mirror of
https://github.com/loot/libloot.git
synced 2026-07-27 14:16:01 -07:00
1478 lines
58 KiB
Plaintext
1478 lines
58 KiB
Plaintext
|
|
# cargo-vet imports lock
|
|
|
|
[[publisher.encoding_rs]]
|
|
version = "0.8.35"
|
|
when = "2024-10-24"
|
|
user-id = 4484
|
|
user-login = "hsivonen"
|
|
user-name = "Henri Sivonen"
|
|
|
|
[[publisher.esplugin]]
|
|
version = "6.1.4"
|
|
when = "2025-09-29"
|
|
trusted-publisher = "github:Ortham/esplugin"
|
|
|
|
[[publisher.futures-task]]
|
|
version = "0.3.31"
|
|
when = "2024-10-05"
|
|
user-id = 33035
|
|
user-login = "taiki-e"
|
|
user-name = "Taiki Endo"
|
|
|
|
[[publisher.futures-util]]
|
|
version = "0.3.31"
|
|
when = "2024-10-05"
|
|
user-id = 33035
|
|
user-login = "taiki-e"
|
|
user-name = "Taiki Endo"
|
|
|
|
[[publisher.libc]]
|
|
version = "0.2.186"
|
|
when = "2026-04-23"
|
|
user-id = 55123
|
|
user-login = "rust-lang-owner"
|
|
|
|
[[publisher.libloadorder]]
|
|
version = "18.8.2"
|
|
when = "2026-05-04"
|
|
trusted-publisher = "github:Ortham/libloadorder"
|
|
|
|
[[publisher.loot-condition-interpreter]]
|
|
version = "6.0.0"
|
|
when = "2026-01-21"
|
|
trusted-publisher = "github:loot/loot-condition-interpreter"
|
|
|
|
[[publisher.unicode-segmentation]]
|
|
version = "1.12.0"
|
|
when = "2024-09-13"
|
|
user-id = 1139
|
|
user-login = "Manishearth"
|
|
user-name = "Manish Goregaokar"
|
|
|
|
[[publisher.unicode-width]]
|
|
version = "0.2.2"
|
|
when = "2025-10-06"
|
|
user-id = 1139
|
|
user-login = "Manishearth"
|
|
user-name = "Manish Goregaokar"
|
|
|
|
[[publisher.windows-link]]
|
|
version = "0.2.1"
|
|
when = "2025-10-06"
|
|
user-id = 64539
|
|
user-login = "kennykerr"
|
|
user-name = "Kenny Kerr"
|
|
|
|
[[publisher.windows-result]]
|
|
version = "0.4.1"
|
|
when = "2025-10-06"
|
|
user-id = 64539
|
|
user-login = "kennykerr"
|
|
user-name = "Kenny Kerr"
|
|
|
|
[[publisher.windows-sys]]
|
|
version = "0.61.2"
|
|
when = "2025-10-06"
|
|
user-id = 64539
|
|
user-login = "kennykerr"
|
|
user-name = "Kenny Kerr"
|
|
|
|
[[publisher.wit-bindgen-rt]]
|
|
version = "0.39.0"
|
|
when = "2025-02-05"
|
|
user-id = 73222
|
|
user-login = "wasmtime-publish"
|
|
|
|
[[audits.bytecode-alliance.wildcard-audits.wit-bindgen-rt]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
user-id = 73222 # wasmtime-publish
|
|
start = "2023-01-01"
|
|
end = "2026-06-03"
|
|
notes = """
|
|
The Bytecode Alliance uses the `wasmtime-publish` crates.io account to automate
|
|
publication of this crate from CI. This repository requires all PRs are reviewed
|
|
by a Bytecode Alliance maintainer and it owned by the Bytecode Alliance itself.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.allocator-api2]]
|
|
who = "Chris Fallin <chris@cfallin.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.18 -> 0.2.20"
|
|
notes = """
|
|
The changes appear to be reasonable updates from Rust's stdlib imported into
|
|
`allocator-api2`'s copy of this code.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.bitflags]]
|
|
who = "Jamey Sharp <jsharp@fastly.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.1.0 -> 2.2.1"
|
|
notes = """
|
|
This version adds unsafe impls of traits from the bytemuck crate when built
|
|
with that library enabled, but I believe the impls satisfy the documented
|
|
safety requirements for bytemuck. The other changes are minor.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.bitflags]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.3.2 -> 2.3.3"
|
|
notes = """
|
|
Nothing outside the realm of what one would expect from a bitflags generator,
|
|
all as expected.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.bitflags]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.4.1 -> 2.6.0"
|
|
notes = """
|
|
Changes in how macros are invoked and various bits and pieces of macro-fu.
