Sourced from EmbarkStudios/cargo-deny-action's releases.

Release 2.0.15 - cargo-deny 0.19.0

Changed

• PR#802 made relative paths passed to --config be resolved relative to the current working directory (rather than the resolved manifest path's directory).
• PR#825 updated gix, reqwest, and tame-index to newer versions. The reqwest 0.13 changes means it is no longer possible to choose the source of root certificates for gix, so that decision is now left to rustls-platform-verifier. The native-certs feature has thus been removed, and cargo-deny no longer defaults to using webpki-roots.

Fixed

• PR#802 fixed path handling of paths passed to --config, resolving #748.
• PR#819 added locations to all SARIF results since that's mandatory for valid SARIF.
• PR#821 fixed compilation on an Alpine host.

Added

• PR#795 added [bans.allow-workspace] to allow workspace crates while denying all external crates.
• PR#800 added [licenses.include-build] to toggle whether build dependencies are included in the license check.
• PR#823 added [advisories.unused-ignored-advisory] to disable the warning when an advisory is ignored but not encountered in the crate graph.
• PR#826 added [advisories.unsound] to determine which crates can show unsound advisories, similarly to the unmaintained field. Defaults to workspace crates, ignoring unsound advisories for transitive dependencies, resolving #824.

Release 2.0.14 - cargo-deny 0.18.6

0.18.5

Changed

• PR#789 changed it so that release binaries are now built with LTO.
• PR#790 and PR#794 updated various crates.

Added

• PR#790 added SARIF as an output format, usable via --format sarif. The current output for this format is experimental and may change in future updates.

0.18.6

Fixed

• PR#805 updated rustsec to 0.31, resolving #804.
• PR#810 resolved #809 by printing the crate name and version when its manifest does not contain a license expression.

Added

• PR#807 added the unused-license-exception option to configure the lint level, resolving #806.

Changed

• PR#808 updated gix to 0.75.

Release 2.0.13 - cargo-deny 0.18.4

Added

• PR#779 added the --metadata-path argument to use a cargo metadata JSON file instead of calling cargo metadata, resolving #777.
• PR#782 added sources.unused-allow-source to allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing #781.

Changed

• PR#786 changed the license check output. / is no longer corrected to OR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.

Fixed

• PR#786 resolved #784 by updating spdx to a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.

Release 2.0.12 - cargo-deny 0.18.3

Changed

• PR#773 changed cargo-deny's duplicate detection to automatically ignore versions whose only dependent is another version of the same crate.

... (truncated)

• 3fd3802 Bump to 0.19.0
• 76cd80e Bump to 0.18.6
• f2ba7ab Bump to 0.18.4
• 30f817c Bump to 0.18.3
• 6e6dcaa Add Defguard to "repositories using this action" (#100)
• 34899fc Bump to 0.18.2
• 4de59db Workaround rustup 1.28 (#96)
• d8395c1 Use rustup from base image
• 55a198a Pin to image hash (#93)
• 8d73959 Install active toolchain by default if rust-version is not passed (#92)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)