skilly-lily

The reason that `cargo generate-lockfile` is called unconditionally is because `cargo metadata` requires a lockfile and an up-to-date cargo index on the machine. In the case that either of those...

@untitaker Can you explain why the workaround is infeasible there? If you pin the dependency in the `Cargo.toml` file, then you won't see any updates when `cargo generate-lockfile` is run....

Thanks for the explanation and examples. That will be very useful in testing. We're definitely going to fix this, we just need to try not to reintroduce the dep download...

You are correct that the `paths.exclude` filter will not work for this, as it only filters at the directory level. We have had a feature request in our backlog for...

Thanks for the input. At the moment, this is as designed. Historically, our users prefer to upload SOMETHING, even if some of the builds fail. This is because most users...

Thanks for the report, I did a quick write-up based on my experience with rust, cargo, and the actual analyzer in question: I _think_ this is just a simple oversight...

It seems that the issue is that `mvn dependency :tree` is not working on your windows system, rather than there being some platform-specific bug (although that may be the underlying...

A few responses: > you need access to the closed-source fossas/basis Currently, this is true, but we have an alternate solution for this. We haven't had time to implement it...

We have added this item to our review backlog. We will review it at a later date, but so far, the consensus internally is that this is a long-term backlog...

There are a couple more changes I intend to make for my own purposes, like supporting `$XDG_CONFIG_HOME` for the config file. I'm not against helping out as a maintainer, but...