4c40dd341e68dfd69073cb4e7cc36cf1dcdb04c7
278 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Zanie Blue
|
ee35fe34ab | Increase the number of retries during test runs in CI (#14565) | ||
|
Zanie Blue
|
1b2ac40568 |
Fix if on macos test job (#14551)
|
||
|
Zanie Blue
|
1dff18897a |
Only run macOS tests on main without opt-in (#14541)
These runners are expensive and have limited concurrency, let's just run them on `main`. |
||
|
renovate[bot]
|
3a77b9cdd9 |
Update aws-actions/configure-aws-credentials digest to f503a18 (#14473)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | aws-actions/configure-aws-credentials | action | digest | `3d8cba3` -> `f503a18` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNy4yIiwidXBkYXRlZEluVmVyIjoiNDEuMTcuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Zanie Blue
|
5f2857a1c7 |
Add linux aarch64 smoke tests (#14427)
Testing https://github.com/astral-sh/uv/pull/14426 |
||
|
John Mumm
|
e40d3d5dff |
Re-enable Artifactory in the registries integration test (#14408)
Having worked out the account issue, I've re-enabled Artifactory in the registries test. |
||
|
Zanie Blue
|
c777491bf4 | Use the insiders requirements when building docs in CI (#14379) | ||
|
Aria Desires
|
2f9061dcd0 | Update python, add support for installing arm windows pythons (#14374) | ||
|
Aria Desires
|
317ce6e245 |
disfavor aarch64 windows in its own house (#13724)
and prefer emulated x64 windows in its stead. This is preparatory work for shipping support for uv downloading and installing aarch64 (arm64) windows Pythons. We've [had builds for this platform ready for a while](https://github.com/astral-sh/python-build-standalone/pull/387), but have held back on shipping them due to a fundamental problem: **The Python packaging ecosystem does not have strong support for aarch64 windows**, e.g., not many projects build aarch64 wheels yet. The net effect of this is that, if we handed you an aarch64 python interpreter on windows, you would have to build a lot more sdists, and there's a high chance you will simply fail to build that sdist and be sad. Yes unfortunately, in this case a non-native Python interpreter simply *works better* than the native one... in terms of working at all, today. Of course, if the native interpreter works for your project, it should presumably have better performance and platform compatibility. We do not want to stand in the way of progress, as ideally this situation is a temporary state of affairs as the ecosystem grows to support aarch64 windows. To enable progress, on aarch64 Windows builds of uv: * We will still use a native python interpreter, e.g., if it's at the front of your `PATH` or the only installed version. * If we are choosing between equally good interpreters that differ in architecture, x64 will be preferred. * If the aarch64 version is newer, we will prefer the aarch64 one. * We will emit a diagnostic on installation, and show the python request to pass to uv to force aarch64 windows to be used. * Will be shipping [aarch64 Windows Python downloads](https://github.com/astral-sh/python-build-standalone/pull/387) * Will probably add some kind of global override setting/env-var to disable this behaviour. * Will be shipping this behaviour in [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) We're coordinating with Microsoft, GitHub (for the `setup-python` action), and the CPython team (for the `python.org` installers), to ensure we're aligned on this default and the timing of toggling to prefer native distributions in the future. See discussion in - https://github.com/astral-sh/uv/issues/12906 --- This is an alternative to * #13719 which uses sorting rather than filtering, as discussed in * #13721 |
||
|
renovate[bot]
|
15551a0201 |
Update Swatinem/rust-cache action to v2.8.0 (#14366)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [Swatinem/rust-cache](https://redirect.github.com/Swatinem/rust-cache) | action | minor | `v2.7.8` -> `v2.8.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>Swatinem/rust-cache (Swatinem/rust-cache)</summary> ### [`v2.8.0`](https://redirect.github.com/Swatinem/rust-cache/releases/tag/v2.8.0) [Compare Source](https://redirect.github.com/Swatinem/rust-cache/compare/v2.7.8...v2.8.0) ##### What's Changed - Add cache-workspace-crates feature by [@​jbransen](https://redirect.github.com/jbransen) in [https://github.com/Swatinem/rust-cache/pull/246](https://redirect.github.com/Swatinem/rust-cache/pull/246) - Feat: support warpbuild cache provider by [@​stegaBOB](https://redirect.github.com/stegaBOB) in [https://github.com/Swatinem/rust-cache/pull/247](https://redirect.github.com/Swatinem/rust-cache/pull/247) ##### New Contributors - [@​jbransen](https://redirect.github.com/jbransen) made their first contribution in [https://github.com/Swatinem/rust-cache/pull/246](https://redirect.github.com/Swatinem/rust-cache/pull/246) - [@​stegaBOB](https://redirect.github.com/stegaBOB) made their first contribution in [https://github.com/Swatinem/rust-cache/pull/247](https://redirect.github.com/Swatinem/rust-cache/pull/247) **Full Changelog**: https://github.com/Swatinem/rust-cache/compare/v2.7.8...v2.8.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b2979d25a8 | Update acj/freebsd-firecracker-action action to v0.5.1 (#14355) | ||
|
renovate[bot]
|
e9533a0e29 | Update aws-actions/configure-aws-credentials digest to 3d8cba3 (#14354) | ||
|
renovate[bot]
|
a8b838dee9 | Update astral-sh/setup-uv action to v6.3.1 (#14360) | ||
|
John Mumm
|
a27e60a22f |
Temporarily disable Artifactory registry test (#14276)
I'm waiting on a response to get our subscription back up. Then I can re-enable this. But for now, this would cause failing CI tests. |
||
|
renovate[bot]
|
a9a9e71481 |
Update google-github-actions/setup-gcloud digest to a8b5801 (#14205)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | google-github-actions/setup-gcloud | action | digest | `77e7a55` -> `a8b5801` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
46221b40c3 |
Update EmbarkStudios/cargo-deny-action action to v2.0.12 (#14206)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [EmbarkStudios/cargo-deny-action](https://redirect.github.com/EmbarkStudios/cargo-deny-action) | action | patch | `v2.0.11` -> `v2.0.12` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>EmbarkStudios/cargo-deny-action (EmbarkStudios/cargo-deny-action)</summary> ### [`v2.0.12`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.12): Release 2.0.12 - cargo-deny 0.18.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.11...v2.0.12) ##### Changed - [PR#773](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/773) changed cargo-deny's duplicate detection to automatically ignore versions whose only dependent is another version of the same crate. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
a52595b61a |
Update google-github-actions/auth digest to 0920706 (#14204)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | google-github-actions/auth | action | digest | `ba79af0` -> `0920706` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
7fce3a88b8 |
Update aws-actions/configure-aws-credentials digest to 3bb878b (#14203)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | aws-actions/configure-aws-credentials | action | digest | `b475783` -> `3bb878b` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Zanie Blue
|
75d4cd30d6 |
Use Depot for Windows cargo test (#14122)
Replaces https://github.com/astral-sh/uv/pull/12320 Switches to Depot for the large Windows runner we use for `cargo test`. The runtime goes from 8m 20s -> 6m 44s (total) and 7m 18s -> 4m 41s (test run) which are 20% and 35% speedups respectively. A few things got marginally slower, like Python installs went from 11s -> 38s, the Rust cache went from 15s -> 30s, and drive setup went from 7s -> 20s. |
||
|
John Mumm
|
2fc922144a |
Add script for testing uv against different registries (#13615)
This PR provides a script that uses environment variables to determine
which registries to test. This script is being used to run automated
registry tests in CI for AWS, Azure, GCP, Artifactory, GitLab,
Cloudsmith, and Gemfury.
You must configure the following required env vars for each registry:
```
UV_TEST_<registry_name>_URL URL for the registry
UV_TEST_<registry_name>_TOKEN authentication token
UV_TEST_<registry_name>_PKG private package to install
```
The username defaults to "\_\_token\_\_" but can be optionally set with:
```
UV_TEST_<registry_name>_USERNAME
```
For each configured registry, the test will attempt to install the
specified package. Some registries can fall back to PyPI internally, so
it's important to choose a package that only exists in the registry you
are testing.
Currently, a successful test means that it finds the line “ +
<package_name>” in the output. This is because in its current form we
don’t know ahead of time what package it is and hence what the exact
expected output would be. The advantage if that anyone can run this
locally, though they would have to have access to the registries they
want to test.
