Treat git
dependencies the same as path
dependencies for allow-wildcard-paths
.
#599
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #488, making it possible to ban wildcards without also banning git-only dependencies.
This may not be a perfect fit for some use cases — arguably
git
dependencies are less implicitly-versioned thanpath
dependencies sincepath
dependencies are typically always the same revision of the same repo, butgit
dependencies might becargo update
d to totally different code. But I can't think of an alternative that's equal-or-better in correctness short of introducing even more configuration.(I suspect that the whole idea of counting path-only or git-only deps as wildcard versions ever is wrong, because the Cargo documentation says that “…the version key always implies that the package is available in a registry. version, git, and path keys are considered separate locations for resolving the dependency” — which implies that a dep without
version
is different from a dep with a wildcard version. However, figuring out Cargo's behavior there and how cargo-deny should treat it feels like a rabbit hole I don't want to go down just to fix #488. I left a TODO comment suggesting further consideration.)