Repository: mozilla/cargo-vet
Pull request #242 (2022-06-30 10:52:21)

Bump serde_json from 1.0.81 to 1.0.82
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.81 to 1.0.82.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/serde-rs/json/releases">serde_json's releases</a>.</em></p>
<blockquote>
<h2>v1.0.82</h2>
<ul>
<li>Implement <code>From&lt;Option&lt;T&gt;&gt;</code> for serde_json::Value where <code>T: Into&lt;Value&gt;</code> (<a href="https://github-redirect.dependabot.com/serde-rs/json/issues/900">#900</a>, thanks <a href="https://github.com/kvnvelasco"><code>@​kvnvelasco</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/serde-rs/json/commit/f286714a4bdc476705f8fb95e1d2d5593d7c11fd"><code>f286714</code></a> Release 1.0.82</li>
<li><a href="https://github.com/serde-rs/json/commit/df704c246808a1ba83b90ee5672d4cf02bbb9f5e"><code>df704c2</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/serde-rs/json/issues/900">#900</a> from kvnvelasco/implement_from_option_for_value</li>
<li><a href="https://github.com/serde-rs/json/commit/b87778bf54dd4d7dc63aacd4c1d7f48e33317fa2"><code>b87778b</code></a> don't use experimental (in 1.36) Self:: access for enums</li>
<li><a href="https://github.com/serde-rs/json/commit/1bf61e9c087c33cc13063b538678120b2ca1d8e3"><code>1bf61e9</code></a> make Value be From&lt;Option<!-- raw HTML omitted -->&gt;</li>
<li><a href="https://github.com/serde-rs/json/commit/3d173405c2e63d0ce2dc575288b164c2ae265f3d"><code>3d17340</code></a> Bump oldest rustc for preserve_order feature to 1.56.1</li>
<li><a href="https://github.com/serde-rs/json/commit/dab5ed3ee97cef5e2b796513f8d9e4c7416e44bf"><code>dab5ed3</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/serde-rs/json/issues/895">#895</a> from dtolnay/ref</li>
<li><a href="https://github.com/serde-rs/json/commit/05e03ee181c56bd67c5315f1f68e8392da537128"><code>05e03ee</code></a> Eliminate all use of ref keyword</li>
<li><a href="https://github.com/serde-rs/json/commit/45f1c4a7441b81fab9824ee46b844d64233750e5"><code>45f1c4a</code></a> Resolve borrow_deref_ref clippy lint</li>
<li><a href="https://github.com/serde-rs/json/commit/de5c34b704c7a6cb764c5ef5742457c7f00155e3"><code>de5c34b</code></a> Resolve get_first clippy lint</li>
<li><a href="https://github.com/serde-rs/json/commit/6b91c96f8d508fae5e3c8f69b57e5b363c769384"><code>6b91c96</code></a> Check for outdated deps in fuzz target</li>
<li>Additional commits viewable in <a href="https://github.com/serde-rs/json/compare/v1.0.81...v1.0.82">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=serde_json&package-manager=cargo&previous-version=1.0.81&new-version=1.0.82)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/Cargo.lock b/Cargo.lock
index c3cdcb1..bfe6499 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1094,9 +1094,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.81"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b7ce2b32a1aed03c558dc61a5cd328f15aff2dbc17daad8fb8af04d2100e15c"
+checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
 dependencies = [
  "itoa",
  "ryu",
diff --git a/Cargo.toml b/Cargo.toml
index 17c9adf..85a8e22 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cargo-vet"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 authors = ["Bobby Holley <bobbyholley@gmail.com>"]
 license = "Apache-2.0/MIT"
@@ -32,7 +32,7 @@ libc = "0.2"
 nom = "7.1.1"
 reqwest = { version = "0.11.10", default-features = false, features = ["rustls-tls"] }
 serde = "1.0.136"
-serde_json = "1.0.79"
+serde_json = "1.0.82"
 tar = { version = "0.4.26", default-features = false }
 tempfile = "3.3.0"
 textwrap = { version = "0.15", default-features = false }
diff --git a/book/src/audit-entries.md b/book/src/audit-entries.md
index 32fc785..abcceb5 100644
--- a/book/src/audit-entries.md
+++ b/book/src/audit-entries.md
@@ -37,23 +37,10 @@ the dependency even if it's listed in the `unaudited` table.
 
