From c9db24538a09b5772ea17232e8fa891763e6fb6b Mon Sep 17 00:00:00 2001 From: John Coffey Date: Mon, 12 Oct 2026 08:19:52 -0700 Subject: [PATCH] Say the vendored hickory leaves out .cargo_vcs_info.json --- vendor/hickory-dns/VENDORED.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vendor/hickory-dns/VENDORED.md b/vendor/hickory-dns/VENDORED.md index 9c3cd1da..d98c7261 100644 --- a/vendor/hickory-dns/VENDORED.md +++ b/vendor/hickory-dns/VENDORED.md @@ -20,8 +20,8 @@ UDP answer. None. Each directory is `cargo package --no-verify` of that commit (the manifest normalized, so it builds outside hickory's workspace), without -`Cargo.lock` and `Cargo.toml.orig`. `.cargo_vcs_info.json` records the -commit. +`Cargo.lock`, `Cargo.toml.orig` and `.cargo_vcs_info.json` (the +repository ignores dotfiles; the commit is recorded above). Both answers hickory 0.26.3 called bogus in production (an insecure delegation below an unsigned zone, and a signed CNAME to a name without the -- 2.54.0