From 9badf7a9ed638101b17dcbc7461e8801f70782d8 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Wed, 30 Sep 2026 22:37:47 +1000 Subject: [PATCH] chore(deps): skip syn 2 and windows-sys 0.52 in cargo-deny duplicate bans (LAB-6648) serde 1.0.229 and thiserror 2.0.21 move their derive crates to syn 3 while cbindgen and zeroize_derive stay on syn 2. cbindgen 0.29.4 moves tempfile's rustix/errno to windows-sys 0.52 while clap's anstyle crates stay on 0.61. Both splits fail multiple-versions = "deny" on routine updates. Skip the older major of each, version-scoped, so any further duplicate still fails. Also correct the getrandom@0.2 comment, which named only the 0.4 split. --- deny.toml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index d897dce..268313f 100644 --- a/deny.toml +++ b/deny.toml @@ -70,11 +70,18 @@ deny = [] # Skip specific dependencies from multiple-version checks # These are transitive dependencies where version duplication is unavoidable skip = [ - # getrandom 0.2.x (aes-gcm crypto chain) vs 0.4.x (tempfile/cbindgen build-dep) + # getrandom 0.2.x (aes-gcm crypto chain) vs the newer major tempfile pulls in + # through the cbindgen build-dep (0.4.x up to cbindgen 0.29.2, 0.3.x from 0.29.4) { crate = "getrandom@0.2", reason = "Transitive via aes-gcm crypto chain" }, # winnow 0.7.x vs 1.x — both pulled by toml@0.9 (direct + via toml_parser) # through cbindgen build-dependency; internal split, can't resolve { crate = "winnow@0.7", reason = "Transitive via toml/cbindgen (build-dependency)" }, + # syn 2.x (cbindgen build-dep, zeroize_derive) vs 3.x (serde_derive, thiserror-impl); + # proc-macro/build-time only, clears once the graph moves to syn 3 + { crate = "syn@2", reason = "Ecosystem mid-migration to syn 3; serde_derive and thiserror-impl moved first" }, + # windows-sys 0.52.x (tempfile -> rustix/errno) vs 0.61.x (clap's anstyle crates), + # both under the cbindgen build-dep; Windows-only bindings + { crate = "windows-sys@0.52", reason = "Transitive via cbindgen (build-dependency) crates on an older windows-sys" }, ] # Skip crate trees entirely (e.g., frequently-updated foundational crates)