 Specifies the relevant criteria for this audit. This field is required.
 
-## `targets`
-
-A string or array of strings specifying the targets for which this audit is
-valid.
-
-Unless otherwise specified, audit entries are assumed to apply to all platforms.
-However, they can optionally be restricted to certain platforms (so that, for
-example, an auditor can skim over complicated assembly code for a platform that
-their project doesn't target).
-
-The syntax for this field mirrors Cargo's syntax for [platform-specific
-dependencies](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#platform-specific-dependencies).
-
 ## `who`
 
 A string identifying the auditor. When invoking `cargo vet certify`, the
-value is auto-populated from the global git config.
+value is auto-populated from the git config.
 
 This field is optional, but encouraged for two reasons:
 * It makes it easier to attribute audits at a glance, particularly for
diff --git a/book/src/config.md b/book/src/config.md
index 4d0ba32..8dd6ce7 100644
--- a/book/src/config.md
+++ b/book/src/config.md
@@ -146,21 +146,6 @@ entries.
 
 Defaults to the empty set and is not inherited.
 
-#### `targets`
-
-A string or array of target specifiers for the platforms of interest for this
-top-level crate. These are the platforms that `cargo vet` will require audits
-for when traversing the subtree (audits can optionally [restrict their
-validity](audit-entries.md#targets) to a set of targets).
-
-For top-level crates, defaults to all platforms.
-
-#### `dev-targets`
-
-Same as the above, but applied to dev-dependencies.
-
-For top-level crates, defaults to all platforms.
-
 #### `notes`
 
 Free-form string for recording rationale or other relevant information.
diff --git a/book/src/specifying-policies.md b/book/src/specifying-policies.md
index 2157cff..687400e 100644
--- a/book/src/specifying-policies.md
+++ b/book/src/specifying-policies.md
@@ -11,10 +11,6 @@ requirements more precisely, such as:
 * **Using different criteria for different top-level crates.** Your workspace
   might contain both a production product and an internal tool, which might
 require different levels of audits for their dependencies.
-* **Ignoring targets you don't support.** Some dependencies are only built for
-  certain platforms. Additionally, audit records can [specify](audit-entries.md#targets)
-  that they do not cover platform-specific code for certain targets. You can
-  leverage these details by scoping `cargo vet` to your platforms of interest.
 
 If the default behavior works for you, there's no need to specify anything. If
 you wish to encode policies such as the above, you can do so in
diff --git a/src/format.rs b/src/format.rs
index 80cec67..458a110 100644
--- a/src/format.rs
+++ b/src/format.rs
@@ -356,13 +356,6 @@ pub struct PolicyEntry {
     #[serde(with = "serialization::string_or_vec_or_none")]
     pub dev_criteria: Option<Vec<Spanned<CriteriaName>>>,
 
-    /// TODO: figure this out
-    pub targets: Option<Vec<String>>,
-
-    /// `targets` but for dev-deps
-    #[serde(rename = "dev-targets")]
-    pub dev_targets: Option<Vec<String>>,
-
     /// Custom criteria for a specific first-party crate's dependencies.
     ///
     /// Any dependency edge that isn't explicitly specified defaults to `criteria`.
diff --git a/src/main.rs b/src/main.rs
index 71c4c91..02e0321 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -545,7 +545,6 @@ fn cmd_inspect(
 
     if sub_args.mode == FetchMode::Sourcegraph {
         let url = format!("https://sourcegraph.com/crates/{package}@v{version}");
-        let prompt = format!("open {url} in your browser");
         tokio::runtime::Handle::current()
             .block_on(prompt_criteria_eulas(
                 out,
@@ -555,7 +554,7 @@ fn cmd_inspect(
                 package,
                 None,
                 version,
-                &prompt,
+                Some(&url),
             ))
             .into_diagnostic()?;
 
