fix: version every path dependency so cargo deny check bans passes - #8
Open
noahgift wants to merge 1 commit into
Open
fix: version every path dependency so cargo deny check bans passes#8noahgift wants to merge 1 commit into
cargo deny check bans passes#8noahgift wants to merge 1 commit into
Conversation
…#3) $ cargo deny check bans error[wildcard]: found 1 wildcard dependency for crate 'pforge-example-calculator' error[wildcard]: found 2 wildcard dependencies for crate 'telemetry-server' bans FAILED A `path` dependency with no `version` is a wildcard: it resolves to whatever is on disk locally, and to anything at all once published. The fleet deny.toml sets `wildcards = "deny"` for that reason. The 0.2.0 release fixed the four workspace-level path deps as a side effect — their pins had to move from "0.1.0" to "0.2" or publishing would have resolved the OLD crates.io copies — but the eight example crates were missed, because each is its own workspace and none is built by `cargo check --workspace`. Which is also why nobody noticed: they are outside every command the repo routinely runs. All eight now carry `version = "0.2"`. $ cargo deny check bans bans ok Verified the examples still resolve — `cargo metadata --no-deps` succeeds in each, and the main workspace still builds with 0 errors. Closes #3 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3.
A
pathdependency with noversionis a wildcard: it resolves to whatever is on disk locally, and to anything at all once published. The fleetdeny.tomlsetswildcards = "deny"for exactly that reason.The 0.2.0 release fixed the four workspace-level path deps as a side effect — their pins had to move from
"0.1.0"to"0.2"or publishing would have resolved the old crates.io copies into the new release. The eight example crates were missed.Worth noting why they were missed, since it is the same shape as several other findings: each example is its own workspace, so none of them is built by
cargo check --workspace. They sit outside every command the repo routinely runs, which is why a wildcard could live there indefinitely without anyone seeing it.All eight now carry
version = "0.2":Verified:
cargo metadata --no-depsresolves in each example workspace, and the main workspace still builds with 0 errors.