0.16.1

Fixed

• PR#691 fixed an issue where workspace dependencies that used the current dir '.' path component would incorrectly trigger the unused-workspace-dependency lint.

0.16.0

Removed

• PR#681 finished the deprecation introduced in PR#611, making the usage of the deprecated fields into errors.

[advisories]

The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the ignore field can be used as before.

• vulnerability - Vulnerability advisories are now deny by default
• unmaintained - Unmaintained advisories are now deny by default
• unsound - Unsound advisories are now deny by default
• notice - Notice advisories are now deny by default
• severity-threshold - The severity of vulnerabilities is now irrelevant

[licenses]

The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either allow or exceptions.

• unlicensed - Crates whose license(s) cannot be confidently determined are now always errors. The clarify field can be used to help cargo-deny determine the license.
• allow-osi-fsf-free - The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed.
• copyleft - The copyleft attribute is now irrelevant, only whether it is explicitly allowed.
• default - The default is now deny.
• deny - All licenses are now denied by default, this field added nothing.

Changed

• PR#685 follows up on PR#673, moving the fields that were added to their own separate bans.workspace-dependencies section. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, but makes it so that if not specified workspace duplicates are now deny instead of warn.

Fixed

• PR#685 resolved #682 by adding the include-path-dependencies field, allowing path dependencies to be ignored if it is false.

0.15.1

Fixed

• PR#681 fixed #680 by always stripping .git from urls when matching sources to resolved nodes as they are allowed, but (generally) have no semantic meaning and are stripped by cargo when emitting metadata.

0.15.0

Added

• PR#673 added linting of [workspace.dependencies], resolving #436 and #525.
  • Added lint workspace-duplicates, which allows checking for missing usage of workspace = true for direct workspace dependencies that are used more than once in the workspace.
  • Added lint unused-workspace-dependencies, which allows checking for dependencies declared in [workspace.dependencies] that aren't actually used.

Changed

• PR#673 changed how span information for workspace dependencies worked, which meant improvements were made to the output for the bans.wildcards lint. Previously fake cargo manifests were created that weren't even necessarily valid toml files, however now the actual cargo manifests are used, meaning that the lint will now point to the correct file and line location of the dependency declaration that uses a wildcard.
• PR#675 changed the utf-8 characters used in rendering diagnostics, inspired by rust-lang/rust#126597.
• PR#676 updated crates notably gix -> 0.64 (and tame-index).

Fixed

• PR#668 resolved #667 by adding a missing feature flag to allow local cargo registry support.

0.14.24

Changed

• PR#663 updated some crates, notably gix -> 0.63 (and tame-index).5

0.14.23

Fixed

• PR#657 resolved #652 by fixing an issue where the exit code was incorrect if logging was disabled.

Added

• PR#659 adding publishing of aarch64-unknown-linux-musl binaries.

0.14.22

Changed

• PR#653 updated jobserver -> 0.1.30
• PR#656 updated gix -> 0.62.0, reqwest -> 0.12.4, tame-index -> 0.11.0

0.14.21

Fixed

• PR#643 resolved #629 by making the hosted git (github, gitlab, bitbucket) org/user name comparison case-insensitive. Thanks @pmnlla!
• PR#649 fixed an issue where depending on the same crate multiple times by using different cfg()/triple targets could cause features to be resolved incorrectly and thus crates to be not pulled into the graph used for checking.

0.14.20

Fixed

• PR#642 resolved #641 by pinning gix-transport (and its unique dependencies) to 0.41.2 as a workaround for cargo install not using the lockfile. See this issue for more information.

0.14.19

Changed

• PR#639 updated tame-index to avoid an error if you don't used --locked.