@@ -577,7 +576,7 @@ fn cmd_inspect(
                 package,
                 None,
                 version,
-                "continue..."
+                None,
             ),
         );
         eulas.into_diagnostic()?;
@@ -985,7 +984,7 @@ async fn prompt_criteria_eulas(
     package: PackageStr<'_>,
     from: Option<&Version>,
     to: &Version,
-    final_prompt: &str,
+    url: Option<&str>,
 ) -> Result<(), io::Error> {
     let description = if let Some(from) = from {
         format!(
@@ -1047,9 +1046,21 @@ async fn prompt_criteria_eulas(
             "Other software projects may rely on this audit. Ask for help if you're not sure.\n"
         )
     );
+
+    let final_prompt = if let Some(url) = url {
+        writeln!(
+            out,
+            "You can inspect the {} here: {}\n",
+            if from.is_some() { "diff" } else { "crate" },
+            url,
+        );
+        "(press ENTER to open in your browser, or re-run with --mode=local)"
+    } else {
+        "(press ENTER to inspect locally)"
+    };
+
     let out_ = out.clone();
-    let final_prompt = format!("(press ENTER to {final_prompt})");
-    tokio::task::spawn_blocking(move || out_.read_line_with_prompt(&final_prompt)).await??;
+    tokio::task::spawn_blocking(move || out_.read_line_with_prompt(final_prompt)).await??;
     Ok(())
 }
 
@@ -1451,7 +1462,6 @@ fn cmd_diff(out: &Arc<dyn Out>, cfg: &Config, sub_args: &DiffArgs) -> Result<(),
     if sub_args.mode == FetchMode::Sourcegraph {
         let url =
             format!("https://sourcegraph.com/crates/{package}/-/compare/v{version1}...v{version2}");
-        let prompt = format!("open {url} in your browser");
         tokio::runtime::Handle::current()
             .block_on(prompt_criteria_eulas(
                 out,
@@ -1461,7 +1471,7 @@ fn cmd_diff(out: &Arc<dyn Out>, cfg: &Config, sub_args: &DiffArgs) -> Result<(),
                 package,
                 Some(version1),
                 version2,
-                &prompt,
+                Some(&url),
             ))
             .into_diagnostic()?;
 
@@ -1491,7 +1501,7 @@ fn cmd_diff(out: &Arc<dyn Out>, cfg: &Config, sub_args: &DiffArgs) -> Result<(),
                 package,
                 Some(version1),
                 version2,
-                "continue...",
+                None,
             )
         );
         eulas.into_diagnostic()?;


Test patch:
diff --git a/src/tests/mod.rs b/src/tests/mod.rs
index 0c3d38a..6da2469 100644
--- a/src/tests/mod.rs
+++ b/src/tests/mod.rs
@@ -420,8 +420,6 @@ fn default_policy() -> PolicyEntry {
         criteria: None,
         dev_criteria: None,
         dependency_criteria: SortedMap::new(),
-        targets: None,
-        dev_targets: None,
         notes: None,
     }
 }
@@ -932,8 +930,6 @@ fn files_inited(metadata: &Metadata) -> (ConfigFile, AuditsFile, ImportsFile) {
                         criteria: Some(vec![DEFAULT_CRIT.to_string().into()]),
                         dev_criteria: Some(vec![DEFAULT_CRIT.to_string().into()]),
                         dependency_criteria: DependencyCriteria::new(),
-                        targets: None,
-                        dev_targets: None,
                         notes: None,
                     },
                 );