You can also use the `--use-op` command line argument to derive these
test env vars from a 1Password vault (default is "RegistryTests" but can
be configured with `--op-vault`). It will look at all items in the vault
with names following the pattern `UV_TEST_<registry_name>` and will
derive the env vars as follows:
```
`UV_TEST_<registry_name>_USERNAME` from the `username` field
`UV_TEST_<registry_name>_TOKEN` from the `password` field
`UV_TEST_<registry_name>_URL` from a field with the label `url`
`UV_TEST_<registry_name>_PKG` from a field with the label `pkg`
```
|
||
|
konsti
|
423cfaabf5 |
Show backtraces for CI crashes (#14081)
I only just realized that we can get backtraces for crashes with `RUST_BACKTRACE: 1`, even non-panics (https://github.com/astral-sh/uv/pull/14079). This is much better than trying to analyze crash dumps. |
||
|
renovate[bot]
|
7c90c5be02 |
Update conda-incubator/setup-miniconda action to v3.2.0 (#14061)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [conda-incubator/setup-miniconda](https://redirect.github.com/conda-incubator/setup-miniconda) | action | minor | `v3.1.1` -> `v3.2.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>conda-incubator/setup-miniconda (conda-incubator/setup-miniconda)</summary> ### [`v3.2.0`](https://redirect.github.com/conda-incubator/setup-miniconda/blob/HEAD/CHANGELOG.md#v320-2025-06-04) [Compare Source](https://redirect.github.com/conda-incubator/setup-miniconda/compare/v3.1.1...v3.2.0) ##### Fixes - Check all `.condarc` files when removing `defaults` by [@​marcoesters](https://redirect.github.com/marcoesters) in [https://github.com/conda-incubator/setup-miniconda/pull/398](https://redirect.github.com/conda-incubator/setup-miniconda/pull/398)/398 - Add version normalization for minicondaVersion in input validation by [@​jezdez](https://redirect.github.com/jezdez) [https://github.com/conda-incubator/setup-miniconda/pull/397](https://redirect.github.com/conda-incubator/setup-miniconda/pull/397)/397 - Workaround for auto_activate_base deprecation by [@​jaimergp](https://redirect.github.com/jaimergp) in [https://github.com/conda-incubator/setup-miniconda/pull/402](https://redirect.github.com/conda-incubator/setup-miniconda/pull/402)/402 ##### Tasks and Maintenance - Bump conda-incubator/setup-miniconda from 3.1.0 to 3.1.1 by [@​dependabot](https://redirect.github.com/dependabot) in [https://github.com/conda-incubator/setup-miniconda/pull/391](https://redirect.github.com/conda-incubator/setup-miniconda/pull/391)/391 - Bump undici from 5.28.4 to 5.28.5 by [@​dependabot](https://redirect.github.com/dependabot) in [https://github.com/conda-incubator/setup-miniconda/pull/390](https://redirect.github.com/conda-incubator/setup-miniconda/pull/390)/390 - Bump semver and [@​types/semver](https://redirect.github.com/types/semver) by [@​dependabot](https://redirect.github.com/dependabot) in [https://github.com/conda-incubator/setup-miniconda/pull/399](https://redirect.github.com/conda-incubator/setup-miniconda/pull/399)/399 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC41MC4wIiwidXBkYXRlZEluVmVyIjoiNDAuNTAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
5beeda7cdc |
Update acj/freebsd-firecracker-action action to v0.5.0 (#14057)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [acj/freebsd-firecracker-action](https://redirect.github.com/acj/freebsd-firecracker-action) | action | minor | `v0.4.2` -> `v0.5.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>acj/freebsd-firecracker-action (acj/freebsd-firecracker-action)</summary> ### [`v0.5.0`](https://redirect.github.com/acj/freebsd-firecracker-action/releases/tag/v0.5.0) [Compare Source](https://redirect.github.com/acj/freebsd-firecracker-action/compare/v0.4.2...v0.5.0) Changes: - Add `disk-size` option to control the size of the VM's disk and root filesystem - Retired obsolete workaround that disabled TCP segmentation offload (TSO) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC41MC4wIiwidXBkYXRlZEluVmVyIjoiNDAuNTAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
a0ea520fe3 | Update taiki-e/install-action action to v2.52.8 (#14056) | ||
|
renovate[bot]
|
f5382c010b |
Update acj/freebsd-firecracker-action action to v0.4.2 (#13906)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [acj/freebsd-firecracker-action](https://redirect.github.com/acj/freebsd-firecracker-action) | action | patch | `v0.4.1` -> `v0.4.2` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>acj/freebsd-firecracker-action (acj/freebsd-firecracker-action)</summary> ### [`v0.4.2`](https://redirect.github.com/acj/freebsd-firecracker-action/releases/tag/v0.4.2) [Compare Source](https://redirect.github.com/acj/freebsd-firecracker-action/compare/v0.4.1...v0.4.2) [Firecracker 1.12.0](https://redirect.github.com/firecracker-microvm/firecracker/releases/tag/v1.12.0) [FreeBSD 14.3-RELEASE](https://www.freebsd.org/releases/14.3R/relnotes/) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC40MC4zIiwidXBkYXRlZEluVmVyIjoiNDAuNDAuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Zanie Blue
|
262ca73965 |
Remove the configuration section in favor of concepts / reference (#13842)
Extends https://github.com/astral-sh/uv/pull/13841 — I'll drop that commit later after that pull request merges but it's small. I find the split into a "Configuration" section awkward and don't think it's helping us. Everything moved into the "Concepts" section, except the "Environment variables" page which definitely belongs in the reference and the "Installer" page which is fairly niche and seems better in the reference. Before / After <img src="https://github.com/user-attachments/assets/80d8304b-17da-4900-a5f4-c3ccac96fcc5" width="400"> |
||
|
Zanie Blue
|
f168802ba4 |
Bump cargo-test-macos timeout to 15m (#13847)
Closes https://github.com/astral-sh/uv/issues/13846 15m is fine, we should definitely take action if it runs that long normally though. |
||
|
Hood Chatham
|
f9d3f24728 |
Add Pyodide support (#12731)
This includes some initial work on adding Pyodide support (issue #12729). It is enough to get ``` uv pip compile -p /path/to/pyodide --extra-index-url file:/path/to/simple-index ``` to work which should already be quite useful. ## Test Plan * added a unit test for `pyodide_platform` * integration tested manually with: ``` cargo run pip install \ -p /home/rchatham/Documents/programming/tmp/pyodide-venv-test/.pyodide-xbuildenv-0.29.3/0.27.4/xbuildenv/pyodide-root/dist/python \ --extra-index-url file:/home/rchatham/Documents/programming/tmp/pyodide-venv-test/.pyodide-xbuildenv-0.29.3/0.27.4/xbuildenv/pyodide-root/package_index \ --index-strategy unsafe-best-match --target blah --no-build \ numpy pydantic ``` --------- Co-authored-by: konsti <konstin@mailbox.org> Co-authored-by: Zanie Blue <contact@zanie.dev> |
||
|
Zanie Blue
|
f429d99b6c |
Disable OpenSUSE system test for now (#13818)
ref #13811 |
||
|
konsti
|
fd48b8bb78 |
Update acj/freebsd-firecracker-action to v0.4.1 (#13804)
This should hopefully fix the flakes we're seeing. Fixes #13746, hopefully. |
||
|
konsti
|
4368c403fe |
Downgrade firecracker action to v0.3 (#13786)
See https://github.com/acj/freebsd-firecracker-action/issues/3 |
||
|
renovate[bot]
|
1e890b5ac7 |
Update taiki-e/install-action action to v2.52.4 (#13778)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [taiki-e/install-action](https://redirect.github.com/taiki-e/install-action) | action | minor | `v2.50.3` -> `v2.52.4` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>taiki-e/install-action (taiki-e/install-action)</summary> ### [`v2.52.4`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.52.4): 2.52.4 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.52.3...v2.52.4) - Update `cargo-binstall@latest` to 1.12.6. - Update `wash@latest` to 0.42.0. ### [`v2.52.3`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.52.3): 2.52.3 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.52.2...v2.52.3) - Update `cargo-nextest@latest` to 0.9.97. - Update `trivy@latest` to 0.63.0. - Update `protoc@latest` to 3.31.1. ### [`v2.52.2`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.52.2): 2.52.2 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.52.1...v2.52.2) - Update `mdbook@latest` to 0.4.51. ### [`v2.52.1`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.52.1): 2.52.1 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.52.0...v2.52.1) - Update `taplo@latest` to 0.10.0. - Update `mdbook@latest` to 0.4.50. - Update `deepsource@latest` to 0.9.0. - Update `cargo-shear@latest` to 1.3.0. ### [`v2.52.0`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.52.0): 2.52.0 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.51.3...v2.52.0) - Support `trivy`. ([#​970](https://redirect.github.com/taiki-e/install-action/pull/970), thanks [@​jayvdb](https://redirect.github.com/jayvdb)) - Update `syft@latest` to 1.26.1. - Update `rclone@latest` to 1.69.3. - Update `cargo-shear@latest` to 1.2.8. ### [`v2.51.3`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.51.3): 2.51.3 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.51.2...v2.51.3) - Update `wasmtime@latest` to 33.0.0. - Update `cargo-tarpaulin@latest` to 0.32.7. - Update `espup@latest` to 0.15.1. - Update `dprint@latest` to 0.50.0. ### [`v2.51.2`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.51.2): 2.51.2 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.51.1...v2.51.2) - Update `syft@latest` to 1.25.1. - Update `release-plz@latest` to 0.3.135. ### [`v2.51.1`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.51.1): 2.51.1 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.51.0...v2.51.1) - Update `syft@latest` to 1.25.0. - Update `cargo-binstall@latest` to 1.12.5. ### [`v2.51.0`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.51.0): 2.51.0 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.10...v2.51.0) - Support `cargo-shear`. ([#​962](https://redirect.github.com/taiki-e/install-action/pull/962), thanks [@​vivienm](https://redirect.github.com/vivienm)) - Update `grcov@latest` to 0.10.0. - Update `cargo-nextest@latest` to 0.9.96. - Update `protoc@latest` to 3.31.0. - Update `syft@latest` to 1.24.0. ### [`v2.50.10`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.10): 2.50.10 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.9...v2.50.10) - Update `trunk@latest` to 0.21.14. - Update `release-plz@latest` to 0.3.134. - Update `cargo-binstall@latest` to 1.12.4. ### [`v2.50.9`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.9): 2.50.9 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.8...v2.50.9) - Update `editorconfig-checker@latest` to 3.3.0. - Update `cargo-lambda@latest` to 1.8.5. ### [`v2.50.8`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.8): 2.50.8 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.7...v2.50.8) - Update `cargo-tarpaulin@latest` to 0.32.5. - Update `mdbook@latest` to 0.4.49. ### [`v2.50.7`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.7): 2.50.7 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.6...v2.50.7) - Update `cargo-tarpaulin@latest` to 0.32.4. ### [`v2.50.6`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.6): 2.50.6 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.5...v2.50.6) - Update `knope@latest` to 0.20.0. ### [`v2.50.5`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.5): 2.50.5 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.4...v2.50.5) - Update `xh@latest` to 0.24.1. - Update `typos@latest` to 1.32.0. - Update `rclone@latest` to 1.69.2. ### [`v2.50.4`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.50.4): 2.50.4 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.50.3...v2.50.4) - Update `typos@latest` to 1.31.2. - Update `osv-scanner@latest` to 2.0.2. - Update `cargo-nextest@latest` to 0.9.95. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4zMy42IiwidXBkYXRlZEluVmVyIjoiNDAuMzMuNiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Zanie Blue
