From 25be2ce717190e922a2be8c94bed06835d1ee4da Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Sun, 10 May 2026 13:17:10 +0100 Subject: [PATCH] Update bitflags from 2.9.0 to 2.11.1 --- Cargo.lock | 4 +- supply-chain/imports.lock | 131 +++++++++++++++++++++++++++----------- 2 files changed, 97 insertions(+), 38 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 69906978..459cd023 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -52,9 +52,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "bitflags" -version = "2.9.0" +version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd" +checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" [[package]] name = "cc" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 0c4d9ff7..fd30ea6c 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -105,6 +105,46 @@ The changes appear to be reasonable updates from Rust's stdlib imported into `allocator-api2`'s copy of this code. """ +[[audits.bytecode-alliance.audits.bitflags]] +who = "Jamey Sharp " +criteria = "safe-to-deploy" +delta = "2.1.0 -> 2.2.1" +notes = """ +This version adds unsafe impls of traits from the bytemuck crate when built +with that library enabled, but I believe the impls satisfy the documented +safety requirements for bytemuck. The other changes are minor. +""" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.3.2 -> 2.3.3" +notes = """ +Nothing outside the realm of what one would expect from a bitflags generator, +all as expected. +""" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.4.1 -> 2.6.0" +notes = """ +Changes in how macros are invoked and various bits and pieces of macro-fu. +Otherwise no major changes and nothing dealing with `unsafe`. +""" + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.7.0 -> 2.9.4" +notes = "Tweaks to the macro, nothing out of order." + +[[audits.bytecode-alliance.audits.bitflags]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "2.10.0 -> 2.11.1" +notes = "Minor updates, nothing awry here." + [[audits.bytecode-alliance.audits.cfg-if]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -270,47 +310,19 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p [[audits.google.audits.bitflags]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" -version = "2.4.2" +version = "1.3.2" notes = """ -Audit notes: +Security review of earlier versions of the crate can be found at +(Google-internal, sorry): go/image-crate-chromium-security-review -* I've checked for any discussion in Google-internal cl/546819168 (where audit - of version 2.3.3 happened) -* `src/lib.rs` contains `#![cfg_attr(not(test), forbid(unsafe_code))]` -* There are 2 cases of `unsafe` in `src/external.rs` but they seem to be - correct in a straightforward way - they just propagate the marker trait's - impl (e.g. `impl bytemuck::Pod`) from the inner to the outer type -* Additional discussion and/or notes may be found in https://crrev.com/c/5238056 +The crate exposes a function marked as `unsafe`, but doesn't use any +`unsafe` blocks (except for tests of the single `unsafe` function). I +think this justifies marking this crate as `ub-risk-1`. + +Additional review comments can be found at https://crrev.com/c/4723145/31 """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.bitflags]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "2.4.2 -> 2.5.0" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.bitflags]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "2.5.0 -> 2.6.0" -notes = "The changes from the previous version are negligible and thus it retains the same properties." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.bitflags]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "2.6.0 -> 2.8.0" -notes = "No changes related to `unsafe impl ... bytemuck` pieces from `src/external.rs`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.bitflags]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "2.8.0 -> 2.9.0" -notes = "Adds a straightforward clear() function, but no new unsafe code." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.either]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -1066,6 +1078,53 @@ criteria = "safe-to-deploy" version = "0.5.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.bitflags]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "1.3.2 -> 2.0.2" +notes = "Removal of some unsafe code/methods. No changes to externals, just some refactoring (mostly internal)." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Nicolas Silva " +criteria = "safe-to-deploy" +delta = "2.0.2 -> 2.1.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Teodor Tanasoaia " +criteria = "safe-to-deploy" +delta = "2.2.1 -> 2.3.2" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "2.3.3 -> 2.4.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "2.4.0 -> 2.4.1" +notes = "Only allowing new clippy lints" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = [ + "Teodor Tanasoaia ", + "Erich Gubler ", +] +criteria = "safe-to-deploy" +delta = "2.6.0 -> 2.7.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Benjamin VanderSloot " +criteria = "safe-to-deploy" +delta = "2.9.4 -> 2.10.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.codespan-reporting]] who = "Erich Gubler " criteria = "safe-to-deploy"