Release 2.0.13 - cargo-deny 0.18.4

Added

• PR#779 added the --metadata-path argument to use a cargo metadata JSON file instead of calling cargo metadata, resolving #777.
• PR#782 added sources.unused-allow-source to allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing #781.

Changed

• PR#786 changed the license check output. / is no longer corrected to OR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.

Fixed

• PR#786 resolved #784 by updating spdx to a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.

Release 2.0.12 - cargo-deny 0.18.3

Changed

• PR#773 changed cargo-deny's duplicate detection to automatically ignore versions whose only dependent is another version of the same crate.

v2.0.11

[0.18.2] - 2025-03-10

Added

• PR#753 resolved #752 by adding back the advisories.unmaintained config option. See the docs for how it can be used. The default matches the current behavior, which is to error on any unmaintained advisory, but adding unmaintained = "workspace" to the [advisories] table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.

[0.18.1] - 2025-02-27

Fixed

• PR#749 updated krates to pull in the fix for EmbarkStudios/krates#100.

v2.0.10

• PR#96 resolved #94 by switching to the directory the manifest path is located in and doing rustup toolchain install if rustup show failed due to any reason

Release 2.0.9 - cargo-deny 0.18.0

• d8395c1 removed the rustup update.

v2.0.8

• PR#93 pins to a hash instead of tag, avoiding future breakage from eg. rustup changes.

Release 2.0.7 - cargo-deny 0.18.0

• PR#92 fixed an issue introduced by the latest rustup release.

Release 2.0.6 - cargo-deny 0.18.0

Changed

• PR#746 changed the directory naming of advisory databases, again, so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default https://github.com/rustsec/advisory-db will now be placed in $CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.
• PR#746 changed the MSRV to 1.85.0 and uses edition 2024.

Fixed

• PR#746 fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail.

Release 2.0.5 - cargo-deny 0.17.0

Changed

• PR#745 updated tame-index to 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.
• PR#745 now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms.

Release 2.0.4 - cargo-deny 0.16.3

• Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes