From 027fcd60ebc1928e501beaabe807317d1c662d22 Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Mon, 19 Jan 2026 18:28:11 +0000 Subject: [PATCH] Update cargo-vet to v0.10.2 --- .github/workflows/ci.yml | 2 +- supply-chain/audits.toml | 36 ++++++++++++++++++------------------ supply-chain/imports.lock | 31 ++++++++++++++++++++----------- 3 files changed, 39 insertions(+), 30 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f925679e..7ad0a7c1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,7 @@ jobs: runs-on: ubuntu-24.04 env: - CARGO_VET_REV: c178261c96c9f820f67817e9c5458db655ddc21f # 0.10.1 + CARGO_VET_REV: 28f617ea97392d527799649db588a6dbb695da8d # 0.10.2 steps: - uses: actions/checkout@v6 diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index e85a706a..9b9881b4 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -62,12 +62,6 @@ who = "Oliver Hamlet " criteria = "safe-to-deploy" delta = "0.8.9 -> 0.9.0" -[[audits.libloadorder]] -who = "Oliver Hamlet " -criteria = "safe-to-deploy" -version = "18.5.1" -notes = "This is my own crate published using Trusted Publishing, but I can't mark it as trusted by cargo-vet because it doesn't support Trusted Publishing and just sees that the publisher is unknown." - [[audits.link-cplusplus]] who = "Oliver Hamlet " criteria = "safe-to-deploy" @@ -78,18 +72,6 @@ who = "Oliver Hamlet " criteria = "safe-to-deploy" delta = "0.4.28 -> 0.4.29" -[[audits.loot-condition-interpreter]] -who = "Oliver Hamlet " -criteria = "safe-to-deploy" -version = "5.3.3" -notes = "This is my own crate published using Trusted Publishing, but I can't mark it as trusted by cargo-vet because it doesn't support Trusted Publishing and just sees that the publisher is unknown." - -[[audits.loot-condition-interpreter]] -who = "Oliver Hamlet " -criteria = "safe-to-deploy" -delta = "5.3.3 -> 5.4.0" -notes = "This is my own crate published using Trusted Publishing, but I can't mark it as trusted by cargo-vet because it doesn't support Trusted Publishing and just sees that the publisher is unknown." - [[audits.napi]] who = "Oliver Hamlet " criteria = "safe-to-run" @@ -140,6 +122,12 @@ who = "Oliver Hamlet " criteria = "safe-to-deploy" delta = "0.4.8 -> 0.4.11" +[[trusted.esplugin]] +criteria = "safe-to-deploy" +trusted-publisher = "github:Ortham/esplugin" +start = "2025-09-29" +end = "2027-01-19" + [[trusted.futures-task]] criteria = "safe-to-deploy" user-id = 33035 # Taiki Endo (taiki-e) @@ -161,6 +149,18 @@ start = "2024-08-15" end = "2026-09-28" notes = "rust-lang-owner is a bot managed by the Rust language's infrastructure team, and the source repo is owned by the rust-lang GitHub org." +[[trusted.libloadorder]] +criteria = "safe-to-deploy" +trusted-publisher = "github:Ortham/libloadorder" +start = "2025-08-01" +end = "2027-01-19" + +[[trusted.loot-condition-interpreter]] +criteria = "safe-to-deploy" +trusted-publisher = "github:loot/loot-condition-interpreter" +start = "2025-09-29" +end = "2027-01-19" + [[trusted.windows-link]] criteria = "safe-to-deploy" user-id = 64539 # Kenny Kerr (kennykerr) diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 505af5ed..5a22fdb9 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -8,6 +8,11 @@ user-id = 4484 user-login = "hsivonen" user-name = "Henri Sivonen" +[[publisher.esplugin]] +version = "6.1.4" +when = "2025-09-29" +trusted-publisher = "github:Ortham/esplugin" + [[publisher.futures-task]] version = "0.3.31" when = "2024-10-05" @@ -28,6 +33,16 @@ when = "2025-03-11" user-id = 55123 user-login = "rust-lang-owner" +[[publisher.libloadorder]] +version = "18.5.1" +when = "2025-09-29" +trusted-publisher = "github:Ortham/libloadorder" + +[[publisher.loot-condition-interpreter]] +version = "5.4.0" +when = "2026-01-01" +trusted-publisher = "github:loot/loot-condition-interpreter" + [[publisher.unicode-segmentation]] version = "1.12.0" when = "2024-09-13" @@ -357,7 +372,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p who = "Lukasz Anforowicz " criteria = "safe-to-deploy" delta = "1.14.0 -> 1.15.0" -notes = "The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = \"std\")]`." +notes = 'The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = "std")]`.' aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" [[audits.google.audits.equivalent]] @@ -498,8 +513,8 @@ who = "Lukasz Anforowicz " criteria = "safe-to-deploy" version = "1.0.35" notes = """ -Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits -(except for benign \"net\" hit in tests and \"fs\" hit in README.md) +Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits +(except for benign "net" hit in tests and "fs" hit in README.md) """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" @@ -682,7 +697,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p who = "Lukasz Anforowicz " criteria = "safe-to-deploy" version = "1.0.197" -notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits" +notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits' aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" [[audits.google.audits.serde_derive]] @@ -701,7 +716,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p who = "Lukasz Anforowicz " criteria = "safe-to-deploy" delta = "1.0.202 -> 1.0.203" -notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits" +notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits' aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" [[audits.google.audits.serde_derive]] @@ -890,12 +905,6 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.12.1 -> 1.13.0" -[[audits.libloadorder.audits.esplugin]] -who = "Oliver Hamlet " -criteria = "safe-to-deploy" -version = "6.1.4" -notes = "This is my own crate published using Trusted Publishing, but I can't mark it as trusted by cargo-vet because it doesn't support Trusted Publishing and just sees that the publisher is unknown." - [[audits.libloadorder.audits.keyvalues-parser]] who = "Oliver Hamlet " criteria = "safe-to-deploy"