From 1ae5d119e1f005dbc0148d35e87feea4d204d898 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 1 Sep 2026 03:20:17 +0000 Subject: [PATCH] chore(deps): in-range cargo update, refresh cargo-vet exemptions Bump 33 transitive crates within their existing semver ranges (aho-corasick, base64, bytemuck_derive, camino, cc, clap/clap_builder/clap_derive, crc32fast, either, find-msvc-tools, futures-core/task/util, http, js-sys, log, macro_rules_attribute(+proc_macro), pastey (new transitive dep of macro_rules_attribute), pkg-config, regex-automata, rustls, rustls-webpki, syn, thiserror(+impl), time, ureq(-proto), wasm-bindgen family, web-sys, zerocopy(-derive), zlib-rs). flate2 1.1.10, hermit-abi 0.5.3 and indexmap 2.14.1 were reverted to their prior pinned versions (via `cargo update -p --precise `) because they fail this repo's 7-day quarantine window (scripts/check-quarantine.sh); none carry an advisory that requires the newer version, so a plain revert is sufficient. Regenerated supply-chain/config.toml exemptions (`cargo vet regenerate exemptions`) to cover the bumped versions; imports.lock was refreshed from upstream (google/isrg/mozilla/zcash) audits at the same time, which now cover a few crates (deranged, hashbrown 0.17.1, indexmap, smallvec, unicode-segmentation) that previously needed a local exemption. Co-Authored-By: Claude Opus 4.8 (1M context) --- engine/Cargo.lock | 186 +++---- engine/supply-chain/config.toml | 108 ++-- engine/supply-chain/imports.lock | 812 +++---------------------------- 3 files changed, 222 insertions(+), 884 deletions(-) diff --git a/engine/Cargo.lock b/engine/Cargo.lock index c56d90a..838b8fa 100644 --- a/engine/Cargo.lock +++ b/engine/Cargo.lock @@ -24,9 +24,9 @@ dependencies = [ [[package]] name = "aho-corasick" -version = "1.1.4" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301" +checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba" dependencies = [ "memchr", ] @@ -155,9 +155,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8" [[package]] name = "base64" -version = "0.22.1" +version = "0.23.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" [[package]] name = "basic-toml" @@ -215,13 +215,13 @@ dependencies = [ [[package]] name = "bytemuck_derive" -version = "1.11.0" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5" +checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.4", ] [[package]] @@ -258,9 +258,9 @@ dependencies = [ [[package]] name = "camino" -version = "1.2.2" +version = "1.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48" +checksum = "bb1307f12aa967b5a58416e87b3653360e0fd614a016b6e970db08fecbb1b80d" dependencies = [ "serde_core", ] @@ -283,7 +283,7 @@ dependencies = [ "rand_distr", "rayon", "safetensors", - "thiserror 2.0.19", + "thiserror 2.0.20", "tokenizers", "yoke", "zip", @@ -302,7 +302,7 @@ dependencies = [ "rayon", "safetensors", "serde", - "thiserror 2.0.19", + "thiserror 2.0.20", ] [[package]] @@ -325,7 +325,7 @@ dependencies = [ "semver", "serde", "serde_json", - "thiserror 2.0.19", + "thiserror 2.0.20", ] [[package]] @@ -345,9 +345,9 @@ dependencies = [ [[package]] name = "cc" -version = "1.4.0" +version = "1.4.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9" +checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273" dependencies = [ "find-msvc-tools", "shlex", @@ -388,9 +388,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.6.1" +version = "4.6.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51" +checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca" dependencies = [ "clap_builder", "clap_derive", @@ -398,9 +398,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.0" +version = "4.6.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f" +checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889" dependencies = [ "anstream", "anstyle", @@ -410,14 +410,14 @@ dependencies = [ [[package]] name = "clap_derive" -version = "4.6.1" +version = "4.6.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9" +checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061" dependencies = [ "heck", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.4", ] [[package]] @@ -449,9 +449,9 @@ dependencies = [ [[package]] name = "crc32fast" -version = "1.5.0" +version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511" +checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550" dependencies = [ "cfg-if", ] @@ -631,9 +631,9 @@ checksum = "e1d926b4d407d372f141f93bb444696142c29d32962ccbd3531117cf3aa0bfa9" [[package]] name = "either" -version = "1.17.0" +version = "1.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d" +checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34" [[package]] name = "enum-as-inner" @@ -677,9 +677,9 @@ checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223" [[package]] name = "find-msvc-tools" -version = "0.1.9" +version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" +checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890" [[package]] name = "flate2" @@ -727,21 +727,21 @@ dependencies = [ [[package]] name = "futures-core" -version = "0.3.33" +version = "0.3.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7" +checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e" [[package]] name = "futures-task" -version = "0.3.33" +version = "0.3.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109" +checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd" [[package]] name = "futures-util" -version = "0.3.33" +version = "0.3.