|
59070b5b3f |
Use codspeed runner for wall time benchmarking (#13586)
We couldn't use the CodSpeed "walltime" runner because it required administrative permissions on our repositories, but following some feedback they've adjusted the required permissions so we can give it a try now. As a brief background, CodSpeed uses Valgrind for instrumented benchmarking, emulating the execution for improved stability on GitHub's runners. This is nice, but means things like allocs and io are not measured. Now, they support standard wall time benchmarking, using their own managed runners for stable measurements. Here, we add support for those while retaining the old workflow — you can toggle between views in their UI. |
||
|
konsti
|
fc77be09f4 |
Use only a single 3.13t Linux integration test (#13700)
Fixes https://github.com/astral-sh/uv/issues/13681 We're still using the apt repo in the deadsnakes test but this is one less location with the flaky apt script. |
||
|
konsti
|
abd5fd199c |
Increase deadsnake timeout to 15min (#13661)
https://github.com/astral-sh/uv/actions/runs/15254949524/job/42900366590 |
||
|
konsti
|
b80cafd5e8 |
Stack traces from Windows CI crashes (#13656)
We regularly have Windows CI crashing with `exit_code: -1073741819`, a recent example is <https://github.com/astral-sh/uv/actions/runs/15244692977/job/42869570968?pr=13650>. This code apparently means Access Violation, akin to a Segmentation Fault. Lacking local reproducibility (at least I never saw this on my Windows machine), I generated workflow steps that will hopefully give us a stack trace (and only fail an already failed job when they are actually bogus; I didn't find any good references). |
||
|
konsti
|
fe6dfbc97b |
Set pypa/gh-action-pypi-publish test to verbose (#13659)
See https://github.com/astral-sh/uv/actions/runs/15244694849/job/42869932290?pr=13652 |
||
|
renovate[bot]
|
853163dee5 |
Update astral-sh/setup-uv action to v6.1.0 (#13652)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | minor | `v6.0.1` -> `v6.1.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v6.1.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v6.1.0): 🌈 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v6.0.1...v6.1.0) #### Changes This release adds the input `server-url` which defaults to `https://github.com`. You can set this to a custom url to control where this action downloads the uv release from. This is useful for users of gitea and comparable solutions. [@​sebadevo](https://redirect.github.com/sebadevo) pointed out that we don't invalidate the cache when the `prune-cache` input is changed. This leads to unnessecarily big caches. The input is now used to compute the cache key, properly invalidating the cache when it is changed. > \[!NOTE]\ > For most users this release will invalidate the cache once. > You will see the known warning [no-github-actions-cache-found-for-key](https://redirect.github.com/astral-sh/setup-uv?tab=readme-ov-file#why-do-i-see-warnings-like-no-github-actions-cache-found-for-key) > This is expected and will only appear once. #### 🐛 Bug fixes - Purge cache in cache key [@​eifinger](https://redirect.github.com/eifinger) ([#​423](https://redirect.github.com/astral-sh/setup-uv/issues/423)) #### 🚀 Enhancements - feat: support custom github url [@​Zoupers](https://redirect.github.com/Zoupers) ([#​414](https://redirect.github.com/astral-sh/setup-uv/issues/414)) #### 🧰 Maintenance - chore: update known versions for 0.7.7 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​422](https://redirect.github.com/astral-sh/setup-uv/issues/422)) - chore: update known versions for 0.7.6 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​415](https://redirect.github.com/astral-sh/setup-uv/issues/415)) - chore: update known versions for 0.7.5 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​412](https://redirect.github.com/astral-sh/setup-uv/issues/412)) - chore: update known versions for 0.7.4 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​410](https://redirect.github.com/astral-sh/setup-uv/issues/410)) - chore: update known versions for 0.7.3 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​405](https://redirect.github.com/astral-sh/setup-uv/issues/405)) - Fix path to known-checksums.ts [@​eifinger](https://redirect.github.com/eifinger) ([#​404](https://redirect.github.com/astral-sh/setup-uv/issues/404)) - Fix update-known-versions workflow argument [@​eifinger](https://redirect.github.com/eifinger) ([#​401](https://redirect.github.com/astral-sh/setup-uv/issues/401)) - Fix update-known-versions workflow [@​eifinger](https://redirect.github.com/eifinger) ([#​400](https://redirect.github.com/astral-sh/setup-uv/issues/400)) - Create version-manifest.json on uv release [@​eifinger](https://redirect.github.com/eifinger) ([#​399](https://redirect.github.com/astral-sh/setup-uv/issues/399)) - Run infrastructure workflows on arm runners [@​eifinger](https://redirect.github.com/eifinger) ([#​396](https://redirect.github.com/astral-sh/setup-uv/issues/396)) - chore: update known checksums for 0.7.2 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​395](https://redirect.github.com/astral-sh/setup-uv/issues/395)) - chore: update known checksums for 0.7.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​390](https://redirect.github.com/astral-sh/setup-uv/issues/390)) #### 📚 Documentation - Add section to README explaining if packages are installed by setup-uv [@​pirate](https://redirect.github.com/pirate) ([#​398](https://redirect.github.com/astral-sh/setup-uv/issues/398)) #### ⬆️ Dependency updates - Bump dependencies [@​eifinger](https://redirect.github.com/eifinger) ([#​424](https://redirect.github.com/astral-sh/setup-uv/issues/424)) - Bump typescript from 5.8.2 to 5.8.3 @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#​393](https://redirect.github.com/astral-sh/setup-uv/issues/393)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
konsti
|
f969417bba |
Increase uv publish integration test timeout (#13658)
Sometimes we have to wait a long time for remote caches to update, see e.g. https://github.com/astral-sh/uv/actions/runs/15252860797/job/42893715464 |
||
|
renovate[bot]
|
8373261fe7 |
Update actions/download-artifact action to v4.3.0 (#13651)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | minor | `v4.2.1` -> `v4.3.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v4.3.0`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.3.0) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.2.1...v4.3.0) #### What's Changed - feat: implement new `artifact-ids` input by [@​GrantBirki](https://redirect.github.com/GrantBirki) in [https://github.com/actions/download-artifact/pull/401](https://redirect.github.com/actions/download-artifact/pull/401) - Fix workflow example for downloading by artifact ID by [@​joshmgross](https://redirect.github.com/joshmgross) in [https://github.com/actions/download-artifact/pull/402](https://redirect.github.com/actions/download-artifact/pull/402) - Prep for v4.3.0 release by [@​robherley](https://redirect.github.com/robherley) in [https://github.com/actions/download-artifact/pull/404](https://redirect.github.com/actions/download-artifact/pull/404) #### New Contributors - [@​GrantBirki](https://redirect.github.com/GrantBirki) made their first contribution in [https://github.com/actions/download-artifact/pull/401](https://redirect.github.com/actions/download-artifact/pull/401) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4.2.1...v4.3.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
9f0d83c7df |
Update acj/freebsd-firecracker-action action to v0.4.0 (#13649)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [acj/freebsd-firecracker-action](https://redirect.github.com/acj/freebsd-firecracker-action) | action | minor | `v0.3.0` -> `v0.4.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>acj/freebsd-firecracker-action (acj/freebsd-firecracker-action)</summary> ### [`v0.4.0`](https://redirect.github.com/acj/freebsd-firecracker-action/releases/tag/v0.4.0) [Compare Source](https://redirect.github.com/acj/freebsd-firecracker-action/compare/v0.3.0...v0.4.0) [Firecracker 1.12.0](https://redirect.github.com/firecracker-microvm/firecracker/releases/tag/v1.12.0) [FreeBSD 14.3-STABLE](https://www.freebsd.org/releases/14.3R/relnotes/) Bug fixes: - Wait for Firecracker VM to exit before returning control to the calling workflow Changes: - Upgrade CI workflow to Ubuntu 24.04 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW50ZXJuYWwiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
samypr100
|
3483f1d8b3 |
fix: format uv-trampoline for 2024 edition (#13519)
## Summary Follow on to https://github.com/astral-sh/uv/pull/13516 Ensure uv-trampoline is formatted after switching to 2024 edition. |
||
|
renovate[bot]
|
a0b27c7cff |
Update fedora Docker tag to v43 (#13165)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | fedora | container | major | `42` -> `43` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
konsti
|
87c8ec8a85 |
Fix ecosystem checks by pinning Git refs (#13401)
https://github.com/pallets/flask/pull/5727 broke our ecosystem checks, for now we're pinning the Git refs to unblock CI. |
||
|
Tim Felgentreff
|
878c2acdf3 |
Add downloading of GraalPy (#13172)
## Summary This adds GraalPy download metadata so that `uv python install graalpy` works. See https://github.com/astral-sh/uv/issues/13114 ## Test Plan The existing integration test was changed to test this functionality. |
||
|
renovate[bot]
|
1cfc67d266 |