|
|
Otherwise no major changes and nothing dealing with `unsafe`.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.bitflags]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.7.0 -> 2.9.4"
|
|
notes = "Tweaks to the macro, nothing out of order."
|
|
|
|
[[audits.bytecode-alliance.audits.bitflags]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.10.0 -> 2.11.1"
|
|
notes = "Minor updates, nothing awry here."
|
|
|
|
[[audits.bytecode-alliance.audits.cfg-if]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.0"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.codespan-reporting]]
|
|
who = "Jamey Sharp <jsharp@fastly.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.11.1"
|
|
notes = "This library uses `forbid(unsafe_code)` and has no filesystem or network I/O."
|
|
|
|
[[audits.bytecode-alliance.audits.fastrand]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.0 -> 2.0.1"
|
|
notes = """
|
|
This update had a few doc updates but no otherwise-substantial source code
|
|
updates.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.fastrand]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.1.1 -> 2.3.0"
|
|
notes = "Minor refactoring, nothing new."
|
|
|
|
[[audits.bytecode-alliance.audits.foldhash]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.3"
|
|
notes = """
|
|
Only a minor amount of `unsafe` code in this crate related to global per-process
|
|
initialization which looks correct to me.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.futures]]
|
|
who = "Joel Dice <joel.dice@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-channel]]
|
|
who = "Joel Dice <joel.dice@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-core]]
|
|
who = "Pat Hickey <phickey@fastly.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.27"
|
|
notes = "Unsafe used to implement a concurrency primitive AtomicWaker. Well-commented and not obviously incorrect. Like my other audits of these concurrency primitives inside the futures family, I couldn't certify that it is correct without formal methods, but that is out of scope for this vetting."
|
|
|
|
[[audits.bytecode-alliance.audits.futures-core]]
|
|
who = "Pat Hickey <pat@moreproductive.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.28 -> 0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-executor]]
|
|
who = "Joel Dice <joel.dice@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-io]]
|
|
who = "Joel Dice <joel.dice@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-macro]]
|
|
who = "Joel Dice <joel.dice@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-sink]]
|
|
who = "Pat Hickey <phickey@fastly.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.27"
|
|
|
|
[[audits.bytecode-alliance.audits.futures-sink]]
|
|
who = "Pat Hickey <pat@moreproductive.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.28 -> 0.3.31"
|
|
|
|
[[audits.bytecode-alliance.audits.hashbrown]]
|
|
who = "Chris Fallin <chris@cfallin.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.14.5 -> 0.15.2"
|
|
|
|
[[audits.bytecode-alliance.audits.heck]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.1 -> 0.5.0"
|
|
notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected."
|
|
|
|
[[audits.bytecode-alliance.audits.log]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.22 -> 0.4.27"
|
|
notes = "Lots of minor updates to macros and such, nothing touching `unsafe`"
|
|
|
|
[[audits.bytecode-alliance.audits.log]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.27 -> 0.4.28"
|
|
notes = "Minor doc updates and lots new tests, nothing out of the ordinary."
|
|
|
|
[[audits.bytecode-alliance.audits.pin-project-lite]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.13 -> 0.2.14"
|
|
notes = "No substantive changes in this update"
|
|
|
|
[[audits.bytecode-alliance.audits.pin-utils]]
|
|
who = "Pat Hickey <phickey@fastly.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.0"
|
|
|
|
[[audits.bytecode-alliance.audits.shlex]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.1.0"
|
|
notes = "Only minor `unsafe` code blocks which look valid and otherwise does what it says on the tin."
