From 01670ae9d52c3a165921b8505424b1324c3f8c34 Mon Sep 17 00:00:00 2001 From: Georg Semmler Date: Tue, 16 Dec 2025 14:16:08 +0100 Subject: [PATCH] Exclude development scripts from published package During a dependency review we noticed that the arbitary crate includes various development scripts. These development scripts shouldn't be there as they might, at some point become problematic. As of now they prevent any downstream user from enabling the `[bans.build.interpreted]` option of cargo deny. I opted for using an explicit include list instead of an exclude list to prevent these files from being included in the published packages to make sure that everything that's included is an conscious choice. --- Cargo.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/Cargo.toml b/Cargo.toml index a060234..20aa826 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -18,6 +18,7 @@ license = "MIT OR Apache-2.0" repository = "https://github.com/rust-fuzz/arbitrary/" documentation = "https://docs.rs/arbitrary/" rust-version = "1.63.0" # Keep in sync with version documented in the README.md +include = ["Cargo.toml", "CHANGELOG.md", "LICENSE-MIT", "LICENSE-APACHE", "README.md", "src/**/*.rs", "tests/**/*.rs", "examples/**/*.rs"] [dependencies] derive_arbitrary = { version = "~1.4.0", path = "./derive", optional = true }