Update Artifact GitHub Actions dependencies (#13290)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | actions/download-artifact | action | digest | `95815c3` -> `d3f86a1` | | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | minor | `v4.2.1` -> `v4.3.0` | --- ### Release Notes <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v4.3.0`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.3.0) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.2.1...v4.3.0) #### What's Changed - feat: implement new `artifact-ids` input by [@​GrantBirki](https://redirect.github.com/GrantBirki) in [https://github.com/actions/download-artifact/pull/401](https://redirect.github.com/actions/download-artifact/pull/401) - Fix workflow example for downloading by artifact ID by [@​joshmgross](https://redirect.github.com/joshmgross) in [https://github.com/actions/download-artifact/pull/402](https://redirect.github.com/actions/download-artifact/pull/402) - Prep for v4.3.0 release by [@​robherley](https://redirect.github.com/robherley) in [https://github.com/actions/download-artifact/pull/404](https://redirect.github.com/actions/download-artifact/pull/404) #### New Contributors - [@​GrantBirki](https://redirect.github.com/GrantBirki) made their first contribution in [https://github.com/actions/download-artifact/pull/401](https://redirect.github.com/actions/download-artifact/pull/401) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4.2.1...v4.3.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
12a978cd34 |
Update astral-sh/setup-uv action to v6.0.1 (#13291)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | patch | `v6.0.0` -> `v6.0.1` | --- ### Release Notes <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v6.0.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v6.0.1): 🌈 Fix default cache dependency glob [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v6.0.0...v6.0.1) ##### Changes The new default in v6 used illegal patterns and therefore didn't match requirements files. This is now fixed. ##### 🐛 Bug fixes - Fix default cache dependency glob [@​eifinger](https://redirect.github.com/eifinger) ([#​388](https://redirect.github.com/astral-sh/setup-uv/issues/388)) ##### 🧰 Maintenance - chore: update known checksums for 0.6.17 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​384](https://redirect.github.com/astral-sh/setup-uv/issues/384)) ##### ⬆️ Dependency updates - Bump dependencies [@​eifinger](https://redirect.github.com/eifinger) ([#​389](https://redirect.github.com/astral-sh/setup-uv/issues/389)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
konsti
|
96cfca1c8f |
Move static feature out of perf features (#13265)
#5577 fixed a bug on macos due to dynamically linking lzma/xz through static linking. In #7686, this feature was moved to the performance category. This PR moves the `xz2/static` back to the general default features, and, inspired by https://github.com/Homebrew/homebrew-core/pull/222211, it structures and documents the feature flags cleaner. We need to take care that this feature does not accidentally disable features we want. --------- Co-authored-by: Zanie Blue <contact@zanie.dev> |
||
|
renovate[bot]
|
f8f1b9c505 | Update taiki-e/install-action action to v2.50.3 (#13161) | ||
|
renovate[bot]
|
cfe82dc22a |
Update EmbarkStudios/cargo-deny-action action to v2 (#13164)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [EmbarkStudios/cargo-deny-action](https://redirect.github.com/EmbarkStudios/cargo-deny-action) | action | major | `v1` -> `v2.0.11` | --- ### Release Notes <details> <summary>EmbarkStudios/cargo-deny-action (EmbarkStudios/cargo-deny-action)</summary> ### [`v2.0.11`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.11) [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.10...v2.0.11) #### \[0.18.2] - 2025-03-10 ##### Added - [PR#753](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/753) resolved [#​752](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/752) by adding back the `advisories.unmaintained` config option. See the [docs](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-unmaintained-field-optional) for how it can be used. The default matches the current behavior, which is to error on any `unmaintained` advisory, but adding `unmaintained = "workspace"` to the `[advisories]` table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace. #### \[0.18.1] - 2025-02-27 ##### Fixed - [PR#749](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/749) updated `krates` to pull in the fix for [EmbarkStudios/krates#100](https://redirect.github.com/EmbarkStudios/krates/issues/100). ### [`v2.0.10`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.10) [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.9...v2.0.10) - [PR#96](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/96) resolved [#​94](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/94) by switching to the directory the manifest path is located in and doing `rustup toolchain install` if `rustup show` failed due to any reason ### [`v2.0.9`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.9): Release 2.0.9 - cargo-deny 0.18.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.8...v2.0.9) - [`d8395c1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/commit/d8395c1) removed the rustup update. ### [`v2.0.8`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.8) [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.7...v2.0.8) - [PR#93](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/93) pins to a hash instead of tag, avoiding future breakage from eg. rustup changes. ### [`v2.0.7`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.7): Release 2.0.7 - cargo-deny 0.18.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.6...v2.0.7) - [PR#92](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/92) fixed an issue introduced by the latest rustup release. ### [`v2.0.6`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.6): Release 2.0.6 - cargo-deny 0.18.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.5...v2.0.6) ##### Changed - [PR#746](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/746) changed the directory naming of advisory databases, [again](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/745), so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default `https://github.com/rustsec/advisory-db` will now be placed in `$CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691`. - [PR#746](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/746) changed the MSRV to 1.85.0 and uses edition 2024. ##### Fixed - [PR#746](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/746) fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail. ### [`v2.0.5`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.5): Release 2.0.5 - cargo-deny 0.17.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.4...v2.0.5) ##### Changed - [PR#745](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/745) updated `tame-index` to [0.18.0](https://redirect.github.com/EmbarkStudios/tame-index/releases/tag/0.18.0) so that cargo 1.85.0 is transparently supported along with older cargo versions. - [PR#745](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/745) now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms. ### [`v2.0.4`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.4): Release 2.0.4 - cargo-deny 0.16.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.3...v2.0.4) - Update base image to rust 1.83.0 so that version 4 lockfiles are supported with no config changes ### [`v2.0.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.3): Release 2.0.3 - cargo-deny 0.16.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.2...v2.0.3) ##### Changed - [PR#721](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/721) updated `rust-version` to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving [#​720](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/720). - [PR#722](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/722) updated the SPDX license list to 3.25.0. ##### Fixed - [PR#726](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/726) resolved [#​725](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/725) by adding the `unnecessary-skip` diagnostic, emitted when there is a `skip` configured for a crate that only has one version in the graph. ### [`v2.0.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.2): Release 2.0.2 - cargo-deny 0.16.2 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2.0.1...v2.0.2) ##### Fixed - [PR#703](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/703) resolved [#​696](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/696) by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in [PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611). - [PR#719](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/719) updated to `krates` -> 0.17.5, fixing an issue where `cargo-deny` could [panic](https://redirect.github.com/EmbarkStudios/krates/issues/97) due to [incorrectly resolving](https://redirect.github.com/EmbarkStudios/krates/issues/84) features for different versions of the same crate referenced by a single crate. - [PR#719](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/719) resolved [#​706](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/706) by removing a warning issued when users use ignored scheme modifiers for source urls. - [PR#719](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/719) resolved [#​718](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/718) by updating the book with missing arguments. ##### Added - [PR#715](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/715) resolved [#​714](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/714) by adding support for Edition 2024. Thanks [@​kpcyrd](https://redirect.github.com/kpcyrd)! - [PR#710](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/710) resolved [#​708](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/708) by allowing for unpublished workspace crates to be excluded from the dependency graph that checks are run against, either via the `--exclude-unpublished` CLI argument or the `graph.exclude-unpublished` config field. Thanks [@​Tastaturtaste](https://redirect.github.com/Tastaturtaste)! ##### Changed - [PR#711](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/711) updated `goblin` -> 0.9.2 - [PR#713](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/713) updated various crates, notably `rustsec` -> 0.30. ### [`v2.0.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.1): Release 2.0.1 - cargo-deny 0.16.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v2...v2.0.1) ##### Fixed - [PR#691](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/691) fixed an issue where workspace dependencies that used the current dir '.' path component would incorrectly trigger the `unused-workspace-dependency` lint. ### [`v2.0.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.0): Release 2.0.0 - cargo-deny 0.16.