|
|
|
|
[[audits.bytecode-alliance.audits.slab]]
|
|
who = "Pat Hickey <phickey@fastly.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.4.6"
|
|
notes = "provides a datastructure implemented using std's Vec. all uses of unsafe are just delegating to the underlying unsafe Vec methods."
|
|
|
|
[[audits.bytecode-alliance.audits.tempfile]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "3.16.0 -> 3.19.1"
|
|
notes = "Idiom and platform updates, but nothing major and nothing out of line."
|
|
|
|
[[audits.bytecode-alliance.audits.tempfile]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "3.20.0 -> 3.21.0"
|
|
notes = "Only minor manifest/CI changes."
|
|
|
|
[[audits.bytecode-alliance.audits.tempfile]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "3.21.0 -> 3.23.0"
|
|
notes = "Doc/test/platform updates, nothing out of the ordinary."
|
|
|
|
[[audits.bytecode-alliance.audits.unicase]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "2.6.0"
|
|
notes = """
|
|
This crate contains no `unsafe` code and no unnecessary use of the standard
|
|
library.
|
|
"""
|
|
|
|
[[audits.google.audits.autocfg]]
|
|
who = "Manish Goregaokar <manishearth@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.4.0"
|
|
notes = "Contains no unsafe"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.bitflags]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.3.2"
|
|
notes = """
|
|
Security review of earlier versions of the crate can be found at
|
|
(Google-internal, sorry): go/image-crate-chromium-security-review
|
|
|
|
The crate exposes a function marked as `unsafe`, but doesn't use any
|
|
`unsafe` blocks (except for tests of the single `unsafe` function). I
|
|
think this justifies marking this crate as `ub-risk-1`.
|
|
|
|
Additional review comments can be found at https://crrev.com/c/4723145/31
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.either]]
|
|
who = "Manish Goregaokar <manishearth@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.13.0"
|
|
notes = "Unsafe code pertaining to wrapping Pin APIs. Mostly passes invariants down."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.either]]
|
|
who = "Daniel Cheng <dcheng@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.13.0 -> 1.14.0"
|
|
notes = """
|
|
Inheriting ub-risk-1 from the baseline review of 1.13.0. While the delta has some diffs in unsafe code, they are either:
|
|
- migrating code to use helper macros
|
|
- migrating match patterns to take advantage of default bindings mode from RFC 2005
|
|
Either way, the result is code that does exactly the same thing and does not change the risk of UB.
|
|
|
|
See https://crrev.com/c/6323164 for more audit details.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.either]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.14.0 -> 1.15.0"
|
|
notes = 'The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = "std")]`.'
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.equivalent]]
|
|
who = "George Burgess IV <gbiv@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.1"
|
|
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.equivalent]]
|
|
who = "Jonathan Hao <phao@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.1 -> 1.0.2"
|
|
notes = "No changes to any .rs files or Rust code."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.fastrand]]
|
|
who = "George Burgess IV <gbiv@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.9.0"
|
|
notes = """
|
|
`does-not-implement-crypto` is certified because this crate explicitly says
|
|
that the RNG here is not cryptographically secure.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.foldhash]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.3 -> 0.1.4"
|
|
notes = "No changes to safety-relevant code"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.foldhash]]
|
|
who = "Chris Palmer <palmer@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.4 -> 0.1.5"
|
|
notes = "No new `unsafe`."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.getrandom]]
|
|
who = "Android Legacy"
|
|
criteria = "safe-to-run"
|
|
version = "0.2.2"
|
|
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.getrandom]]
|
|
who = "David Koloski <dkoloski@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.2 -> 0.2.12"
|
|
notes = "Audited at https://fxrev.dev/932979"
|
|
aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.getrandom]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.2.12 -> 0.2.14"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.getrandom]]
|
|
who = "danakj <danakj@chromium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.2.14 -> 0.2.15"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.heck]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.4.1"
|
|
notes = """
|
|
Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
|
|
and there were no hits.
