused",
+      "severity": "warning"
+    },
+    "type": "diagnostic"
+  },
+  {
+    "fields": {
+      "code": "unused-workspace-dependency",
+      "graphs": [],
+      "labels": [
+        {
+          "column": 1,
+          "line": 31,
+          "message": "unused workspace dependency",
+          "span": "unused-version"
+        },
+        {
+          "column": 48,
+          "line": 31,
+          "message": "note the dependency is renamed",
+          "span": "smallvec"
+        }
+      ],
+      "message": "workspace dependency is declared, but unused",
+      "severity": "warning"
+    },
+    "type": "diagnostic"
+  }
+]
diff --git a/tests/snapshots/bans__deny_wildcards.snap b/tests/snapshots/bans__deny_wildcards.snap
index 10ac7cde5..93968608e 100644
--- a/tests/snapshots/bans__deny_wildcards.snap
+++ b/tests/snapshots/bans__deny_wildcards.snap
@@ -16,10 +16,10 @@ expression: diags
       ],
       "labels": [
         {
-          "column": 1,
-          "line": 1,
-          "message": "wildcard crate entry",
-          "span": "ansi_term = '*'"
+          "column": 14,
+          "line": 9,
+          "message": "wildcard dependency",
+          "span": "*"
         }
       ],
       "message": "found 1 wildcard dependency for crate 'wildcards-test-crate'",
@@ -48,10 +48,10 @@ expression: diags
       ],
       "labels": [
         {
-          "column": 1,
-          "line": 1,
-          "message": "wildcard crate entry",
-          "span": "itoa = '*'"
+          "column": 9,
+          "line": 9,
+          "message": "wildcard dependency",
+          "span": "*"
         }
       ],
       "message": "found 1 wildcard dependency for crate 'wildcards-test-dep'",
diff --git a/tests/sources.rs b/tests/sources.rs
index 3125b02ad..342063bcc 100644
--- a/tests/sources.rs
+++ b/tests/sources.rs
@@ -13,7 +13,7 @@ pub fn src_check(
     let krates = kg.gather();
     let cfg = cfg.into();
 
-    tu::gather_diagnostics::<Config, _, _>(&krates, name, cfg, |ctx, _cs, tx, _files| {
+    tu::gather_diagnostics::<Config, _, _>(&krates, name, cfg, |ctx, tx| {
         sources::check(ctx, tx);
     })
 }
diff --git a/tests/test_data/wildcards/allow-git/src/lib.rs b/tests/test_data/wildcards/allow-git/src/lib.rs
new file mode 100644
index 000000000..8b1378917
--- /dev/null
+++ b/tests/test_data/wildcards/allow-git/src/lib.rs
@@ -0,0 +1 @@
+
diff --git a/tests/test_data/wildcards/allow-git/src/main.rs b/tests/test_data/wildcards/allow-git/src/main.rs
deleted file mode 100644
index f328e4d9d..000000000
--- a/tests/test_data/wildcards/allow-git/src/main.rs
+++ /dev/null
@@ -1 +0,0 @@
-fn main() {}
diff --git a/tests/test_data/wildcards/allow-paths-public/Cargo.toml b/tests/test_data/wildcards/allow-paths-public/Cargo.toml
index 2ef2b93d8..528c158a4 100644
--- a/tests/test_data/wildcards/allow-paths-public/Cargo.toml
+++ b/tests/test_data/wildcards/allow-paths-public/Cargo.toml
@@ -5,7 +5,5 @@ authors = []
 edition = "2018"
 license = "MIT"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 wildcards-test-allow-paths-dependency = { path = "../allow-paths-dependency" }
diff --git a/tests/test_data/wildcards/dependency/Cargo.toml b/tests/test_data/wildcards/dependency/Cargo.toml
index cad8fd594..d0cf60726 100644
--- a/tests/test_data/wildcards/dependency/Cargo.toml
+++ b/tests/test_data/wildcards/dependency/Cargo.toml
@@ -5,7 +5,5 @@ authors = []
 edition = "2018"
 license = "MIT"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 itoa = "*"
diff --git a/tests/test_data/wildcards/maincrate/Cargo.toml b/tests/test_data/wildcards/maincrate/Cargo.toml
index 2a128664f..f325742db 100644
--- a/tests/test_data/wildcards/maincrate/Cargo.toml
+++ b/tests/test_data/wildcards/maincrate/Cargo.toml
@@ -5,8 +5,6 @@ authors = []
 edition = "2018"
 license = "MIT"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 ansi_term = "*"
 wildcards-test-dep = { path = "../dependency", version = "0.1.0" }
diff --git a/tests/test_data/workspace/.cargo/config.toml b/tests/test_data/workspace/.cargo/config.toml
new file mode 100644
index 000000000..935ed75d4
--- /dev/null
+++ b/tests/test_data/workspace/.cargo/config.toml
@@ -0,0 +1,3 @@
+[registries]
+embark-deny-git = { index = "https://dl.cloudsmith.io/public/embark/deny/cargo/index.git" }
+embark-deny-sparse = { index = "sparse+https://cargo.cloudsmith.io/embark/deny/" }
diff --git a/tests/test_data/workspace/Cargo.lock b/tests/test_data/workspace/Cargo.lock
new file mode 100644
index 000000000..9813695d9
--- /dev/null
+++ b/tests/test_data/workspace/Cargo.lock
@@ -0,0 +1,307 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "camino"
+version = "1.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0ec6b951b160caa93cc0c7b209e5a3bff7aae9062213451ac99493cd844c239"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo-platform"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "crate-one"
+version = "0.1.0"
+source = "sparse+https://cargo.cloudsmith.io/embark/deny/"
+checksum = "a12b64b5462f14585186b282beaa160bd9b1bbcce9cf42fcace3ba20dc7ef88d"
+
+[[package]]
+name = "crate-two"
+version = "0.1.0"
+source = "registry+https://dl.cloudsmith.io/public/embark/deny/cargo/index.git"
+checksum = "d506c511495d1a0ded8cf08599097406a64afdf5b120281f628aa297ce1a0815"
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "indexmap"
+version = "2.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "krates"
+version = "0.16.6"
+source = "git+https://github.com/EmbarkStudios/krates?rev=b03ecd6f3204a1b1ec04fbaead2d0d122a3a4494#b03ecd6f3204a1b1ec04fbaead2d0d122a3a4494"
+dependencies = [
+ "cargo_metadata",
+ "cfg-expr",
+ "petgraph",
+ "semver",
+]
+
+[[package]]
+name = "member-one"
+version = "0.1.0"
+dependencies = [
+ "crate-one",
+ "smallvec",
+ "spdx 0.10.6",
+ "spdx 0.6.0",
+ "spdx 0.6.1",
+ "spdx 0.7.0",
+ "wildcards-test-allow-git",
+]
+
+[[package]]
+name = "member-two"
+version = "0.1.0"
+dependencies = [
+ "crate-two",
+ "member-one",
+ "spdx 0.10.6",
+ "spdx 0.6.0",
+ "spdx 0.7.0",
+ "spdx 0.9.0",
+ "wildcards-test-allow-git",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
+dependencies = [
+ "fixedbitset",
+ "indexmap",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "root"
+version = "0.1.0"
+dependencies = [
+ "member-one",
+ "member-two",
+ "spdx 0.9.0",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "semver"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.203"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.203"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d947f6b3163d8857ea16c4fa0dd4840d52f3041039a85decd46867eb1abef2e4"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "spdx"
+version = "0.6.0"
+source = "git+https://github.com/EmbarkStudios/spdx?tag=0.6.0#e4e4cd0e44b2716f79790aa6a030c016cd5e01f9"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "spdx"
+version = "0.6.1"
+source = "git+https://github.com/EmbarkStudios/spdx?tag=0.6.1#3bd22313e35f76bd11d04feceabc3ad4b8518c5f"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "spdx"
+version = "0.7.0"
+source = "git+https://github.com/EmbarkStudios/spdx?tag=0.7.0#c3e1a50787768a1df103ee93466986063bfb9122"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "spdx"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a346909b3fd07776f9b96b98d4a58e3666f831c9a672c279b10f795a34c36425"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "spdx"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47317bbaf63785b53861e1ae2d11b80d6b624211d42cb20efcd210ee6f8a14bc"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901fa70d88b9d6c98022e23b4136f9f3e54e4662c3bc1bd1d84a42a9a0f0c1e9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "wildcards-test-allow-git"
+version = "0.1.0"
+dependencies = [
+ "krates",
+]
+
+[[patch.unused]]
+name = "tinyvec"
+version = "1.6.1"
+source = "git+https://github.com/Lokathor/tinyvec?tag=v1.6.1#612c87d0d799b98c662ca44943b6531120d2168b"
diff --git a/tests/test_data/workspace/Cargo.toml b/tests/test_data/workspace/Cargo.toml
new file mode 100644
index 000000000..b174500b4
--- /dev/null
+++ b/tests/test_data/workspace/Cargo.toml
@@ -0,0 +1,36 @@
+[package]
+name = "root"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+spdx = "0.9"
+member-one.workspace = true
+member-two.workspace = true
+
+[workspace]
+members = ["crates/*", "."]
+
+[workspace.dependencies]
+spdx = "0.10"
+# Validates that we recognize the workspace dependency exists even though it is renamed
+spdx-old = { version = "0.9", package = "spdx" }
+spdx-very-old = { version = "0.8", package = "spdx" }
+spdx-git = { git = "https://github.com/EmbarkStudios/spdx", tag = "0.7.0", package = "spdx" }
+member-one = { path = "crates/member-one" }
+member-two = { path = "crates/member-two" }
+# Validates we can find workspace dependency sources from non-crates.io registries
+crate-two = { version = "0.1.0", registry = "embark-deny-git" }
+crate-one = { version = "0.1.0", registry = "embark-deny-sparse" }
+# Validates we can find workspace dependency sources even if the crate is outside
+# the workspace root
+wildcards-test-allow-git = { path = "../wildcards/allow-git" }
+# This crate is not in the graph at all
+non-existent = { version = "1.6", package = "tinyvec" }
+# This crate is in the graph, but not this particular version
+unused-version = { version = "0.1", package = "smallvec" }
+
+[patch.crates-io]
+# Validates we take patches into account when matching workspace dependency sources
+spdx-very-old = { git = "https://github.com/EmbarkStudios/spdx", tag = "0.6.0", package = "spdx" }
+non-existent = { git = "https://github.com/Lokathor/tinyvec", tag = "v1.6.1", package = "tinyvec" }
diff --git a/tests/test_data/workspace/crates/member-one/Cargo.toml b/tests/test_data/workspace/crates/member-one/Cargo.toml
new file mode 100644
index 000000000..2e86d64dd
--- /dev/null
+++ b/tests/test_data/workspace/crates/member-one/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "member-one"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+spdx = { version = "0.10" }
+wildcards-test-allow-git = { path = "../../../wildcards/allow-git" }
+
+[target.'cfg(unix)'.dependencies]
+crate-one.workspace = true
+
+[dev-dependencies]
+spdx = "0.10"
+spdx-git = { git = "https://github.com/EmbarkStudios/spdx", tag = "0.7.0", package = "spdx" }
+spdx-git2 = { git = "https://github.com/EmbarkStudios/spdx", tag = "0.6.1", package = "spdx" }
+
+[build-dependencies]
+spdx-very-old = { version = "0.6", git = "https://github.com/EmbarkStudios/spdx", tag = "0.6.0", package = "spdx" }
+spdx = { version = "1.13", package = "smallvec" }
diff --git a/tests/test_data/workspace/crates/member-one/src/lib.rs b/tests/test_data/workspace/crates/member-one/src/lib.rs
new file mode 100644
index 000000000..8b1378917
--- /dev/null
+++ b/tests/test_data/workspace/crates/member-one/src/lib.rs
@@ -0,0 +1 @@
+
diff --git a/tests/test_data/workspace/crates/member-two/Cargo.toml b/tests/test_data/workspace/crates/member-two/Cargo.toml
new file mode 100644
index 000000000..c789e668e
--- /dev/null
+++ b/tests/test_data/workspace/crates/member-two/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "member-two"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+spdx-very-old = { version = "0.6", git = "https://github.com/EmbarkStudios/spdx", tag = "0.6.0", package = "spdx" }
+
+[dev-dependencies]
+spdx-git.workspace = true
+
+[target.'cfg(target_os = "windows")'.dev-dependencies]
+spdx = "0.10"
+
+[target.'cfg(target_os="windows")'.dev-dependencies]
+crate-two = { version = "0.1.0", registry = "embark-deny-git" }
+
+[build-dependencies]
+spdx = "0.9"
+member = { path = "../member-one", package = "member-one" }
+
+[target.'cfg(windows)'.build-dependencies]
+crate-two.workspace = true
+wildcards-test-allow-git.workspace = true
diff --git a/tests/test_data/workspace/crates/member-two/src/lib.rs b/tests/test_data/workspace/crates/member-two/src/lib.rs
new file mode 100644
index 000000000..7d12d9af8
--- /dev/null
+++ b/tests/test_data/workspace/crates/member-two/src/lib.rs
@@ -0,0 +1,14 @@
+pub fn add(left: usize, right: usize) -> usize {
+    left + right
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn it_works() {
+        let result = add(2, 2);
+        assert_eq!(result, 4);
+    }
+}
diff --git a/tests/test_data/workspace/deny.toml b/tests/test_data/workspace/deny.toml
new file mode 100644
index 000000000..9552a13e7
--- /dev/null
+++ b/tests/test_data/workspace/deny.toml
@@ -0,0 +1,5 @@
+# Makes local iteration easier
+[bans]
+multiple-versions = 'allow'
+workspace-duplicates = 'deny'
+unused-workspace-dependencies = 'deny'
diff --git a/tests/test_data/workspace/src/lib.rs b/tests/test_data/workspace/src/lib.rs
new file mode 100644
index 000000000..8b1378917
--- /dev/null
+++ b/tests/test_data/workspace/src/lib.rs
@@ -0,0 +1 @@
+