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa" +checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc" dependencies = [ "futures-core", "futures-task", @@ -967,9 +967,9 @@ checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" [[package]] name = "http" -version = "1.4.2" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425" +checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0" dependencies = [ "bytes", "itoa", @@ -1040,9 +1040,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" [[package]] name = "js-sys" -version = "0.3.103" +version = "0.3.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102" +checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a" dependencies = [ "cfg-if", "futures-util", @@ -1064,7 +1064,7 @@ dependencies = [ "lex-core", "serde", "serde_json", - "thiserror 2.0.19", + "thiserror 2.0.20", "toml 0.8.23", "ureq", "zip", @@ -1085,7 +1085,7 @@ dependencies = [ "memmap2", "serde", "tempfile", - "thiserror 2.0.19", + "thiserror 2.0.20", "time", "toml 0.8.23", "tracing", @@ -1109,7 +1109,7 @@ dependencies = [ "lex-session", "serde_json", "tempfile", - "thiserror 2.0.19", + "thiserror 2.0.20", "toml 0.8.23", "tracing", "tracing-appender", @@ -1143,25 +1143,25 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53" [[package]] name = "log" -version = "0.4.33" +version = "0.4.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" +checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6" [[package]] name = "macro_rules_attribute" -version = "0.2.2" +version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "65049d7923698040cd0b1ddcced9b0eb14dd22c5f86ae59c3740eab64a676520" +checksum = "b3ae8f6d608c795738406608304d30a2dfbdc8e58e44f7ba43236da5208ded3c" dependencies = [ "macro_rules_attribute-proc_macro", - "paste", + "pastey", ] [[package]] name = "macro_rules_attribute-proc_macro" -version = "0.2.2" +version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "670fdfda89751bc4a84ac13eaa63e205cf0fd22b4c9a5fbfa085b63c1f1d3a30" +checksum = "fc04a4c58212d57930a24bf47d3fa87485264a3a054e9c10e042eb373573ad3c" [[package]] name = "matchers" @@ -1336,6 +1336,12 @@ version = "1.0.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a" +[[package]] +name = "pastey" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4" + [[package]] name = "percent-encoding" version = "2.3.2" @@ -1350,9 +1356,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" [[package]] name = "pkg-config" -version = "0.3.33" +version = "0.3.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" +checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" [[package]] name = "plain" @@ -1589,9 +1595,9 @@ dependencies = [ [[package]] name = "regex-automata" -version = "0.4.16" +version = "0.4.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad" +checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2" dependencies = [ "aho-corasick", "memchr", @@ -1639,9 +1645,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.41" +version = "0.23.43" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f" +checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" dependencies = [ "log", "once_cell", @@ -1663,9 +1669,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types", @@ -1779,7 +1785,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -1904,9 +1910,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.3" +version = "3.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3" +checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f" dependencies = [ "proc-macro2", "quote", @@ -1971,11 +1977,11 @@ dependencies = [ [[package]] name = "thiserror" -version = "2.0.19" +version = "2.0.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9" +checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f" dependencies = [ - "thiserror-impl 2.0.19", + "thiserror-impl 2.0.20", ] [[package]] @@ -1991,13 +1997,13 @@ dependencies = [ [[package]] name = "thiserror-impl" -version = "2.0.19" +version = "2.0.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd" +checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -2011,9 +2017,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.54" +version = "0.3.55" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244" +checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134" dependencies = [ "deranged", "libc", @@ -2078,7 +2084,7 @@ dependencies = [ "serde", "serde_json", "spm_precompiled", - "thiserror 2.0.19", + "thiserror 2.0.20", "unicode-normalization-alignments", "unicode-segmentation", "unicode_categories", @@ -2153,7 +2159,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c" dependencies = [ "crossbeam-channel", "symlink", - "thiserror 2.0.19", + "thiserror 2.0.20", "time", "tracing-subscriber", ] @@ -2395,11 +2401,11 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" [[package]] name = "ureq" -version = "3.3.0" +version = "3.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0" +checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "flate2", "log", "percent-encoding", @@ -2412,11 +2418,11 @@ dependencies = [ [[package]] name = "ureq-proto" -version = "0.6.0" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c" +checksum = "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "http", "httparse", "log", @@ -2482,9 +2488,9 @@ dependencies = [ [[package]] name = "wasm-bindgen" -version = "0.2.126" +version = "0.2.127" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4" +checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70" dependencies = [ "cfg-if", "once_cell", @@ -2495,9 +2501,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro" -version = "0.2.126" +version = "0.2.127" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1" +checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -2505,9 +2511,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.126" +version = "0.2.127" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e" +checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284" dependencies = [ "bumpalo", "proc-macro2", @@ -2518,18 +2524,18 @@ dependencies = [ [[package]] name = "wasm-bindgen-shared" -version = "0.2.126" +version = "0.2.127" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24" +checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf" dependencies = [ "unicode-ident", ] [[package]] name = "web-sys" -version = "0.3.103" +version = "0.3.