build(deps): update pre-commit hook embarkstudios/cargo-deny to v0.20.2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
EmbarkStudios/cargo-deny	repository	minor	0.19.0 → 0.20.2

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

EmbarkStudios/cargo-deny (EmbarkStudios/cargo-deny)

v0.20.2

Compare Source

Fixed

• PR#884 fixed snapshot filenames on Windows which caused the release binary publish to fail...again.

v0.20.1

Compare Source

Fixed

• PR#883 fixed snapshot filenames on Windows which caused the release binary publish to fail.

v0.20.0

Compare Source

Changed

• PR#881 refactored the CLI, moving some duplicated options/flags into the root and removing several deprecated options/flags/values. See the PR for a full list of changes.

Added

• PR#879 resolved #​873 by adding a new bans.std-replacements lint which checks the graph for crates.io sourced crates that have been partially or fully replaced in std and/or core.

Fixed

• PR#880 resolved #​765 by respecting non-default build script paths in manifests.
• PR#881 resolved #​874 by cleaning up the CLI, deduplicating some options/flags that caused bug in the list subcommand.

v0.19.9

Compare Source

Added

• PR#866 added sources.unused-allowed-org

Fixed

• PR#870 resolved #​868 by spawning scoped threads directly, allowing forward progress even on severely constrained thread pool counts.
• PR#871 resolved #​869 by ignoring wildcards on crates that depend on themselves.

v0.19.8

Compare Source

Fixed

• PR#864 fixed matching of ^ and ~ with on prerelease versions for when checking if a crate is affected by an advisory. As of the time of the PR, this literally affected none of published versions of any crate with an advisory, but this just ensures such a case will be handled in the future.

v0.19.7

Compare Source

Changed

• PR#860 updated crates, resolving krates#111.

v0.19.6

Compare Source

Fixed

• PR#854 resolved #​854 by removing environment variables that affect repo paths before cloning or fetching the advisory database.

v0.19.5

Compare Source

Fixed

• PR#857 fixed a segfault reported in #​855.

v0.19.4

Compare Source

Fixed

• PR#847 and PR#848 resolved #​846, which was an advisory parsing bug that only affected Windows.

v0.19.3

Compare Source

Fixed

• PR#847 resolved #​846, which only affected Windows.

v0.19.2

Compare Source

Fixed

• PR#845 fixed structural issues with SARIF output, resolving #​818. Thanks @​KyleChamberlin!

v0.19.1

Compare Source

Fixed

• PR#833 fixed an issue where the maximum advisory database staleness was over 14 years instead of the intended 90 days.
• PR#839 fixed an issue where unsound advisories would appear for transitive dependencies despite requesting them only for workspace dependencies, resolving #​829.
• PR#840 resolved #​797 by passing --filter-platform when collecting cargo metadata if only a single target was requested either in the config or via the command line.
• PR#841 fixed an issue where --frozen would not disable fetching of the advisory DB, resolving #​759.
• PR#842 and PR#844 updated crates. Notably krates was updated to resolve two issues with crates being pruned from the graph used when running checks. Resolving these two issues may mean that updating cargo-deny may highlight issues that were previously hidden.
  • EmbarkStudios/krates#106 would fail to pull in crates brought in via a feature if that crate had its lib target renamed by the package author.
  • EmbarkStudios/krates#109 would fail to bring in optional dependencies if they were brought in by a weak feature in a crate also brought in by a weak feature.

Changed

• PR#830 removed gix in favor of shelling out to git. This massively improves build times and eases maintenance as gix bumps minor versions quite frequently. If cargo-deny is used in an environment that for some reason allows internet access but doesn't have git available, the advisory database would need to be updated before calling cargo-deny.
• PR#838 removed rustsec in favor of manually implemented advisory parsing and checking, with a nightly cron job that checks that the implementation exactly matches rustsec on the official rustsec advisory db.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.