|
|
|
|
`heck` (version `0.3.3`) has been added to Chromium in
|
|
https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.indexmap]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "2.7.1"
|
|
notes = '''
|
|
Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`
|
|
and there were no hits.
|
|
|
|
There is a little bit of `unsafe` Rust code - the audit can be found at
|
|
https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2
|
|
'''
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.indexmap]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.7.1 -> 2.8.0"
|
|
notes = """
|
|
No `unsafe` introduced or affected in:
|
|
* `indexmap_with_default!` and `indexset_with_default!` macros
|
|
* New `PartialEq` implementations
|
|
* `fn slice_eq` in `util.rs`
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.log]]
|
|
who = "danakj <danakj@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.4.22"
|
|
notes = """
|
|
Unsafe review in https://docs.google.com/document/d/1IXQbD1GhTRqNHIGxq6yy7qHqxeO4CwN5noMFXnqyDIM/edit?usp=sharing
|
|
|
|
Unsafety is generally very well-documented, with one exception, which we
|
|
describe in the review doc.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.num-traits]]
|
|
who = "Manish Goregaokar <manishearth@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.19"
|
|
notes = "Contains a single line of float-to-int unsafe with decent safety comments"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.pin-project-lite]]
|
|
who = "David Koloski <dkoloski@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.9"
|
|
notes = "Reviewed on https://fxrev.dev/824504"
|
|
aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.pin-project-lite]]
|
|
who = "David Koloski <dkoloski@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.9 -> 0.2.13"
|
|
notes = "Audited at https://fxrev.dev/946396"
|
|
aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.78"
|
|
notes = """
|
|
Grepped for "crypt", "cipher", "fs", "net" - there were no hits
|
|
(except for a benign "fs" hit in a doc comment)
|
|
|
|
Notes from the `unsafe` review can be found in https://crrev.com/c/5385745.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.78 -> 1.0.79"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.79 -> 1.0.80"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.80 -> 1.0.81"
|
|
notes = "Comment changes only"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "danakj <danakj@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.81 -> 1.0.82"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.82 -> 1.0.83"
|
|
notes = "Substantive change is replacing String with Box<str>, saving memory."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.83 -> 1.0.84"
|
|
notes = "Only doc comment changes in `src/lib.rs`."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "danakj@chromium.org"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.84 -> 1.0.85"
|
|
notes = "Test-only changes."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.85 -> 1.0.86"
|
|
notes = """
|
|
Comment-only changes in `build.rs`.
|
|
Reordering of `Cargo.toml` entries.
|
|
Just bumping up the version number in `lib.rs`.
|
|
Config-related changes in `test_size.rs`.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "danakj <danakj@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.86 -> 1.0.87"
|
|
notes = "No new unsafe interactions."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Liza Burakova <liza@chromium.org"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.87 -> 1.0.89"
|
|
notes = """
|
|
Biggest change is adding error handling in build.rs.
|
|
Some config related changes in wrapper.rs.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.89 -> 1.0.92"
|
|
notes = """
|
|
I looked at the delta and the previous discussion at
|
|
https://chromium-review.googlesource.com/c/chromium/src/+/5385745/3#message-a8e2813129fa3779dab15acede408ee26d67b7f3
|
|
and the changes look okay to me (including the `unsafe fn from_str_unchecked`
|
|
changes in `wrapper.rs`).