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141" +checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30" dependencies = [ "js-sys", "wasm-bindgen", @@ -2690,18 +2696,18 @@ dependencies = [ [[package]] name = "zerocopy" -version = "0.8.55" +version = "0.8.56" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb" +checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb" dependencies = [ "zerocopy-derive", ] [[package]] name = "zerocopy-derive" -version = "0.8.55" +version = "0.8.56" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb" +checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1" dependencies = [ "proc-macro2", "quote", @@ -2751,9 +2757,9 @@ dependencies = [ [[package]] name = "zlib-rs" -version = "0.6.6" +version = "0.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b142a20ec14a91d5bc708c1dc21b080c550113d8aa77afa29635673a65dd02c5" +checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12" [[package]] name = "zmij" diff --git a/engine/supply-chain/config.toml b/engine/supply-chain/config.toml index 953e71b..e67b4f7 100644 --- a/engine/supply-chain/config.toml +++ b/engine/supply-chain/config.toml @@ -21,7 +21,7 @@ version = "0.8.12" criteria = "safe-to-deploy" [[exemptions.aho-corasick]] -version = "1.1.4" +version = "1.1.5" criteria = "safe-to-deploy" [[exemptions.allocator-api2]] @@ -60,6 +60,10 @@ criteria = "safe-to-deploy" version = "1.5.1" criteria = "safe-to-deploy" +[[exemptions.base64]] +version = "0.23.1" +criteria = "safe-to-deploy" + [[exemptions.bincode]] version = "1.3.3" criteria = "safe-to-deploy" @@ -77,7 +81,7 @@ version = "1.25.2" criteria = "safe-to-deploy" [[exemptions.bytemuck_derive]] -version = "1.11.0" +version = "1.12.0" criteria = "safe-to-deploy" [[exemptions.bytes]] @@ -93,7 +97,7 @@ version = "0.1.13+1.0.8" criteria = "safe-to-deploy" [[exemptions.camino]] -version = "1.2.2" +version = "1.2.5" criteria = "safe-to-deploy" [[exemptions.candle-core]] @@ -117,19 +121,19 @@ version = "0.2.4" criteria = "safe-to-deploy" [[exemptions.cc]] -version = "1.4.0" +version = "1.4.4" criteria = "safe-to-deploy" [[exemptions.clap]] -version = "4.6.1" +version = "4.6.6" criteria = "safe-to-deploy" [[exemptions.clap_builder]] -version = "4.6.0" +version = "4.6.6" criteria = "safe-to-deploy" [[exemptions.clap_derive]] -version = "4.6.1" +version = "4.6.4" criteria = "safe-to-deploy" [[exemptions.clap_lex]] @@ -145,7 +149,7 @@ version = "0.9.1" criteria = "safe-to-deploy" [[exemptions.crc32fast]] -version = "1.5.0" +version = "1.5.1" criteria = "safe-to-deploy" [[exemptions.criterion]] @@ -188,10 +192,6 @@ criteria = "safe-to-deploy" version = "0.3.9" criteria = "safe-to-deploy" -[[exemptions.deranged]] -version = "0.5.8" -criteria = "safe-to-deploy" - [[exemptions.derive_builder]] version = "0.20.2" criteria = "safe-to-deploy" @@ -213,7 +213,7 @@ version = "0.1.3" criteria = "safe-to-deploy" [[exemptions.either]] -version = "1.17.0" +version = "1.18.0" criteria = "safe-to-deploy" [[exemptions.enum-as-inner]] @@ -233,7 +233,7 @@ version = "2.5.0" criteria = "safe-to-deploy" [[exemptions.find-msvc-tools]] -version = "0.1.9" +version = "0.1.11" criteria = "safe-to-deploy" [[exemptions.flate2]] @@ -249,15 +249,15 @@ version = "2.11.0" criteria = "safe-to-deploy" [[exemptions.futures-core]] -version = "0.3.33" +version = "0.3.34" criteria = "safe-to-run" [[exemptions.futures-task]] -version = "0.3.33" +version = "0.3.34" criteria = "safe-to-run" [[exemptions.futures-util]] -version = "0.3.33" +version = "0.3.34" criteria = "safe-to-run" [[exemptions.gemm]] @@ -316,10 +316,6 @@ criteria = "safe-to-deploy" version = "0.16.1" criteria = "safe-to-deploy" -[[exemptions.hashbrown]] -version = "0.17.1" -criteria = "safe-to-deploy" - [[exemptions.heck]] version = "0.5.0" criteria = "safe-to-deploy" @@ -329,7 +325,7 @@ version = "0.5.2" criteria = "safe-to-deploy" [[exemptions.http]] -version = "1.4.2" +version = "1.5.0" criteria = "safe-to-deploy" [[exemptions.httparse]] @@ -340,10 +336,6 @@ criteria = "safe-to-deploy" version = "1.0.1" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.14.0" -criteria = "safe-to-deploy" - [[exemptions.is-terminal]] version = "0.4.17" criteria = "safe-to-run" @@ -361,7 +353,7 @@ version = "1.0.18" criteria = "safe-to-deploy" [[exemptions.js-sys]] -version = "0.3.103" +version = "0.3.104" criteria = "safe-to-run" [[exemptions.lexime-trie]] @@ -381,7 +373,15 @@ version = "0.12.1" criteria = "safe-to-deploy" [[exemptions.log]] -version = "0.4.33" +version = "0.4.34" +criteria = "safe-to-deploy" + +[[exemptions.macro_rules_attribute]] +version = "0.2.3" +criteria = "safe-to-deploy" + +[[exemptions.macro_rules_attribute-proc_macro]] +version = "0.2.3" criteria = "safe-to-deploy" [[exemptions.matchers]] @@ -452,6 +452,10 @@ criteria = "safe-to-deploy" version = "1.0.15" criteria = "safe-to-deploy" +[[exemptions.pastey]] +version = "0.2.3" +criteria = "safe-to-deploy" + [[exemptions.percent-encoding]] version = "2.3.2" criteria = "safe-to-deploy" @@ -461,7 +465,7 @@ version = "0.2.17" criteria = "safe-to-deploy" [[exemptions.pkg-config]] -version = "0.3.33" +version = "0.3.34" criteria = "safe-to-deploy" [[exemptions.plain]] @@ -500,10 +504,6 @@ criteria = "safe-to-deploy" version = "0.1.1" criteria = "safe-to-deploy" -[[exemptions.quote]] -version = "1.0.46" -criteria = "safe-to-deploy" - [[exemptions.r-efi]] version = "5.3.0" criteria = "safe-to-deploy" @@ -541,7 +541,7 @@ version = "1.13.1" criteria = "safe-to-deploy" [[exemptions.regex-automata]] -version = "0.4.16" +version = "0.4.18" criteria = "safe-to-deploy" [[exemptions.regex-syntax]] @@ -561,7 +561,7 @@ version = "1.1.4" criteria = "safe-to-deploy" [[exemptions.rustls]] -version = "0.23.41" +version = "0.23.43" criteria = "safe-to-deploy" [[exemptions.rustls-pki-types]] @@ -569,7 +569,7 @@ version = "1.15.1" criteria = "safe-to-deploy" [[exemptions.rustls-webpki]] -version = "0.103.13" +version = "0.103.15" criteria = "safe-to-deploy" [[exemptions.rustversion]] @@ -648,10 +648,6 @@ criteria = "safe-to-deploy" version = "0.4.12" criteria = "safe-to-run" -[[exemptions.smallvec]] -version = "1.15.2" -criteria = "safe-to-deploy" - [[exemptions.smawk]] version = "0.3.3" criteria = "safe-to-deploy" @@ -673,7 +669,7 @@ version = "2.0.119" criteria = "safe-to-deploy" [[exemptions.syn]] -version = "3.0.3" +version = "3.0.4" criteria = "safe-to-deploy" [[exemptions.sysctl]] @@ -689,7 +685,7 @@ version = "1.0.69" criteria = "safe-to-deploy" [[exemptions.thiserror]] -version = "2.0.19" +version = "2.0.20" criteria = "safe-to-deploy" [[exemptions.thiserror-impl]] @@ -697,7 +693,7 @@ version = "1.0.69" criteria = "safe-to-deploy" [[exemptions.thiserror-impl]] -version = "2.0.19" +version = "2.0.20" criteria = "safe-to-deploy" [[exemptions.thread_local]] @@ -705,7 +701,7 @@ version = "1.1.10" criteria = "safe-to-deploy" [[exemptions.time]] -version = "0.3.54" +version = "0.3.55" criteria = "safe-to-deploy" [[exemptions.time-macros]] @@ -780,10 +776,6 @@ criteria = "safe-to-deploy" version = "0.1.12" criteria = "safe-to-deploy" -[[exemptions.unicode-segmentation]] -version = "1.13.3" -criteria = "safe-to-deploy" - [[exemptions.unicode_categories]] version = "0.1.1" criteria = "safe-to-deploy" @@ -793,11 +785,11 @@ version = "0.9.0" criteria = "safe-to-deploy" [[exemptions.ureq]] -version = "3.3.0" +version = "3.4.0" criteria = "safe-to-deploy" [[exemptions.ureq-proto]] -version = "0.6.0" +version = "0.6.1" criteria = "safe-to-deploy" [[exemptions.utf8-zero]] @@ -825,23 +817,23 @@ version = "1.0.4+wasi-0.2.12" criteria = "safe-to-deploy" [[exemptions.wasm-bindgen]] -version = "0.2.126" +version = "0.2.127" criteria = "safe-to-run" [[exemptions.wasm-bindgen-macro]] -version = "0.2.126" +version = "0.2.127" criteria = "safe-to-run" [[exemptions.wasm-bindgen-macro-support]] -version = "0.2.126" +version = "0.2.127" criteria = "safe-to-run" [[exemptions.wasm-bindgen-shared]] -version = "0.2.126" +version = "0.2.127" criteria = "safe-to-run" [[exemptions.web-sys]] -version = "0.3.103" +version = "0.3.104" criteria = "safe-to-run" [[exemptions.webpki-roots]] @@ -913,11 +905,11 @@ version = "0.8.2" criteria = "safe-to-deploy" [[exemptions.zerocopy]] -version = "0.8.55" +version = "0.8.56" criteria = "safe-to-deploy" [[exemptions.zerocopy-derive]] -version = "0.8.55" +version = "0.8.56" criteria = "safe-to-deploy" [[exemptions.zerofrom]] @@ -937,7 +929,7 @@ version = "7.2.0" criteria = "safe-to-deploy" [[exemptions.zlib-rs]] -version = "0.6.6" +version = "0.6.7" criteria = "safe-to-deploy" [[exemptions.zmij]] diff --git a/engine/supply-chain/imports.lock b/engine/supply-chain/imports.lock index f37229e..a0e3b21 100644 --- a/engine/supply-chain/imports.lock +++ b/engine/supply-chain/imports.lock @@ -1,6 +1,13 @@ # cargo-vet imports lock +[[publisher.unicode-segmentation]] +version = "1.13.3" +when = "2026-06-01" +user-id = 1139 +user-login = "Manishearth" +user-name = "Manish Goregaokar" + [[publisher.unicode-width]] version = "0.2.2" when = "2025-10-06" @@ -77,13 +84,6 @@ and `lib.rs` pointing out "Zero `unsafe`"). ''' aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.autocfg]] -who = "Manish Goregaokar " -criteria = "safe-to-deploy" -version = "1.4.0" -notes = "Contains no unsafe" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.base64]] who = "Adam Langley " criteria = "safe-to-deploy" @@ -91,12 +91,6 @@ version = "0.13.1" notes = "Skimmed the uses of `std` to ensure that nothing untoward is happening. Code uses `forbid(unsafe_code)` and, indeed, there are no uses of `unsafe`" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.base64]] -who = "amarjotgill " -criteria = "safe-to-deploy" -version = "0.22.1" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.bit-set]] who = "George Burgess IV " criteria = "safe-to-run" @@ -146,34 +140,6 @@ criteria = "safe-to-run" version = "0.2.2" aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" -[[audits.google.audits.either]] -who = "Manish Goregaokar " -criteria = "safe-to-deploy" -version = "1.13.0" -notes = "Unsafe code pertaining to wrapping Pin APIs. Mostly passes invariants down." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.either]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.13.0 -> 1.14.0" -notes = """ -Inheriting ub-risk-1 from the baseline review of 1.13.0. While the delta has some diffs in unsafe code, they are either: -- migrating code to use helper macros -- migrating match patterns to take advantage of default bindings mode from RFC 2005 -Either way, the result is code that does exactly the same thing and does not change the risk of UB. - -See https://crrev.com/c/6323164 for more audit details. