Sergey "Shnatsel" Davidoff

I believe you meant #606 not #601

gix has made several accidental semver-breaking changes in the past, so we chose to be conservative with updating gix. This also helped keep MSRV sufficiently conservative to enable packaging in...

The way to go for filtering would be `cargo metadata`, but that runs into its own issues and limitations, as I've learned by working on `cargo auditable`.

It seems this issue is fixed in `cargo deny`: https://github.com/rust-lang/cargo/issues/10801 ~~@ewoolsey using `cargo deny` instead could be a reasonable workaround.~~

Nevermind, I think it's only fixed for other lints, and security audits still run into this due to looking only at `Cargo.lock`

FWIW https://crates.io/crates/mtpng exists and can be used as inspiration/reference

I've used it with `cargo build --target=something-other-than-native-target` and it worked fine. I haven't tried it with `cross` specifically. Try it and let me know if it works!

FWIW `sccache` required some fixes to work with `cargo auditable`. If `cross` doesn't Just Work, I'm happy to accept fixes for supporting `cross` or to help investigate why it fails.

Yeah, that doesn't work because you're calling it `cross` not `cargo cross`. Hmm. I think the best way forward is to file an issue on the `cross` issue tracker about...

We've identified 2 ways to do today in the linked Cross issue: 1. Use a [custom docker image](https://github.com/cross-rs/cross#custom-docker-images) which [overrides `cargo` with `cargo auditable`](https://github.com/rust-secure-code/cargo-auditable/blob/master/REPLACING_CARGO.md) 2. Use a [pre-build hook](https://github.com/cross-rs/cross#pre-build-hook) to...