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.3...v2) #### `Action` ##### Added - [PR#78](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/78) added SSH support, thanks [@​nagua](https://redirect.github.com/nagua)! ##### Changed - This release includes breaking changes in cargo-deny, so this release begins the `v2` tag, using `v1` will be stable but not follow future `cargo-deny` releases. #### `cargo-deny` ##### Removed - [PR#681](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/681) finished the deprecation introduced in [PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611), making the usage of the deprecated fields into errors. ##### `[advisories]` The following fields have all been removed in favor of denying all advisories by default. To ignore an advisory the [`ignore`](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-ignore-field-optional) field can be used as before. - `vulnerability` - Vulnerability advisories are now `deny` by default - `unmaintained` - Unmaintained advisories are now `deny` by default - `unsound` - Unsound advisories are now `deny` by default - `notice` - Notice advisories are now `deny` by default - `severity-threshold` - The severity of vulnerabilities is now irrelevant ##### `[licenses]` The following fields have all been removed in favor of denying all licenses that are not explicitly allowed via either [`allow`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-allow-field-optional) or [`exceptions`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-exceptions-field-optional). - `unlicensed` - Crates whose license(s) cannot be confidently determined are now always errors. The [`clarify`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-clarify-field-optional) field can be used to help cargo-deny determine the license. - `allow-osi-fsf-free` - The OSI/FSF Free attributes are now irrelevant, only whether it is explicitly allowed. - `copyleft` - The copyleft attribute is now irrelevant, only whether it is explicitly allowed. - `default` - The default is now `deny`. - `deny` - All licenses are now denied by default, this field added nothing. ##### Changed - [PR#685](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/685) follows up on [PR#673](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/673), moving the fields that were added to their own separate [`bans.workspace-dependencies`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-workspace-dependencies-field-optional) section. This is an unannounced breaking change but is fairly minor and 0.15.0 was never released on github actions so the amount of people affected by this will be (hopefully) small. This also makes the workspace duplicate detection off by default since the field is optional, *but* makes it so that if not specified workspace duplicates are now `deny` instead of `warn`. ##### Fixed - [PR#685](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/685) resolved [#​682](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/682) by adding the `include-path-dependencies` field, allowing path dependencies to be ignored if it is `false`. ### [`v1.6.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.3): Release 1.6.3 - cargo-deny 0.14.21 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.2...v1.6.3) ##### Fixed - [PR#643](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/643) resolved [#​629](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/629) by making the hosted git (github, gitlab, bitbucket) org/user name comparison case-insensitive. Thanks [@​pmnlla](https://redirect.github.com/pmnlla)! - [PR#649](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/649) fixed an issue where depending on the same crate multiple times by using different `cfg()/triple` targets could cause features to be resolved incorrectly and thus crates to be not pulled into the graph used for checking. #### \[0.14.20] - 2024-03-23 ##### Fixed - [PR#642](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/642) resolved [#​641](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/641) by pinning `gix-transport` (and its unique dependencies) to 0.41.2 as a workaround for `cargo install` not using the lockfile. See [this issue](https://redirect.github.com/Byron/gitoxide/issues/1328) for more information. ### [`v1.6.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.2): Release 1.6.2 - cargo-deny 0.14.19 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.1...v1.6.2) ##### Changed - [PR#639](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/639) updated tame-index to avoid an error if you don't used `--locked`. #### \[0.14.18] - 2024-03-21 ##### Fixed - [PR#638](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/638) resolved [#​636](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/636) by updating `krates`. #### \[0.14.17] - 2024-03-17 ##### Changed - [PR#631](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/631) improved the diagnostic for when the yank check fails due to some issue with retrieving or reading the index information. - [PR#633](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/633) updated `gix` -> 0.60. ### [`v1.6.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.1) [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.6.0...v1.6.1) ##### Fixed - [PR#626](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/626) resolved [#​625](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/625) by explicitly checking that a license identified as Pixar was actually (probably) the Pixar license, instead of a normal Apache-2.0 license. ### [`v1.6.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.6.0) [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.15...v1.6.0) #### action changes - Color output is now always enabled so that colors show up in the action output. #### 0.14.15 ##### Added - [PR#618](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/618) added metadata notes to diagnostics when a license is rejected, as well as removing span information for accepted licenses unless the log level is `info` or higher to make the diagnostic clearer by default. #### 0.14.14 ##### Fixed - [PR#617](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/617) resolved [#​576](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/576) by updating the SPDX license list to 3.23. #### 0.14.13 ##### Fixed - [PR#615](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/615) fixed an issue introduced in [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) where the various `bans` diagnostic codes could not have their lint level changed via the CLI. It also introduced the `deprecated` diagnostic code. #### 0.14.12 ##### Changed - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) did a major refactor of configuration, both how it is deserialized and changing (hopefully improving) many options. - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) moved `targets`, `exclude`, `all-features`, `features`, `no-default-features`, and `exclude` into the `[graph]` table. - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) moved `feature-depth` into the `[output]` table. ##### Added - [PR#613](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/613) added support for [basic shell expansion](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-db-path-field-optional) to `advisories.db-path`, which expands support beyond just `~` to include environment variable expansion. ##### Fixed - [PR#601](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/601) resolved [#​600](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/600) by outputting the correct spans when a license was both allowed and denied. - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) resolved [#​264](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/264) be replacing `toml` and `serde` with `toml-span`. - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) resolved [#​539](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/539) by simplifying the very common `name = "<crate_name>", version = "<requirements>"` used to target specific crates into either a plain [package spec string](https://embarkstudios.github.io/cargo-deny/checks/cfg.html#string-format) or the simpler `crate = "<package spec>"`. - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) resolved [#​578](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/578) by adding a `reason = "<reason>"` field to *many* fields within the configuration that are provided in diagnostics. `[bans.deny]` also has an additional `use-instead = "<url/crate_name>"`. [PR#610](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/610) did this for the `advisories.ignore` field. - [PR#605](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/605) resolved [#​579](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/579) by allowing yanked crates to be ignored by specifying a [PackageSpec](https://embarkstudios.github.io/cargo-deny/checks/cfg.html#package-specs) in the `[advisories.ignore]` array. ##### Deprecated - [PR#606](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/606) and [PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611) together deprecated several fields listed below. See [PR#611](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/611) for how to change your config to opt-in to the new behavior that will become the default when the deprecated fields are removed in a future minor version. - `[advisories]` - `vulnerability` - `unmaintained` - `unsound` - `notice` - `severity-threshold` - `[licenses]` - `unlicensed` - `allow-osi-fsf-free` - `copyleft` - `default` - `deny` ### [`v1.5.15`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.15): Release 1.5.15 - cargo-deny 0.14.11 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.14...v1.5.15) ##### Fixed - Resolved [https://github.com/EmbarkStudios/cargo-deny-action/issues/71](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/71) that was introduced in the previous release. ### [`v1.5.14`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.14): Release 1.5.14 - cargo-deny 0.14.11 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.13...v1.5.14) ##### Added - Added the `manifest-path` key as a shorthand for doing `arguments: --manifest-path <path>` ### [`v1.5.13`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.13): Release 1.5.13 - cargo-deny 0.14.11 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.12...v1.5.13) ##### Fixed - [PR#599](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/599) resolved [#​488](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/488) by treating git and path sources differently. Thanks [@​kpreid](https://redirect.github.com/kpreid)! ### [`v1.5.12`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.12): Release 1.5.12 - cargo-deny 0.14.10 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.11...v1.5.12) ##### Fixed - [PR#596](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/596) updated `krates` *again* to pull in [krates#77](https://redirect.github.com/EmbarkStudios/krates/pull/77). ### [`v1.5.11`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.11): Release 1.5.11 - cargo-deny 0.14.9 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.10...v1.5.11) ##### Fixed - [PR#594](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/594) updated `krates` *again* to pull in [krates#75](https://redirect.github.com/EmbarkStudios/krates/pull/75). ### [`v1.5.10`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.10): Release 1.5.10 - cargo-deny 0.14.8 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.9...v1.5.10) ##### Fixed - [PR#592](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/592) updated `krates` *again* to pull in [krates#73](https://redirect.github.com/EmbarkStudios/krates/pull/73). ### [`v1.5.9`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.9): Release 1.5.9 - cargo-deny 0.14.7 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.8...v1.5.9) ##### Fixed - [PR#591](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/591) updated `krates` *again* to pull in [krates#71](https://redirect.github.com/EmbarkStudios/krates/pull/71). ### [`v1.5.8`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.8): Release 1.5.8 - cargo-deny 0.14.6 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.7...v1.5.8) ##### Fixed - [PR#590](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/590) updated `krates` to fix an issue with crates that directly have a dependency on 2 or more versions of the same crate. ##### Added - [PR#590](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/590) resolved [#​405](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/405) by emitting warnings when a `wrapper` crate for a banned crate does not have a dependency on that crate. ##### Changed - [PR#591](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/591) updated `gix` and `tame-index`. ### [`v1.5.7`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.7): Release 1.5.7 - cargo-deny 0.14.5 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.6...v1.5.7) ##### Fixed - [PR#588](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/588) resolved an issue introduced in \[0.14.4] where features that reference dev-only dependencies in non-workspace crates would cause a [panic](https://redirect.github.com/EmbarkStudios/krates/issues/66). ### [`v1.5.6`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.6): Release 1.5.6 - cargo-deny 0.14.4 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.5...v1.5.6) ##### Fixed - [PR#586](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/586) resolved 2 issues with crate graph creation, see [krates#60](https://redirect.github.com/EmbarkStudios/krates/issues/60) and [krates#64](https://redirect.github.com/EmbarkStudios/krates/issues/64) for more details. ### [`v1.5.5`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.5): Release 1.5.5 - cargo-deny 0.14.2 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.4...v1.5.5) ##### Added - [PR#545](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/545) added the ability to specify additional license exceptions via [additional configuration files](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#additional-exceptions-configuration-file). - [PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549) added the [`bans.build`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-build-field-optional) configuration option, opting in to checking for [file extensions](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-script-extensions-field-optional), [native executables](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-executables-field-optional), and [interpreted scripts](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-interpreted-field-optional). This resolved [#​43](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/43). ##### Changed - [PR#557](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/557) introduced changes to how [`dev-dependencies`](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#development-dependencies) are handled. By default, crates that are only used as dev-dependencies (ie, there are no normal nor build dependency edges linking them to other crates) will no longer be considered when checking for [`multiple-versions`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-multiple-versions-field-optional) violations. This can be re-enabled via the [`bans.multiple-versions-include-dev`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-multiple-versions-include-dev-field-optional) config field. Additionally, licenses are no longer checked for `dev-dependencies`, but can be re-enabled via [`licenses.include-dev`](https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-include-dev-field-optional) the config field. `dev-dependencies` can also be completely disabled altogether, but this applies to all checks, including `advisories` and `sources`, so is not enabled by default. This behavior can be enabled by using the [`exclude-dev`](https://embarkstudios.github.io/cargo-deny/checks/cfg.html#the-exclude-dev-field-optional) field, or the `--exclude-dev` command line flag. This change resolved [#​322](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/322), [#​329](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/329), [#​413](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/413) and [#​497](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/497). ##### Fixed - [PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549) fixed [#​548](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/548) by correctly locating cargo registry indices from an git ssh url. - [PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549) fixed [#​552](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/552) by correctly handling signal interrupts and removing the advisory-dbs lock file. - [PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549) fixed [#​553](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/553) by adding the `native-certs` feature flag that can enable the OS native certificate store. ##### Deprecated - [PR#549](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/549) moved `bans.allow-build-scripts` to [`bans.build.allow-build-scripts`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-allow-build-scripts-field-optional). `bans.allow-build-scripts` is still supported, but emits a warning. ### [`v1.5.4`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.4): Release 1.5.4 - cargo-deny 0.14.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.3...v1.5.4) Updated the cargo version to 1.71.0 which should give significant improvements to run times due to using the crates.io sparse index instead of the old git index. ### [`v1.5.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.3): Release 1.5.3 - cargo-deny 0.14.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.2...v1.5.3) ##### Changed - [PR#520] resolved [#​522](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/522) by completely removing all dependencies upon `git2` and `openssl`. This was done by transitioning from `git2` -> `gix` for all git operations, both directly in this crate, as well as replacing [`crates-index`](https://redirect.github.com/frewsxcv/rust-crates-index) with [`tame-index`](https://redirect.github.com/EmbarkStudios/tame-index). - [PR#520] bumped the MSRV from `1.65.0` -> `1.70.0` - [PR#523](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/523) added "(try `cargo update -p <crate_name>`)" when an advisory is detected for a crate. Thanks [@​Victor-N-Suadicani](https://redirect.github.com/Victor-N-Suadicani)! ##### Fixed - [PR#520] resolved [#​361](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/361) by printing output when a fetch is being performed to clarify what is taking time. - [PR#520] (possibly) resolved [#​435](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/435) by switching all git operations from `git2` to `gix`. - [PR#520] resolved [#​439](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/439) by using minimal refspecs for cloning and fetching all remote git repositories (indices or advisory databases) where only the remote HEAD is needed to update the local repository, regardless of the default remote branch pointed to by HEAD. - [PR#520] resolved [#​446](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/446) by ensuring (and testing) that crates from non-registry sources are not checked for advisories, eg. in the case that a local crate is named and versioned the same as a crate from crates.io that has an advisory that affects it. - [PR#520] resolved [#​515](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/515) by always opening the correct registry index based upon the environment. - [PR#531](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/531) resolved [#​210](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/210) by adding `osi` and `fsf` options to `licenses.allow-osi-fsf-free`. Thanks [@​zkxs](https://redirect.github.com/zkxs)! - [PR#533](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/533) resolved [#​521](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/521) and [#​524](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/524) by allowing clarifications to add files that are used to verify the license information is up to date, rather than needing to match one of the license files that was discovered. - [PR#534](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/534) resolved [#​479](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/479) by improving how advisory databases are cloned and/or fetched, notably each database now uses `gix`'s [file-based locking](https://docs.rs/gix-lock/7.0.2/gix_lock/struct.Marker.html#method.acquire_to_hold_resource) to ensure that only one process has mutable access to an advisory database repo at a time. ##### Removed - [PR#520] removed all features, notably `standalone`. This is due to cargo still being in transition from `git2` -> `gix` and having no way to compiled *without* OpenSSL. Once cargo is a better state with regards to this we can add back that feature. [PR#520]: https://redirect.github.com/EmbarkStudios/cargo-deny/pull/520 ### [`v1.5.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.2): Release 1.5.2 - cargo-deny 0.13.9 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.1...v1.5.2) ##### Fixed - [PR#506](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/506) replaced `atty` (unmaintained) with `is-terminal`. Thanks [@​tottoto](https://redirect.github.com/tottoto)! - [PR#511](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/511) resolved [#​494](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/494), [#​507](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/507), and [#​510](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/510) by fixing up how and when urls are normalized. - [PR#512](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/512) resolved [#​509](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/509) by fixing casing of the root configuration keys. - [PR#513](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/513) resolved [#​508](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/508) by correctly using the crates.io sparse index when checking for yanked crates if specified by the user, as well as falling back to the regular git index if the sparse index is not present. ### [`v1.5.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.1): Release 1.5.1 - cargo-deny 0.13.8 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.5.0...v1.5.1) ##### Added - [PR#504](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/504) (though really [PR#365](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/365)) resolved [#​350](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/350) by adding the `deny-multiple-versions` field to `bans.deny` entries, allowing specific crates to deny multiple versions while allowing/warning on them more generally. Thanks [@​leops](https://redirect.github.com/leops)! - [PR#493](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/493) resolved [#​437](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/437) by also looking for deny configuration files in `.cargo`. Thanks [@​DJMcNab](https://redirect.github.com/DJMcNab)! - [PR#502](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/502) resolved [#​500](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/500) by adding initial support for [sparse indices](https://blog.rust-lang.org/inside-rust/2023/01/30/cargo-sparse-protocol.html). ##### Fixed - [PR#503](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/503) resolved [#​498](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/498) by falling back to more lax parsing of the SPDX expression of crate if fails to parse according to the stricter but more correct rules. ### [`v1.5.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.5.0): Release 1.5.0 - cargo-deny 0.13.7 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.4.0...v1.5.0) Update from cargo-deny 0.13.5 to 0.13.7, apparently I missed two releases, that's embarrassing. #### 0.13.7 ##### Fixed - [PR#491](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/491) resolved [#​490](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/490) by building libgit2 from vendored sources instead of relying on potentially outdated packages. #### 0.13.6 ##### Changed - [PR#489](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/489) updated dependencies, notably `clap`, `cargo`, and `git2` ##### Added - [PR#485](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/485) added this project and repository to our Security Bug Bounty Program and has Private vulnerability reporting enabled. See [`SECURITY.md`](./SECURITY.md) for more details. - [PR#487](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/487) added `allow-wildcard-paths`, fixing [#​488](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/448) by allowing wildcards to be denied, but allowing them for internal, private crates. Thanks [@​sribich](https://giqthub.com/sribich)! ##### Fixed - [PR#489](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/489) fixed an issue where git sources where `branch=master` would be incorrectly categorized as not specifying the branch (ie use HEAD of default branch). ### [`v1.4.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.4.0): Release 1.4.0 - cargo-deny 0.13.5 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.3.2...v1.4.0) ##### Changed - Updated to cargo-deny 0.13.5 ### [`v1.3.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.3.2): - cargo-deny 0.12.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.3.1...v1.3.2) ##### Added - [PR#54](https://redirect.github.com/PR/cargo-deny-action/issues/54) resolved [#​53](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/53) by adding the `credentials` parameter for passing in a private access token to allow cargo to fetch private github repositories. Thanks [@​danielhaap83](https://redirect.github.com/danielhaap83)! ### [`v1.3.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.3.1): - cargo-deny 0.12.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.3.0...v1.3.1) ##### Fixed - [PR#426](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/426) fixed an oversight in [PR#422](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/422), fully resolving [#​412](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/412) by allowing both `https` and `ssh` URLs for advisory databases. Thanks [@​jbg](https://redirect.github.com/jbg)! ##### Changed - [PR#427](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/427) updated dependencies. ### [`v1.3.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.3.0): - cargo-deny 0.12.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.17...v1.3.0) ##### Removed - [PR#423](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/423) removed the `fix` subcommand. This functionality was far too complicated for far too little benefit. ##### Fixed - [PR#420](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/420) resolved [#​388](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/388) by adding the ability to fetch advisory databases via the `git` CLI. Thanks [@​danielhaap83](https://redirect.github.com/danielhaap83)! - [PR#422](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/422) fixed [#​380](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/380) and [#​410](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/410) by updating a few transitive dependencies that use `git2`, as well as removing the usage of `rustsec`'s `git` feature so that we now use `git2 v0.14`, resolving a crash issue in new `libgit2` versions available in eg. rolling release distros such as Arch. This should also make it easier to update and improve git related functionality since more of it is inside cargo-deny itself now. - [PR#424](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/424) *really* fixed (there's even a test now!) [#​384](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/384) by adding each version's reverse dependency graph in the ascending order. ### [`v1.2.17`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.17): - cargo-deny 0.11.4 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.16...v1.2.17) #### Changed - [PR#51](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/51) updated the image to use Rust 1.60.0 by default. Thanks [@​MarcoIeni](https://redirect.github.com/MarcoIeni)! ### [`v1.2.16`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.16): - cargo-deny 0.11.4 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.15...v1.2.16) #### Added - [PR#49](https://redirect.github.com/EmbarkStudios/cargo-deny-action/pull/49) added the `command-arguments` option to the action. Thanks [@​ryo33](https://redirect.github.com/ryo33)! ### [`v1.2.15`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.15): - cargo-deny 0.11.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.14...v1.2.15) ##### Fixed - Accidentally change how arguments were forwarded to cargo-deny which broken more complicated invocations ### [`v1.2.14`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.14): - cargo-deny 0.11.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.13...v1.2.14) ##### Added - Added `git` to the image, resolving [#​40](https://redirect.github.com/EmbarkStudios/cargo-deny-action/issues/40) ### [`v1.2.13`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.13): - cargo-deny 0.11.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.12...v1.2.13) ##### Changed - Added the `rust-version` github actions variable, allowing you to specify a specific cargo version to use when running cargo-deny, including nightly, or other unstable versions. ### [`v1.2.12`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.12): - cargo-deny 0.11.3 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.11...v1.2.12) ##### Fixed - [PR#407](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/407) resolved [#​406](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/406) by always checking license exceptions first. ### [`v1.2.11`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.10...v1.2.11) [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.10...v1.2.11) ### [`v1.2.10`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.10): - cargo-deny 0.11.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.9...v1.2.10) ##### Added - [PR#391](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/391) resolved [#​344](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/344) by adding `[licenses.ignore-sources]` to ignore license checking for crates sourced from 1 or more specified registries. Thanks [@​ShellWowza](https://redirect.github.com/ShellWowza)! - [PR#396](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/396) resolved [#​366](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/366) by also looking for `.deny.toml` in addition to `deny.toml` if a config file is not specified. ##### Changed - [PR#392](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/392) updated all dependencies. ##### Fixed - [PR#393](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/393) resolved [#​371](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/371) by changing the default for version requirements specified in config files to accept all versions, rather than using the almost-but-not-quite default of `*`. - [PR#394](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/394) resolved [#​147](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/147) by ignore *all* private crates, not only the ones in the workspace. - [PR#395](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/395) resolved [#​375](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/375) by fixing a potential infinite loop when using `[bans.skip-tree]`. ### [`v1.2.9`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.9): - cargo-deny 0.11.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.8...v1.2.9) Fixed image to use proper tag. ### [`v1.2.8`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.8): - cargo-deny 0.11.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.7...v1.2.8) Updated the cargo version in the image to 1.57.0 to allow for the use of [custom profiles](https://doc.rust-lang.org/cargo/reference/profiles.html#custom-profiles). ### [`v1.2.7`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.7): v1.2.6 - cargo-deny 0.11.