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.either]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.14.0 -> 1.15.0" -notes = 'The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = "std")]`.' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.equivalent]] who = "George Burgess IV " criteria = "safe-to-deploy" @@ -213,17 +179,29 @@ delta = "0.1.4 -> 0.1.5" notes = "No new `unsafe`." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.glob]] -who = "George Burgess IV " +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " criteria = "safe-to-deploy" -version = "0.3.1" -aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. -[[audits.google.audits.glob]] -who = "Dustin J. Mitchell " +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " criteria = "safe-to-deploy" -delta = "0.3.1 -> 0.3.2" -notes = "Still no unsafe" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" [[audits.google.audits.itertools]] @@ -253,32 +231,6 @@ delta = "1.4.0 -> 1.5.0" notes = "Unsafe review notes: https://crrev.com/c/5650836" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.log]] -who = "danakj " -criteria = "safe-to-deploy" -version = "0.4.22" -notes = """ -Unsafe review in https://docs.google.com/document/d/1IXQbD1GhTRqNHIGxq6yy7qHqxeO4CwN5noMFXnqyDIM/edit?usp=sharing - -Unsafety is generally very well-documented, with one exception, which we -describe in the review doc. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.log]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "0.4.22 -> 0.4.25" -notes = "No impact on `unsafe` usage in `lib.rs`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.log]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "0.4.25 -> 0.4.26" -notes = "Only trivial code and documentation changes." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.nom]] who = "danakj@chromium.org" criteria = "safe-to-deploy" @@ -295,20 +247,6 @@ version = "0.2.19" notes = "Contains a single line of float-to-int unsafe with decent safety comments" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.pin-project-lite]] -who = "David Koloski " -criteria = "safe-to-deploy" -version = "0.2.9" -notes = "Reviewed on https://fxrev.dev/824504" -aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.pin-project-lite]] -who = "David Koloski " -criteria = "safe-to-deploy" -delta = "0.2.9 -> 0.2.13" -notes = "Audited at https://fxrev.dev/946396" -aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.quick-error]] who = "George Burgess IV " criteria = "safe-to-run" @@ -365,15 +303,6 @@ Still no `unsafe` anywhere. """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.rand]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "0.8.5" -notes = """ -For more detailed unsafe review notes please see https://crrev.com/c/6362797 -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.rand_chacha]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -392,309 +321,6 @@ For more detailed unsafe review notes please see https://crrev.com/c/6362797 """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.rustversion]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "1.0.14" -notes = """ -Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'`` -and there were no hits except for: - -* Using trivially-safe `unsafe` in test code: - - ``` - tests/test_const.rs:unsafe fn _unsafe() {} - tests/test_const.rs:const _UNSAFE: () = unsafe { _unsafe() }; - ``` - -* Using `unsafe` in a string: - - ``` - src/constfn.rs: "unsafe" => Qualifiers::Unsafe, - ``` - -* Using `std::fs` in `build/build.rs` to write `${OUT_DIR}/version.expr` - which is later read back via `include!` used in `src/lib.rs`. - -Version `1.0.6` of this crate has been added to Chromium in -https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057 -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.14 -> 1.0.15" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "danakj " -criteria = "safe-to-deploy" -delta = "1.0.15 -> 1.0.16" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.16 -> 1.0.17" -notes = "Just updates windows compat" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Liza Burakova " -criteria = "safe-to-deploy" -delta = "1.0.17 -> 1.0.18" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.18 -> 1.0.19" -notes = "No unsafe, just doc changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.0.19 -> 1.0.20" -notes = "Only minor updates to documentation and the mock today used for testing." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "1.0.197" -notes = """ -Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`. - -There were some hits for `net`, but they were related to serialization and -not actually opening any connections or anything like that. - -There were 2 hits of `unsafe` when grepping: -* In `fn as_str` in `impl Buf` -* In `fn serialize` in `impl Serialize for net::Ipv4Addr` - -Unsafe review comments can be found in https://crrev.com/c/5350573/2 (this -review also covered `serde_json_lenient`). - -Version 1.0.130 of the crate has been added to Chromium in -https://crrev.com/c/3265545. The CL description contains a link to a -(Google-internal, sorry) document with a mini security review. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.197 -> 1.0.198" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "danakj " -criteria = "safe-to-deploy" -delta = "1.0.198 -> 1.0.201" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.201 -> 1.0.202" -notes = "Trivial changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.202 -> 1.0.203" -notes = "s/doc_cfg/docsrs/ + tuple_impls/tuple_impl_body-related changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.203 -> 1.0.204" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.204 -> 1.0.207" -notes = "The small change in `src/private/ser.rs` should have no impact on `ub-risk-2`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.207 -> 1.0.209" -notes = """ -The delta carries fairly small changes in `src/private/de.rs` and -`src/private/ser.rs` (see https://crrev.com/c/5812194/2..5). AFAICT the -delta has no impact on the `unsafe`, `from_utf8_unchecked`-related parts -of the crate (in `src/de/format.rs` and `src/ser/impls.rs`). -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.209 -> 1.0.210" -notes = "Almost no new code - just feature rearrangement" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Liza Burakova " -criteria = "safe-to-deploy" -delta = "1.0.210 -> 1.0.213" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.213 -> 1.0.214" -notes = "No unsafe, no crypto" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.214 -> 1.0.215" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.215 -> 1.0.216" -notes = "The delta makes minor changes in `build.rs` - switching to the `?` syntax sugar." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.216 -> 1.0.217" -notes = "Minimal changes, nothing unsafe" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.0.217 -> 1.0.218" -notes = "No changes outside comments and documentation." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.218 -> 1.0.219" -notes = "Just allowing `clippy::elidable_lifetime_names`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "1.0.197" -notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "danakj " -criteria = "safe-to-deploy" -delta = "1.0.197 -> 1.0.201" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.201 -> 1.0.202" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.202 -> 1.0.203" -notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.203 -> 1.0.204" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.204 -> 1.0.207" -notes = 'Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.207 -> 1.0.209" -notes = ''' -There are no code changes in this delta - see https://crrev.com/c/5812194/2..5 - -I've neverthless also grepped for `-i cipher`, `-i crypto`, `\bfs\b`, -`\bnet\b`, and `\bunsafe\b`. There were no hits. -''' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.209 -> 1.0.210" -notes = "Almost no new code - just feature rearrangement" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Liza Burakova " -criteria = "safe-to-deploy" -delta = "1.0.210 -> 1.0.213" -notes = "Grepped for 'unsafe', 'crypt', 'cipher', 'fs', 'net' - there were no hits" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.213 -> 1.0.214" -notes = "No changes to unsafe, no crypto" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.214 -> 1.0.215" -notes = "Minor changes should not impact UB risk" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.215 -> 1.0.216" -notes = "The delta adds `#[automatically_derived]` in a few places. Still no `unsafe`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.216 -> 1.0.217" -notes = "No changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.0.217 -> 1.0.218" -notes = "No changes outside comments and documentation." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.218 -> 1.0.219" -notes = "Minor changes (clippy tweaks, using `mem::take` instead of `mem::replace`)." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.smallvec]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -769,48 +395,6 @@ criteria = "safe-to-run" version = "0.2.0" aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" -[[audits.google.audits.yoke-derive]] -who = "Manish Goregaokar " -criteria = "safe-to-deploy" -version = "0.7.5" -notes = "Custom derive implementing the `Yokeable` trait. Generally generates simple code that asserts covariance." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.yoke-derive]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "0.7.5 -> 0.8.0" -notes = "No code changes: only incrementing the version." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.zerofrom]] -who = "Manish Goregaokar " -criteria = "safe-to-deploy" -version = "0.1.5" -notes = "Contains no unsafe" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.zerofrom]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "0.1.5 -> 0.1.6" -notes = "Only minor cfg tweaks." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.zerofrom-derive]] -who = "Manish Goregaokar " -criteria = "safe-to-deploy" -version = "0.1.5" -notes = "Contains no unsafe" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.zerofrom-derive]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "0.1.5 -> 0.1.6" -notes = "Only a minor clippy adjustment." