From 1896943f62fdb0240a0b4db55fa8c10a7058c79b Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 22 Feb 2022 03:41:31 +1000
Subject: [PATCH] fix(ci): also check for duplicate dependencies with optional
 features off (#3592)

* fix(dependencies): update an unused duplicate dependency exception

This duplicate was removed by PR #3572, but other duplicates still exist.

* feat(ci): check for duplicate dependencies with optional features off
---
 .github/workflows/ci.yml | 9 ++++++++-
 deny.toml                | 9 ++++++---
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 008603f2..755c6fea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
     strategy:
       matrix:
         checks:
-          - bans 
+          - bans
           - sources
 
     # Prevent sudden announcement of a new advisory from failing ci:
@@ -244,3 +244,10 @@ jobs:
       with:
         command: check ${{ matrix.checks }}
         args: --all-features --workspace
+
+    # this check runs with optional features off
+    # so we expect some warnings about "skip tree root was not found"
+    - uses: EmbarkStudios/cargo-deny-action@v1
+      with:
+        command: check ${{ matrix.checks }}
+        args: --workspace
diff --git a/deny.toml b/deny.toml
index e289d437..04404342 100644
--- a/deny.toml
+++ b/deny.toml
@@ -46,9 +46,6 @@ skip-tree = [
     # ticket #2984: owo-colors dependencies
     { name = "color-eyre", version = "=0.5.11" },
 
-    # ticket #2998: hdrhistogram dependencies
-    { name = "hdrhistogram", version = "=6.3.4" },
-
     # ticket #3061: reqwest and minreq dependencies
     { name = "webpki-roots", version = "=0.18.0" },
 
@@ -59,6 +56,12 @@ skip-tree = [
     # alternative: downgrade Zebra to `bigint`
     { name = "bigint", version = "=4.4.3" },
 
+    # upgrade sentry, metrics-exporter-prometheus, reqwest, hyper,
+    # which needs #2953: upgrade tracing to the latest major version
+    #
+    # also wait for tower-test and tokio-test to upgrade
+    { name = "tokio-util", version = "=0.6.9" },
+
     # recent major version bumps
     # we should re-check these dependencies in February 2022