ci(deps): bump EmbarkStudios/cargo-deny-action from 2.0.17 to 2.1.1

[dependabot]

Bumps EmbarkStudios/cargo-deny-action from 2.0.17 to 2.1.1.

Commits

• 3c63498 Fix use-git-cli deprecation (#116)
• 6f99e34 Bump to 0.20.2
• 8b229e2 Deprecate use-git-cli
• bb137d7 Bump to 0.19.8
• a531616 Bump to 0.19.7
• 6c8f9fa Bump to 0.19.5
• f28dad7 Remove mergify
• e4d1338 Add xray to the list of repositories using this action (#105)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[epappas]

PR #531: ci(deps): bump EmbarkStudios/cargo-deny-action from 2.0.17 to 2.1.1 (by dependabot[bot])

Summary

This Dependabot PR updates the cargo-deny GitHub Action used in the CI supply-chain/license-audit job (.github/workflows/ci.yml) from v2.0.17 to v2.1.1. The pin remains a full commit SHA with a version comment, and the upstream release primarily bumps the bundled cargo-deny binary through several releases (0.19.5 → 0.20.2) and deprecates the use-git-cli action input. The workflow's explanatory comment about why the action is used instead of a direct cargo deny install is preserved.

Issues Found

CRITICAL Issues (Must Fix Before Merge)

None found.

HIGH Severity Issues (Advised to Fix Before Merge)

None found.

MEDIUM Severity Issues (Optional to Fix Before Merge)

1. Reliability — Underlying tool version jump may change check behavior. The action bump silently upgrades the cargo-deny binary from ~0.19.x to 0.20.2 (per the upstream commits listed: "Bump to 0.19.5/0.19.7/0.19.8/0.20.2"). Evidence:

   -        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v2.0.17
   +        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1

   Multi-version jumps of cargo-deny can introduce new or renamed lints, updated SPDX license lists, and deprecated deny.toml fields, any of which can turn a previously-green audit red. Impact is bounded because this PR's own CI run exercises exactly this job — but if the cargo-deny job fails on this PR, the fix belongs in deny.toml, not in reverting the bump. Proposed fix: confirm the cargo-deny workflow job is green on this PR before merge, and address any new warnings in deny.toml in a follow-up.

LOW Severity Issues (Minor Improvements)

1. Maintainability — Deprecated use-git-cli input. This release deprecates the action's use-git-cli input (upstream commits "Deprecate use-git-cli" and "Fix use-git-cli deprecation (feat(validator): Validation System Improvements & Resource Management #116)"). The visible hunk only shows with: command: check (plus a comment referencing all-features), so I cannot confirm whether this workflow sets use-git-cli — I am uncertain. If it does, expect deprecation warnings and plan to remove the input; if it doesn't, no action needed.

Suggestions for Improvements

• Verify out-of-band that SHA 3c6349835b2b7b196a839186cb8b78e02f7b5f25 genuinely tags v2.1.1 in EmbarkStudios/cargo-deny-action (the PR description's commit list is consistent with this — 3c63498 is the head commit of the compare range — but SHA verification is the whole point of pinning and costs one click).
• Consider adding EmbarkStudios/cargo-deny-action to the Dependabot config's auto-merge allowlist only if the cargo-deny CI job is a required status check, so green bumps like this merge without manual toil.

Positive Observations

• The action remains pinned to a full-length commit SHA with a human-readable # v2.1.1 comment — the correct supply-chain-hardening pattern for third-party actions, and Dependabot preserved it.
• The pre-existing comment explaining why the action is used instead of a direct cargo deny install (advisory-db fetch failures on these runners) is untouched, keeping the rationale coherent with the change.
• Scope is minimal: one line, one file, no unrelated churn.

Recommendation and Next Steps

APPROVE — this is a low-risk, SHA-pinned CI dependency bump whose blast radius is confined to the audit job itself, which this PR's own CI run validates; merge once the cargo-deny job is green (and fix any newly-surfaced deny.toml lints rather than rolling back if it isn't).

[dependabot]

Superseded by #540.