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.isrg.audits.cfg-if]] who = "David Cook " criteria = "safe-to-deploy" @@ -826,16 +410,6 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.0.3 -> 1.0.4" -[[audits.isrg.audits.rand]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "0.8.5 -> 0.9.1" - -[[audits.isrg.audits.rand]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "0.9.1 -> 0.9.2" - [[audits.isrg.audits.rand_chacha]] who = "David Cook " criteria = "safe-to-deploy" @@ -856,40 +430,6 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "0.4.3 -> 0.5.1" -[[audits.isrg.audits.rayon]] -who = "Brandon Pitman " -criteria = "safe-to-deploy" -delta = "1.6.1 -> 1.7.0" - -[[audits.isrg.audits.rayon]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "1.7.0 -> 1.8.0" - -[[audits.isrg.audits.rayon]] -who = "Ameer Ghani " -criteria = "safe-to-deploy" -delta = "1.8.0 -> 1.8.1" - -[[audits.isrg.audits.rayon]] -who = "Brandon Pitman " -criteria = "safe-to-deploy" -delta = "1.8.1 -> 1.9.0" - -[[audits.isrg.audits.rayon]] -who = "Brandon Pitman " -criteria = "safe-to-deploy" -delta = "1.9.0 -> 1.10.0" - -[[audits.isrg.audits.rayon]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "1.10.0 -> 1.11.0" -notes = """ -I compared src/slice/sort.rs against the file library/core/src/slice/sort.rs -from the standard library, as of commit e501add. -""" - [[audits.isrg.audits.rayon-core]] who = "Ameer Ghani " criteria = "safe-to-deploy" @@ -900,56 +440,20 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.12.1 -> 1.13.0" -[[audits.isrg.audits.serde]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.219 -> 1.0.224" - -[[audits.isrg.audits.serde]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.224 -> 1.0.225" - -[[audits.isrg.audits.serde]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "1.0.225 -> 1.0.226" - -[[audits.isrg.audits.serde_core]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -version = "1.0.224" - -[[audits.isrg.audits.serde_core]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.224 -> 1.0.225" - -[[audits.isrg.audits.serde_core]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "1.0.225 -> 1.0.226" - -[[audits.isrg.audits.serde_derive]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.219 -> 1.0.224" - -[[audits.isrg.audits.serde_derive]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.224 -> 1.0.225" - -[[audits.isrg.audits.serde_derive]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "1.0.225 -> 1.0.226" - [[audits.isrg.audits.subtle]] who = "David Cook " criteria = "safe-to-deploy" delta = "2.5.0 -> 2.6.1" +[[audits.mozilla.wildcard-audits.unicode-segmentation]] +who = "Manish Goregaokar " +criteria = "safe-to-deploy" +user-id = 1139 # Manish Goregaokar (Manishearth) +start = "2019-05-15" +end = "2027-04-23" +notes = "All code written or reviewed by Manish" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.wildcard-audits.unicode-width]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -1131,6 +635,30 @@ criteria = "safe-to-deploy" version = "0.2.3" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.deranged]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.3.11" +notes = """ +This crate contains a decent bit of `unsafe` code, however all internal +unsafety is verified with copious assertions (many are compile-time), and +otherwise the unsafety is documented and left to the caller to verify. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.deranged]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +delta = "0.3.11 -> 0.4.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.deranged]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +delta = "0.4.0 -> 0.5.8" +notes = "New unsafe code is properly guarded" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.fnv]] who = "Bobby Holley " criteria = "safe-to-deploy" @@ -1144,39 +672,29 @@ criteria = "safe-to-deploy" delta = "0.1.5 -> 0.2.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.log]] +[[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" -delta = "0.4.26 -> 0.4.29" +delta = "0.16.1 -> 0.17.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.macro_rules_attribute]] -who = "Andy Leiserson " -criteria = "safe-to-deploy" -version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.macro_rules_attribute-proc_macro]] -who = "Andy Leiserson " +[[audits.mozilla.audits.hashbrown]] +who = "Erich Gubler " criteria = "safe-to-deploy" -version = "0.2.2" +delta = "0.17.0 -> 0.17.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.num-conv]] -who = "Alex Franchuk " +[[audits.mozilla.audits.indexmap]] +who = "Erich Gubler " criteria = "safe-to-deploy" -version = "0.1.0" -notes = """ -Very straightforward, simple crate. No dependencies, unsafe, extern, -side-effectful std functions, etc. -""" +delta = "2.8.0 -> 2.11.4" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.num-conv]] -who = "Lars Eggert " +[[audits.mozilla.audits.indexmap]] +who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" -delta = "0.1.0 -> 0.2.0" -notes = "Revision only removes code" +delta = "2.11.4 -> 2.14.0" +notes = "Mostly internal refactorings. No new unsafe code." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" [[audits.mozilla.audits.oorandom]] @@ -1186,22 +704,6 @@ version = "11.1.5" notes = "Small random number generator, explicitly not cryptographically secure, no use of unsafe code, no dependencies" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -[[audits.mozilla.audits.pin-project-lite]] -who = "Mike Hommey " -criteria = "safe-to-deploy" -delta = "0.2.13 -> 0.2.14" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.pin-project-lite]] -who = "Nika Layzell " -criteria = "safe-to-deploy" -delta = "0.2.14 -> 0.2.16" -notes = """ -Only functional change is to work around a bug in the negative_impls feature -(https://github.com/taiki-e/pin-project/issues/340#issuecomment-2432146009) -""" -aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" - [[audits.mozilla.audits.powerfmt]] who = "Alex Franchuk " criteria = "safe-to-deploy" @@ -1234,80 +736,17 @@ As far as I can tell, it does not have any file IO or network access. """ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.rayon]] -who = "Josh Stone " -criteria = "safe-to-deploy" -version = "1.5.3" -notes = "All code written or reviewed by Josh Stone or Niko Matsakis." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.rayon]] -who = "Mike Hommey " -criteria = "safe-to-deploy" -delta = "1.5.3 -> 1.6.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.rustc-hash]] -who = "Bobby Holley " -criteria = "safe-to-deploy" -version = "1.1.0" -notes = "Straightforward crate with no unsafe code, does what it says on the tin." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.rustc-hash]] -who = "Ben Dean-Kawamura " -criteria = "safe-to-deploy" -delta = "1.1.0 -> 2.1.1" -notes = "Simple hashing crate, no unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde]] -who = "Erich Gubler " -criteria = "safe-to-deploy" -delta = "1.0.226 -> 1.0.227" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "1.0.227 -> 1.0.228" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_core]] -who = "Erich Gubler " -criteria = "safe-to-deploy" -delta = "1.0.226 -> 1.0.227" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_core]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "1.0.227 -> 1.0.228" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_derive]] -who = "Erich Gubler " -criteria = "safe-to-deploy" -delta = "1.0.226 -> 1.0.227" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_derive]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "1.0.227 -> 1.0.228" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - [[audits.mozilla.audits.smallvec]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "1.14.0 -> 1.15.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.smawk]] -who = "Jan-Erik Rediger " +[[audits.mozilla.audits.smallvec]] +who = "Mike Hommey " criteria = "safe-to-deploy" -version = "0.3.2" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" +delta = "1.15.1 -> 1.15.2" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" [[audits.mozilla.audits.strsim]] who = "Ben Dean-Kawamura " @@ -1389,37 +828,6 @@ delta = "0.1.4 -> 0.1.8" notes = "No unsafe code" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.time-macros]] -who = "Kershaw Chang " -criteria = "safe-to-deploy" -version = "0.2.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.time-macros]] -who = "Kershaw Chang " -criteria = "safe-to-deploy" -delta = "0.2.6 -> 0.2.10" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.time-macros]] -who = "Alex Franchuk " -criteria = "safe-to-deploy" -delta = "0.2.10 -> 0.2.18" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.time-macros]] -who = "Lars Eggert " -criteria = "safe-to-deploy" -delta = "0.2.18 -> 0.2.22" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.time-macros]] -who = "Lars Eggert " -criteria = "safe-to-deploy" -delta = "0.2.22 -> 0.2.27" -notes = "Refactors some unsafe code, nothing new" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.utf8parse]] who = "Nika Layzell " criteria = "safe-to-deploy" @@ -1445,34 +853,6 @@ criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.zeroize]] -who = "Benjamin Beurdouche " -criteria = "safe-to-deploy" -version = "1.8.1" -notes = """ -This code DOES contain unsafe code required to internally call volatiles -for deleting data. This is expected and documented behavior. -""" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.zmij]] -who = "Benjamin VanderSloot " -criteria = "safe-to-deploy" -version = "1.0.20" -notes = """ -A lot of unsafe code here, included as a dependency of serde_json. -The testing is very thorough, validating all 32-bit floats, and 100m -random 64-bit floats. No unsafe imports. -""" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.zcash.audits.autocfg]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "1.4.0 -> 1.5.0" -notes = "Filesystem change is to remove the generated LLVM IR output file after probing." -aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" - [[audits.zcash.audits.basic-toml]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -1489,26 +869,6 @@ was being selected by the target OS instead of the host OS. """ aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.glob]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "0.3.2 -> 0.3.3" -aggregated-from = "https://raw.githubusercontent.com/zcash/librustzcash/main/supply-chain/audits.toml" - -[[audits.zcash.audits.rustversion]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "1.0.20 -> 1.0.21" -notes = "Build script change is to fix building with `-Zfmt-debug=none`." -aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" - -[[audits.zcash.audits.rustversion]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "1.0.21 -> 1.0.22" -notes = "Changes to generated code are to prepend a clippy annotation." -aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml" - [[audits.zcash.audits.time-core]] who = "Kris Nuttycombe " criteria = "safe-to-deploy" @@ -1522,23 +882,3 @@ criteria = "safe-to-deploy" delta = "0.2.0 -> 0.2.1" notes = "No code changes at all." aggregated-from = "https://raw.githubusercontent.com/zcash/librustzcash/main/supply-chain/audits.toml" - -[[audits.zcash.audits.yoke-derive]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "0.8.0 -> 0.8.1" -notes = """ -Changes to generated `unsafe` code are to silence the `clippy::mem_forget` lint; -no actual code changes. -""" -aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml" - -[[audits.zcash.audits.zeroize]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "1.8.1 -> 1.8.2" -notes = """ -Changes to `unsafe` code are to alter how `core::mem::size_of` is named; no actual changes -to the `unsafe` logic. -""" -aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml"