chore(deps): update embarkstudios/cargo-deny-action action to v2

[stackable-bot]

This PR contains the following updates:

Package	Type	Update	Change
EmbarkStudios/cargo-deny-action	action	major	v1.6.3 -> v2.0.12

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

EmbarkStudios/cargo-deny-action (EmbarkStudios/cargo-deny-action)

v2.0.12: Release 2.0.12 - cargo-deny 0.18.3

Compare Source

Changed

• PR#773 changed cargo-deny's duplicate detection to automatically ignore versions whose only dependent is another version of the same crate.

v2.0.11

Compare Source

[0.18.2] - 2025-03-10

Added

• PR#753 resolved #​752 by adding back the advisories.unmaintained config option. See the docs for how it can be used. The default matches the current behavior, which is to error on any unmaintained advisory, but adding unmaintained = "workspace" to the [advisories] table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.

[0.18.1] - 2025-02-27

Fixed

• PR#749 updated krates to pull in the fix for EmbarkStudios/krates#100.

v2.0.10

Compare Source

• PR#96 resolved #​94 by switching to the directory the manifest path is located in and doing rustup toolchain install if rustup show failed due to any reason

v2.0.9: Release 2.0.9 - cargo-deny 0.18.0

Compare Source

• d8395c1 removed the rustup update.

v2.0.8

Compare Source

• PR#93 pins to a hash instead of tag, avoiding future breakage from eg. rustup changes.

v2.0.7: Release 2.0.7 - cargo-deny 0.18.0

Compare Source

• PR#92 fixed an issue introduced by the latest rustup release.

v2.0.6: Release 2.0.6 - cargo-deny 0.18.0

Compare Source

Changed

• PR#746 changed the directory naming of advisory databases, again, so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default https://github.com/rustsec/advisory-db will now be placed in $CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.
• PR#746 changed the MSRV to 1.85.0 and uses edition 2024.

Fixed

• PR#746 fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail.

v2.0.5: Release 2.0.5 - cargo-deny 0.17.0

Compare Source

Changed

• PR#745 updated tame-index to 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.
• PR#745 now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms.

v2.0.4: Release 2.0.4 - cargo-deny 0.16.3

Compare Source

• Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes

v2.0.3: Release 2.0.3 - cargo-deny 0.16.3

Compare Source

Changed

• PR#721 updated rust-version to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #​720.
• PR#722 updated the SPDX license list to 3.25.0.

Fixed

• PR#726 resolved #​725 by adding the unnecessary-skip diagnostic, emitted when there is a skip configured for a crate that only has one version in the graph.

v2.0.2: Release 2.0.2 - cargo-deny 0.16.2

Compare Source

Fixed

• PR#703 resolved #​696 by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in PR#611.
• PR#719 updated to krates -> 0.17.5, fixing an issue where cargo-deny could panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.
• PR#719 resolved #​706 by removing a warning issued when users use ignored scheme modifiers for source urls.
• PR#719 resolved #​718 by updating the book with missing arguments.

Added

• PR#715 resolved #​714 by adding support for Edition 2024. Thanks @​kpcyrd!
• PR#710 resolved #​708 by allowing for unpublished workspace crates to be excluded from the dependency graph that checks are run against, either via the --exclude-unpublished CLI argument or the graph.exclude-unpublished config field. Thanks @​Tastaturtaste!

Changed

• PR#711 updated goblin -> 0.9.2
• PR#713 updated various crates, notably rustsec -> 0.30.

v2.0.1: Release 2.0.1 - cargo-deny 0.16.1

Compare Source

Fixed

• PR#691 fixed an issue where workspace dependencies that used the current dir '.' path component would incorrectly trigger the unused-workspace-dependency lint.

v2.0.0: Release 2.0.0 - cargo-deny 0.16.0

Compare Source

Action

Added

• PR#78 added SSH support, thanks @​nagua!

Changed

• This release includes breaking changes in cargo-deny, so this release begins the v2 tag, using v1 will be stable but not follow future cargo-deny releases.

cargo-deny

Removed

• PR#681 finished the deprecation introduced in PR#611, making the usage of the deprecated fields into errors.

[advisories]

The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the ignore field can be used as before.

• vulnerability - Vulnerability advisories are now deny by default
• unmaintained - Unmaintained advisories are now deny by default
• unsound - Unsound advisories are now deny by default
• notice - Notice advisories are now deny by default
• severity-threshold - The severity of vulnerabilities is now irrelevant

[licenses]

The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either allow or exceptions.

• unlicensed - Crates whose license(s) cannot be confidently determined are now always errors. The clarify field can be used to help cargo-deny determine the license.
• allow-osi-fsf-free - The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed.
• copyleft - The copyleft attribute is now irrelevant, only whether it is explicitly allowed.
• default - The default is now deny.
• deny - All licenses are now denied by default, this field added nothing.

Changed

• PR#685 follows up on PR#673, moving the fields that were added to their own separate bans.workspace-dependencies section. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, but makes it so that if not specified workspace duplicates are now deny instead of warn.

Fixed

• PR#685 resolved #​682 by adding the include-path-dependencies field, allowing path dependencies to be ignored if it is false.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.