From 357c6e74d5d7e80eb3a295cfdf3c92938207b7c8 Mon Sep 17 00:00:00 2001 From: link2xt Date: Thu, 20 Aug 2026 12:29:35 +0000 Subject: [PATCH] build: use --locked in scripts/clippy.sh This is mostly a reaction in response to https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/ I don't know when exactly `cargo clippy` and similar commands (check, build, run etc.) may update dependencies and it does not look like they actively pull the package index and update yanked crates. We also keep the lockfile updated all the time by checking in CI. Still, all commands better use --locked as a precaution. --- scripts/clippy.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/clippy.sh b/scripts/clippy.sh index 93197dcf6..cb8db6ca3 100755 --- a/scripts/clippy.sh +++ b/scripts/clippy.sh @@ -6,4 +6,4 @@ # # To automatically fix warnings, run # scripts/clippy.sh --fix --allow-dirty -cargo clippy --workspace --all-targets --all-features "$@" -- -D warnings +cargo clippy --locked --workspace --all-targets --all-features "$@" -- -D warnings