Skip to content

deny.toml lists 20 skips, 1 unmatched skip and 2 advisory ignores that no longer match anything #993

Description

@andrewgazelka

cargo deny passes, but it spends most of its output telling us its own config is stale. On current main it reports:

  • 20 unnecessary-skip warnings, for skips applied to crates that now have only one version: smallvec, event-listener, regex-syntax, regex-automata, bitflags, toml_edit, parking_lot_core, parking_lot, indexmap, heck, idna, strsim, socket2, semver, rustc_version, compact_str, zerocopy, clap, miniz_oxide, nom.
  • 1 unmatched-skip: rustls-pemfile is not in the graph at all.
  • 2 advisory-not-detected: RUSTSEC-2024-0320 (yaml-rust, via syntect) and RUSTSEC-2026-0192 (ttf-parser, via ab_glyph) no longer match anything.
  • 2 license-exception-not-encountered: epaint_default_fonts and hexf-parse.
  • 1 unmatched-source: https://github.com/andrewgazelka/bvh-data.

I confirmed this is not fallout from the dependency bumps in #991: running the same gate against pristine origin/main produces byte-identical staleness. It predates that PR, which is why I left it out of that diff.

Repro:

nix run .#deny

The fix is to delete each entry the tool names. Each one is currently costing a reader of the gate output the work of deciding whether it matters.

Filed by an agent from a dependency-update pass; not reviewed by a human.

Metadata

Metadata

Assignees

No one assigned

    Labels

    dependenciesPull requests that update a dependency file

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions