fix(release): drop version requirements from intra-workspace path deps - #6
1 finding
The change matches its stated goal — dropping version = "…" from intra-workspace path dependencies and adding a workflow guard against re-introducing them — but the description omits a significant piece of the diff: the deny.toml edit that adds allow-wildcard-paths = true. Without that line, cargo-deny's existing wildcards = "deny" would fail on the very version-less path deps this PR creates, so it is not incidental. The body should mention it. No other problems found; the workflow step interpolates no untrusted context and widens no permissions. The code index for this repository is cold, so this review saw the diff alone.
| Finding | Where | |
|---|---|---|
 |
deny.toml gains allow-wildcard-paths = true, unmentioned in the PR body |
(pull request description) |
 deny.toml gains `allow-wildcard-paths = true`, unmentioned in the PR body
(pull request description)
[RULE] description-missing-significant-change
The description never mentions the deny.toml change, which is a significant part of this diff. Adding allow-wildcard-paths = true is the necessary counterpart to dropping the version requirements — without it, cargo-deny's existing wildcards = "deny" rule would fail on every version-less path dependency. The body explains the motivation for the Cargo.toml edits and the workflow guard in detail but says nothing about relaxing the deny configuration that those edits force.
