fix cargo deny check

.github/workflows/fuzz.yml

@@ -29,6 +29,7 @@ jobs:
           version: ">= 416.0.0"
       - run: rustup default nightly
       - run: opam install ocamlbuild
+      # See Cargo.toml for reasons
       - run: cargo install --git https://github.com/Ekleog-NEAR/bolero --rev 362328af9f0539f9d6ee62bb4334afaa0a71b572
       - run: opam exec -- cargo +nightly bolero build-clusterfuzz --all-features
       - run: |

Cargo.toml

@@ -44,10 +44,11 @@ wast = { version = "52", optional = true }
 
 [dev-dependencies]
 arbitrary = { version = "1.3", features = ["derive"] }
-bolero = { git = "https://github.com/Ekleog-NEAR/bolero", rev = "362328af9f0539f9d6ee62bb4334afaa0a71b572", features = ["arbitrary"] }
-criterion = "0.4.0"
+# Need a fork of bolero for camshaft/bolero#161, #162 and #163. Also update fuzz.yml when they land.
+bolero = { git = "https://github.com/Ekleog-NEAR/bolero", rev = "362328af9f0539f9d6ee62bb4334afaa0a71b572", version = "0.9.0", features = ["arbitrary"] }
+criterion = "0.5.0"
 rayon = "1.6.1"
-tempfile = "3.5"
+tempfile = "3.7"
 walkdir = "2.3.0"
 wasm-instrument = "0.4"
 wasm-smith = "0.12"

deny.toml

@@ -14,8 +14,17 @@ skip = [
     { name = "windows-sys" },
     { name = "windows-targets" },
     { name = "windows_x86_64_msvc" },
+    # wasmparser 0.105 requires:
+    { name = "wasmparser", version = "0.105" },
+    { name = "hashbrown", version = "0.12" },
+    { name = "indexmap", version = "1.9" },
+    # bolero-generator-derive v0.9.2 requires:
+    { name = "syn", version = "1.0" },
 ]
 
+# our bolero fork requires:
+[sources]
+allow-git = ["https://github.com/Ekleog-NEAR/bolero?rev=362328af9f0539f9d6ee62bb4334afaa0a71b572#362328af9f0539f9d6ee62bb4334afaa0a71b572"]
 
 [licenses]
 allow = [
@@ -29,6 +38,4 @@ allow = [
 ignore = [
     # parity-wasm is only ever used for dev-dependencies
     "RUSTSEC-2022-0061",
-    # atty is only ever used for dev-dependencies
-    "RUSTSEC-2021-0145",
 ]