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.6...v1.2.7) #### \[0.11.0] - 2021-12-06 ##### Changed - [PR#382](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/382) updated dependencies and bumped the Minimum Stable Rust Version to **1.56.1**. #### \[0.10.3] - 2021-11-22 ##### Changed - [PR#379](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/379) updated `askalono` which got rid of the `failure` dependency, which was pulling in a lot of additional crates that are now gone. ##### Fixed - [PR#379](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/379) fixed [#​378](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/378) which was an edge case where the `sources` check was executed against a crate that didn't use any crates from crates.io, and the config file was shorter than the crates.io URL. #### \[0.10.2] - 2021-11-21 ##### Fixed - [PR#376](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/376) fixed the JSON formatting when using `--format json` output option. Thanks [@​dnaka91](https://redirect.github.com/dnaka91)! ##### Changed - [PR#377](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/377) updated dependencies. #### \[0.10.1] - 2021-11-10 ##### Fixed - [PR#347](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/374) resolved [#​372](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/372) by correcting a slight mistake that resulted in an incorrect hash making cargo-deny unable to lookup index or crate information from the local file system. #### \[0.10.0] - 2021-10-29 ##### Added - [PR#353](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/353) resolved [#​351](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/351) by adding the `sources.private` field to blanket allow git repositories sourced from a particular url. - [PR#359](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/359) resolved [#​341](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/341) and [#​357](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/357) by adding support for the [`--frozen`, `--locked`, and `--offline`](https://doc.rust-lang.org/cargo/commands/cargo-metadata.html#manifest-options) flags to determine whether network access is allowed, and whether the `Cargo.lock` file can be created and/or modified. - [PR#368](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/368) added the `licenses.unused-allowed-license` field to control whether the [L006 - license was not encountered](https://embarkstudios.github.io/cargo-deny/checks/licenses/diags.html#l006---license-was-not-encountered) diagnostic. Thanks [@​thomcc](https://redirect.github.com/thomcc)! ##### Changed - [PR#358](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/358) bumped the Minimum Stable Rust Version to **1.53.0**. - [PR#358](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/358) bumped various dependencies, notably `semver` to `1.0.3`. #### \[0.9.1] - 2021-03-26 ##### Changed - Updated dependencies ### [`v1.2.6`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.6): Release 1.2.6 - cargo-deny 0.9.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.5...v1.2.6) ##### Changed - Updated dependencies ### [`v1.2.5`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.5): - cargo-deny 0.9.0 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.4...v1.2.5) ##### Changed - Updated `krates`, which in turn uses an updated `cargo_metadata` which uses [`camino`](https://docs.rs/camino) for utf-8 paths. Rather than support both vanilla Path/Buf and Utf8Path/Buf, cargo-deny now just uses Utf8Path/Buf, which means that non-utf-8 paths for things like your Cargo.toml manifest or license paths will no longer function. This is a breaking change, that can be reverted if it disruptive for users, but the assumption is that cargo-deny is operating on normal checkouts of rust repositories that are overwhelmingly going to be utf-8 compatible paths. ### [`v1.2.4`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.4): Update image [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.3...v1.2.4) Updates the base image to rust 1.50.0 to fix issue if you pin to it via eg rust-toolchain. ### [`v1.2.3`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.3): - cargo-deny 0.8.5 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.2...v1.2.3) ##### Added - [PR#315](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/315) resolved [#​312](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/312) by adding support for excluding packages in the deny configuration file, in addition to the existing support for the `--exclude` CLI option. Thanks [@​luser](https://redirect.github.com/luser)! ##### Fixed - [PR#318](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/318) fixed [#​316](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/316) by adding a workaround for crate versions with pre-release identifiers in them that could be erroneously marked as matching advisories in an advisory database. Thanks for reporting this [@​djc](https://redirect.github.com/djc)! ### [`v1.2.2`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.2): - cargo-deny 0.8.4 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.2.1...v1.2.2) ##### Changed - Updated dependencies, notably `rustsec`, `crossbeam`\*, and `cargo`. - Bumped the Minimum Stable Rust Version to **1.44.1**. ### [`v1.2.1`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/v1.2.1): - cargo-deny 0.8.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/1.2.0...v1.2.1) Updates cargo-deny from 0.7.3 -> 0.8.1 ##### Added - [PR#238](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/238) resolved [#​225](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/225) by adding a `wrappers` field to `[bans.deny]` entries, which allows the banned crate to be used only if it is a direct dependency of one of the wrapper crates. Thanks [@​Stupremee](https://redirect.github.com/Stupremee)! - [PR#244](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/244) resolved [#​69](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/69) by adding support for multiple advisory databases, which will all be checked during the `advisory` check. Thanks [@​Stupremee](https://redirect.github.com/Stupremee)! - [PR#243](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/243) resolved [#​54](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/54) by adding support for compiling and using `cargo` crate directly via the `standalone` feature. This allows `cargo-deny` to be used without cargo being installed, but it still requires [**rustc**](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/295) to be available. Thanks [@​Stupremee](https://redirect.github.com/Stupremee)! - [PR#275](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/275) resolved [#​64](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/64) by adding a diagnostic when a user tries to ignore an advisory identifier that doesn't exist in any database. - [PR#262](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/262) added the `fix` subcommand, which was added to bring `cargo-deny` to feature parity with `cargo-audit` so that it can take over for `cargo-audit` as the [official frontend](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/194) for the the [RustSec Advisory Database](https://redirect.github.com/RustSec/advisory-db). ##### Changed - `advisories.db-url` has been deprecated in favor of `advisories.db-urls` since multiple databses are now supported. - `advisories.db-path` is now no longer the directory into which the advisory database is cloned into, but rather a root directory where each unique database is placed in a canonicalized directory similar to how `.cargo/registry/index` directories work. - [PR#274](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/274) resolved [#​115](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/115) by normalizing git urls. Thanks [@​senden9](https://redirect.github.com/senden9)! ##### Fixed - [#​265](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/265) A transitive dependency (`smol_str`) forced the usage of the latest Rust stable version (1.46) which was unintended. We now state the MSRV in the README and check for it in CI so that changing the MSRV is a conscious decision. - [PR#287](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/287) fixed [#​286](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/286), which could happen if using a git source where the representation differed slightly between the user specified id and the id used for dependencies. - [PR#249](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/249) fixed [#​190](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/190) by printing a different diagnostic for when the path specified for a clarification license file could not be found. Thanks [@​khodzha](https://redirect.github.com/khodzha)! - [PR#297](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/297) fixed a couple of diagnostics to have codes. - [PR#296](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/296) resolved [#​288](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/288) by improving the information in diagnostics pertaining to advisories. Thanks [@​tomasfarias](https://redirect.github.com/tomasfarias)! ### [`v1.2.0`](https://redirect.github.com/EmbarkStudios/cargo-deny-action/releases/tag/1.2.0): - cargo-deny 0.8.1 [Compare Source](https://redirect.github.com/EmbarkStudios/cargo-deny-action/compare/v1.1.0...1.2.0) Updates cargo-deny from 0.7.3 -> 0.8.1 ##### Added - [PR#238](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/238) resolved [#​225](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/225) by adding a `wrappers` field to `[bans.deny]` entries, which allows the banned crate to be used only if it is a direct dependency of one of the wrapper crates. Thanks [@​Stupremee](https://redirect.github.com/Stupremee)! - [PR#244](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/244) resolved [#​69](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/69) by adding support for multiple advisory databases, which will all be checked during the `advisory` check. Thanks [@​Stupremee](https://redirect.github.com/Stupremee)! - [PR#243](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/243) resolved [#​54](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/54) by adding support for compiling and using `cargo` crate directly via the `standalone` feature. This allows `cargo-deny` to be used without cargo being installed, but it still requires [**rustc**](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/295) to be available. Thanks [@​Stupremee](https://redirect.github.com/Stupremee)! - [PR#275](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/275) resolved [#​64](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/64) by adding a diagnostic when a user tries to ignore an advisory identifier that doesn't exist in any database. - [PR#262](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/262) added the `fix` subcommand, which was added to bring `cargo-deny` to feature parity with `cargo-audit` so that it can take over for `cargo-audit` as the [official frontend](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/194) for the the [RustSec Advisory Database](https://redirect.github.com/RustSec/advisory-db). ##### Changed - `advisories.db-url` has been deprecated in favor of `advisories.db-urls` since multiple databses are now supported. - `advisories.db-path` is now no longer the directory into which the advisory database is cloned into, but rather a root directory where each unique database is placed in a canonicalized directory similar to how `.cargo/registry/index` directories work. - [PR#274](https://redirect.github.com/EmbarkStudios/cargo-deny/pull/274) resolved [#​115](https://redirect.github.com/EmbarkStudios/cargo-deny/issues/115) by normalizing git urls. Thanks [@​senden9](https://redirect.github.com/senden9)! ##### Fixe </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbnRlcm5hbCJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |