chore(deps): update dependency cargo:cargo-dist to 0.31.0

[renovate]

This PR contains the following updates:

Package	Update	Change
cargo:cargo-dist (source)	minor	0.30.0 → 0.31.0

---

Release Notes

axodotdev/cargo-dist (cargo:cargo-dist)

v0.31.0

Compare Source

This release includes several new features, including the major introduction of mirrors that installers can fallback to.

Simple hosting (aka mirrors)

This release adds a new hosting method, simple, which supports static file hosting. This allows you to host your artifacts on the hosting provider of your choice so long as it follows a similar URL structure to GitHub Releases hosting. It can also be used alongside GitHub hosting; if you specify more than one hosting provider, the secondary hosting source will be used as a mirror. The priority is determined by the order of the keys in your config. For example, this will use GitHub first and fall back to your static host if GitHub is unavailable:

hosting = ["github", "simple"]
simple-download-url = "https://static.myapp.com/{tag}"

And this will use your static host first and fall back to GitHub if necessary:

hosting = ["simple", "github"]
simple-download-url = "https://static.myapp.com/{tag}"

For more information, see the docs.

Note: currently, dist won't upload artifacts to static hosts; it expects you to handle that, either manually or via writing a custom job.

• impl @​Gankra Add "simple" hosting style
• impl @​mistydemeo feat(homebrew): mirror support with multi-urls

Disabling npm-shrinkwrap.json for npm installers

Currently, the npm installer includes an npm-shrinkwrap.json to specify the exact versions of its runtime dependencies as used at the time dist was released. Since some users would prefer looser dependency specification, this release provides an option to disable this. For more information, see the docs.

npm-shrinkwrap = false

• impl @​mistydemeo feat: option to skip npm-shrinkwrap.json generation

Configurable build directory for generic projects

Until now, generic (non-Rust) project support has assumed that artifacts are always written to the root of the project directory. This path is now configurable using the out-dir setting in your dist.toml. For example, if your project generates a binary named example in a subdirectory called build, you can specify:

binaries = ["example"]
out-dir = "build"

• impl @​CatBraaain support out_dir in config

Fixes

• impl @​EliteTK + @​gankra Reduce risk of an interrupted installation leading to a partial installation

v0.30.4

Compare Source

This release contains a few minor bugfixes. It also updates dependencies, including a rimraf upgrade that resolves a CVE in @​isaacs/brace-expansion. This vulnerability was not exploitable in the way dist used rimraf.

Fixes

• impl @​eegli fix: installer receipt for windows with posix shell
• impl @​kazutoiris fix: prevent unintended escaping of multiline run
• impl @​20jasper fix: typo in variable name
• impl @​OpenSauce chore(actions): bump default github actions

v0.30.3

Compare Source

This release contains a few minor bugfixes. It also updates dependencies, including a rimraf upgrade that resolves a CVE in glob. This vulnerability was not exploitable in the way dist used rimraf.

Fixes

• impl @​AThePeanut4 fix: invalid file permissions when running the shell installer under sudo
• impl @​ryanobjc fix: macOS codesigning configuration not being respected

Thanks to @​zachstence for handling the rimraf/glob upgrade!

v0.30.2

Compare Source

• When customizing when artifacts are attested, you can now use the announce phase.

v0.30.1

Compare Source

• Bump default x64 macos runners to macos-15-intel (macos-13 is deprecated)
• In order to avoid overly broad permissions, GitHub attestations permissions scope is moved to the job level.
• Don't run host job if plan fails

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.