Update dependency cargo-deny to v0.18.2

[renovate]

This PR contains the following updates:

Package	Update	Change
cargo-deny	minor	0.16.1 -> 0.18.2

---

Release Notes

EmbarkStudios/cargo-deny (cargo-deny)

v0.18.2

Compare Source

Added

• PR#753 resolved #​752 by adding back the advisories.unmaintained config option. See the docs for how it can be used. The default matches the current behavior, which is to error on any unmaintained advisory, but adding unmaintained = "workspace" to the [advisories] table will mean unmaintained advisories will only error if the crate is a direct dependency of your workspace.

v0.18.1

Compare Source

Fixed

• PR#749 updated krates to pull in the fix for EmbarkStudios/krates#100.

v0.18.0

Compare Source

Changed

• PR#746 changed the directory naming of advisory databases, again, so the name uses the last path component and a different, but also stable, hashing algorithm. Eg. the default https://github.com/rustsec/advisory-db will now be placed in $CARGO_HOME/advisory-dbs/advisory-db-3157b0e258782691.
• PR#746 changed the MSRV to 1.85.0 and uses edition 2024.

Fixed

• PR#746 fixes an issue when using cargo 1.85.0 where source urls were not being properly assigned to crates.io due to the constant being used no longer matching the new path used in cargo 1.85.0 causing eg. workspace dependency checks to fail.

v0.17.0

Compare Source

Changed

• PR#745 updated tame-index to 0.18.0 so that cargo 1.85.0 is transparently supported along with older cargo versions.
• PR#745 now uses the same stable hashing as cargo 1.85.0 for the advisory databases, which changes their path, but will notably now be the same across all host platforms.

v0.16.4

Compare Source

Changed

• PR#742 updated gix to 0.70, to resolve RUSTSEC-2025-0001.

Fixed

• PR#739 fixed an issue where sources could match even if the hostname was not the same.

v0.16.3

Compare Source

Changed

• PR#721 updated rust-version to 1.81.0 to accurately reflect the minimum rust version required to compile, resolving #​720.
• PR#722 updated the SPDX license list to 3.25.0.

Fixed

• PR#726 resolved #​725 by adding the unnecessary-skip diagnostic, emitted when there is a skip configured for a crate that only has one version in the graph.

v0.16.2

Compare Source

Fixed

• PR#703 resolved #​696 by no longer emitting errors when failing to deserialize deprecated fields, and removed some lingering documentation that wasn't removed in PR#611.
• PR#719 updated to krates -> 0.17.5, fixing an issue where cargo-deny could panic due to incorrectly resolving features for different versions of the same crate referenced by a single crate.
• PR#719 resolved #​706 by removing a warning issued when users use ignored scheme modifiers for source urls.
• PR#719 resolved #​718 by updating the book with missing arguments.

Added

• PR#715 resolved #​714 by adding support for Edition 2024. Thanks @​kpcyrd!
• PR#710 resolved #​708 by allowing for unpublished workspace crates to be excluded from the dependency graph that checks are run against, either via the --exclude-unpublished CLI argument or the graph.exclude-unpublished config field. Thanks @​Tastaturtaste!

Changed

• PR#711 updated goblin -> 0.9.2
• PR#713 updated various crates, notably rustsec -> 0.30.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.