The nix flake's checks were failing for various reasons. The following fixes are
applied to get it up to date again.
- Update to release-24.11, since `crane` requires it – also to keep up-to-date
- Add `.json` to the source filters to allow for testing patch migration
- Ensure that the `rad` and `git-remote-rad` binaries are built for the nextest
check. N.b. the binaries need to be in the target dir of `radicle-cli` since
that is where the nextest check runs from.
- Add `cargo-audit` and `cargo-deny`, to the devShell, to allow for running those
tools locally
- Bump `gix-path` to 0.10.11 to avoid a vulnerability[^0]
[^0]: https://rustsec.org/advisories/RUSTSEC-2024-0371
"cargo deny" changed their configuration file in a release made in
February. While the heartwood deny.toml still works, it triggers a
bunch of deprecation warnings now. Change deny.toml to follow
the new defaults and locations for configuration fields so that no
warnings about that are triggered.
Add the "MPL-2.0" license to list of allowed licenses. It was
previously allowed by virtue of being an OSI license, but that setting
has been deprecated.
This still leaves many actual errors and warnings in the code base,
such as duplicate versions of the same dependency, or licenses that
are not explicitly allowed, and one security advisory.
Signed-off-by: Lars Wirzenius <liw@liw.fi>
Add `deny.toml` with a few exceptions, and update certain dependencies
to get rid of duplicates.
Running `cargo deny check` will yield some warnings still, but no
errors.
Sebastian Thiel
Fintan Halpenny
Lars Wirzenius
cloudhead