Sourced from EmbarkStudios/cargo-deny-action's releases.

Release 2.0.13 - cargo-deny 0.18.4

Added

• PR#779 added the --metadata-path argument to use a cargo metadata JSON file instead of calling cargo metadata, resolving #777.
• PR#782 added sources.unused-allow-source to allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing #781.

Changed

• PR#786 changed the license check output. / is no longer corrected to OR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.

Fixed

• PR#786 resolved #784 by updating spdx to a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.

Release 2.0.12 - cargo-deny 0.18.3

Changed

• PR#773 changed cargo-deny's duplicate detection to automatically ignore versions whose only dependent is another version of the same crate.

Release 2.0.9 - cargo-deny 0.18.0

• d8395c1 removed the rustup update.

Release 2.0.7 - cargo-deny 0.18.0

• PR#92 fixed an issue introduced by the latest rustup release.

Release 2.0.6 - cargo-deny 0.18.0

Changed

• PR#746 changed the directory naming of advisory databases, again, so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default https://github.com/rustsec/advisory-db will now be placed in $CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.
• PR#746 changed the MSRV to 1.85.0 and uses edition 2024.

Fixed

• PR#746 fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail.

Release 2.0.5 - cargo-deny 0.17.0

Changed

• PR#745 updated tame-index to 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.
• PR#745 now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms.

Release 2.0.4 - cargo-deny 0.16.3

• Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes

Release 2.0.3 - cargo-deny 0.16.3

Changed

• PR#721 updated rust-version to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #720.
• PR#722 updated the SPDX license list to 3.25.0.

Fixed

• PR#726 resolved #725 by adding the unnecessary-skip diagnostic, emitted when there is a skip configured for a crate that only has one version in the graph.

Release 2.0.2 - cargo-deny 0.16.2

Fixed

• PR#703 resolved #696 by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in PR#611.
• PR#719 updated to krates -> 0.17.5, fixing an issue where cargo-deny could panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.
• PR#719 resolved #706 by removing a warning issued when users use ignored scheme modifiers for source urls.

... (truncated)

• f2ba7ab Bump to 0.18.4
• 30f817c Bump to 0.18.3
• 6e6dcaa Add Defguard to "repositories using this action" (#100)
• 34899fc Bump to 0.18.2
• 4de59db Workaround rustup 1.28 (#96)
• d8395c1 Use rustup from base image
• 55a198a Pin to image hash (#93)
• 8d73959 Install active toolchain by default if rust-version is not passed (#92)
• 25f8f6f Fix CI
• 7800eb5 add rama to repo using this PR (#85)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)