chore: update cargo-deny-action@v2

[chungquantin]

There was an issue with the CI cargo-deny tackled in the PR: EmbarkStudios/cargo-deny-action#91

Hence, we need to update our cargo-deny-action to v2 to sync with the update referenced from restatedev/restate@b16d7da

By updating to V2, unmaintained = "warn" is removed completely and all unmaintained crates now emit errors. As mentioned here

Hence, reported three dependency vulnerabilities due to unmaintained crates.

• Vulnerability dependency #436
• Vulnerability dependency #437
• Vulnerability dependency #438
• Vulnerability dependency #440
• Vulnerability dependency #441

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.46%. Comparing base (68ec6d5) to head (9d82d84).
Report is 3 commits behind head on main.

@@            Coverage Diff             @@
##             main     #439      +/-   ##
==========================================
+ Coverage   75.34%   75.46%   +0.11%     
==========================================
  Files          64       64              
  Lines       13973    14108     +135     
  Branches    13973    14108     +135     
==========================================
+ Hits        10528    10646     +118     
- Misses       2098     2100       +2     
- Partials     1347     1362      +15     

Files with missing lines	Coverage Δ
crates/pop-parachains/src/relay.rs	83.51% <ø> (ø)

... and 4 files with indirect coverage changes

[AlexD10S]

The docker issue seems related to the deny, looking at the fix there https://github.com/EmbarkStudios/cargo-deny-action/pull/92/files and the rustup latest release: https://blog.rust-lang.org/2025/03/02/Rustup-1.28.0.html#whats-new-in-rustup-1280

rustup will no longer automatically install the active toolchain if it is not installed.
To ensure its installation, run rustup toolchain install with no arguments.
The following command installs the active toolchain both before and after this change:
rustup show active-toolchain || rustup toolchain install

It seems we have to include this line in the Dockerfile (Before RUN cargo build --release)

RUN rustup show active-toolchain || rustup toolchain install

You can the test docker builds locally:

docker build -t pop .  --platform linux/amd64

[AlexD10S]

The removal of unmaintained dependencies is a hassle, but according to the docs:

If you want to ignore a specific advisory, add it to the ignore field

The approach you took makes sense. Approved.
But it would be good to check which libraries depend on the ones with vulnerabilities and see if we can eliminate them by upgrading.