Repository navigation
ci: check Rust dependencies with cargo-deny - #76
Merged
Merged
Conversation
Update plist, anyhow, and event-listener, and replace yanked spin. Require patched Tokio and time versions for downstream consumers.
Check advisories, licenses, duplicate versions, and sources on pushes, pull requests, and weekly. Document unavoidable GTK exceptions.
velocitysystems
left a comment
velocitysystems
left a comment
Contributor
There was a problem hiding this comment.
Please squash the review follow-up commits into the commits they amend before merge:
fix: refresh example Tokio lockfilesintofix: update vulnerable Rust dependenciesci: run pinned cargo-deny directly on push and PRintoci: check Rust dependencies with cargo-deny
velocitysystems
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI currently does not check Rust dependencies for advisories or enforce license and source policies. Add a dedicated cargo-deny job on pushes and pull requests, installing pinned cargo-deny 0.20.2 and using the Rust toolchain declared in
rust-toolchain.toml.The policy checks all platforms and development dependencies, rejects wildcard dependencies and unapproved sources, and reports duplicate versions as warnings. Update affected dependencies, raise the Tokio and time minimum versions, replace the yanked spin version, and document two upstream exceptions: proc-macro-error and glib in Tauri's GTK stack.
Closes #74