v2.0.11

[0.18.2] - 2025-03-10

Added

• PR#753 resolved #752 by adding back the advisories.unmaintained config option. See the docs for how it can be used. The default matches the current behavior, which is to error on any unmaintained advisory, but adding unmaintained = "workspace" to the [advisories] table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.

[0.18.1] - 2025-02-27

Fixed

• PR#749 updated krates to pull in the fix for EmbarkStudios/krates#100.

v2.0.10

• PR#96 resolved #94 by switching to the directory the manifest path is located in and doing rustup toolchain install if rustup show failed due to any reason

Release 2.0.9 - cargo-deny 0.18.0

• d8395c1 removed the rustup update.

v2.0.8

• PR#93 pins to a hash instead of tag, avoiding future breakage from eg. rustup changes.

Release 2.0.7 - cargo-deny 0.18.0

• PR#92 fixed an issue introduced by the latest rustup release.

Release 2.0.6 - cargo-deny 0.18.0

Changed

• PR#746 changed the directory naming of advisory databases, again, so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default https://github.com/rustsec/advisory-db will now be placed in $CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.
• PR#746 changed the MSRV to 1.85.0 and uses edition 2024.

Fixed

• PR#746 fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail.

Release 2.0.5 - cargo-deny 0.17.0

Changed

• PR#745 updated tame-index to 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.
• PR#745 now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms.

Release 2.0.4 - cargo-deny 0.16.3

• Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes

Release 2.0.3 - cargo-deny 0.16.3

Changed

• PR#721 updated rust-version to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #720.
• PR#722 updated the SPDX license list to 3.25.0.

Fixed

• PR#726 resolved #725 by adding the unnecessary-skip diagnostic, emitted when there is a skip configured for a crate that only has one version in the graph.

Release 2.0.2 - cargo-deny 0.16.2

Fixed

• PR#703 resolved #696 by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in PR#611.
• PR#719 updated to krates -> 0.17.5, fixing an issue where cargo-deny could panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.
• PR#719 resolved #706 by removing a warning issued when users use ignored scheme modifiers for source urls.
• PR#719 resolved #718 by updating the book with missing arguments.

Added

• PR#715 resolved #714 by adding support for Edition 2024. Thanks @kpcyrd!
• PR#710 resolved #708 by allowing for unpublished workspace crates to be excluded from the dependency graph that checks are run against, either via the --exclude-unpublished CLI argument or the graph.exclude-unpublished config field. Thanks @Tastaturtaste!

Changed

• PR#711 updated goblin -> 0.9.2
• PR#713 updated various crates, notably rustsec -> 0.30.