cargo deny passes, but it spends most of its output telling us its own config is stale. On current main it reports:
- 20
unnecessary-skip warnings, for skips applied to crates that now have only one version: smallvec, event-listener, regex-syntax, regex-automata, bitflags, toml_edit, parking_lot_core, parking_lot, indexmap, heck, idna, strsim, socket2, semver, rustc_version, compact_str, zerocopy, clap, miniz_oxide, nom.
- 1
unmatched-skip: rustls-pemfile is not in the graph at all.
- 2
advisory-not-detected: RUSTSEC-2024-0320 (yaml-rust, via syntect) and RUSTSEC-2026-0192 (ttf-parser, via ab_glyph) no longer match anything.
- 2
license-exception-not-encountered: epaint_default_fonts and hexf-parse.
- 1
unmatched-source: https://github.com/andrewgazelka/bvh-data.
I confirmed this is not fallout from the dependency bumps in #991: running the same gate against pristine origin/main produces byte-identical staleness. It predates that PR, which is why I left it out of that diff.
Repro:
The fix is to delete each entry the tool names. Each one is currently costing a reader of the gate output the work of deciding whether it matters.
Filed by an agent from a dependency-update pass; not reviewed by a human.
cargo denypasses, but it spends most of its output telling us its own config is stale. On current main it reports:unnecessary-skipwarnings, for skips applied to crates that now have only one version:smallvec,event-listener,regex-syntax,regex-automata,bitflags,toml_edit,parking_lot_core,parking_lot,indexmap,heck,idna,strsim,socket2,semver,rustc_version,compact_str,zerocopy,clap,miniz_oxide,nom.unmatched-skip:rustls-pemfileis not in the graph at all.advisory-not-detected:RUSTSEC-2024-0320(yaml-rust, via syntect) andRUSTSEC-2026-0192(ttf-parser, via ab_glyph) no longer match anything.license-exception-not-encountered:epaint_default_fontsandhexf-parse.unmatched-source:https://github.com/andrewgazelka/bvh-data.I confirmed this is not fallout from the dependency bumps in #991: running the same gate against pristine
origin/mainproduces byte-identical staleness. It predates that PR, which is why I left it out of that diff.Repro:
The fix is to delete each entry the tool names. Each one is currently costing a reader of the gate output the work of deciding whether it matters.
Filed by an agent from a dependency-update pass; not reviewed by a human.