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.92 -> 1.0.93"
|
|
notes = "No `unsafe`-related changes."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.proc-macro2]]
|
|
who = "Daniel Cheng <dcheng@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.93 -> 1.0.94"
|
|
notes = "Minor doc changes and clippy lint adjustments+fixes."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.quote]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.35"
|
|
notes = """
|
|
Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits
|
|
(except for benign "net" hit in tests and "fs" hit in README.md)
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.quote]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.35 -> 1.0.36"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.quote]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.36 -> 1.0.37"
|
|
notes = """
|
|
The delta just 1) inlines/expands `impl ToTokens` that used to be handled via
|
|
`primitive!` macro and 2) adds `impl ToTokens` for `CStr` and `CString`.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.quote]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.37 -> 1.0.38"
|
|
notes = "Still no unsafe"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.quote]]
|
|
who = "Daniel Cheng <dcheng@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.38 -> 1.0.39"
|
|
notes = "Only minor changes for clippy lints and documentation."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.quote]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.39 -> 1.0.40"
|
|
notes = """
|
|
The delta is just a simplification of how `tokens.extend(...)` call is made.
|
|
Still no `unsafe` anywhere.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.regex-syntax]]
|
|
who = "Manish Goregaokar <manishearth@google.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.8.5"
|
|
notes = "Contains no unsafe"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.197"
|
|
notes = """
|
|
Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`.
|
|
|
|
There were some hits for `net`, but they were related to serialization and
|
|
not actually opening any connections or anything like that.
|
|
|
|
There were 2 hits of `unsafe` when grepping:
|
|
* In `fn as_str` in `impl Buf`
|
|
* In `fn serialize` in `impl Serialize for net::Ipv4Addr`
|
|
|
|
Unsafe review comments can be found in https://crrev.com/c/5350573/2 (this
|
|
review also covered `serde_json_lenient`).
|
|
|
|
Version 1.0.130 of the crate has been added to Chromium in
|
|
https://crrev.com/c/3265545. The CL description contains a link to a
|
|
(Google-internal, sorry) document with a mini security review.
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.197 -> 1.0.198"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "danakj <danakj@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.198 -> 1.0.201"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.201 -> 1.0.202"
|
|
notes = "Trivial changes"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.202 -> 1.0.203"
|
|
notes = "s/doc_cfg/docsrs/ + tuple_impls/tuple_impl_body-related changes"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.203 -> 1.0.204"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.204 -> 1.0.207"
|
|
notes = "The small change in `src/private/ser.rs` should have no impact on `ub-risk-2`."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.207 -> 1.0.209"
|
|
notes = """
|
|
The delta carries fairly small changes in `src/private/de.rs` and
|
|
`src/private/ser.rs` (see https://crrev.com/c/5812194/2..5). AFAICT the
|
|
delta has no impact on the `unsafe`, `from_utf8_unchecked`-related parts
|
|
of the crate (in `src/de/format.rs` and `src/ser/impls.rs`).
|
|
"""
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.209 -> 1.0.210"
|
|
notes = "Almost no new code - just feature rearrangement"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Liza Burakova <liza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.210 -> 1.0.213"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.213 -> 1.0.214"
|
|
notes = "No unsafe, no crypto"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.214 -> 1.0.215"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.215 -> 1.0.216"
|
|
notes = "The delta makes minor changes in `build.rs` - switching to the `?` syntax sugar."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.216 -> 1.0.217"
|
|
notes = "Minimal changes, nothing unsafe"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Daniel Cheng <dcheng@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.217 -> 1.0.218"
|
|
notes = "No changes outside comments and documentation."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.218 -> 1.0.219"
|
|
notes = "Just allowing `clippy::elidable_lifetime_names`."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.197"
|
|
notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits'
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "danakj <danakj@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.197 -> 1.0.201"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.201 -> 1.0.202"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.202 -> 1.0.203"
|
|
notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits'
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.203 -> 1.0.204"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.204 -> 1.0.207"
|
|
notes = 'Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits'
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.207 -> 1.0.209"
|
|
notes = '''
|
|
There are no code changes in this delta - see https://crrev.com/c/5812194/2..5
|
|
|
|
I've neverthless also grepped for `-i cipher`, `-i crypto`, `\bfs\b`,
|
|
`\bnet\b`, and `\bunsafe\b`. There were no hits.
|
|
'''
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.209 -> 1.0.210"
|
|
notes = "Almost no new code - just feature rearrangement"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Liza Burakova <liza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.210 -> 1.0.213"
|
|
notes = "Grepped for 'unsafe', 'crypt', 'cipher', 'fs', 'net' - there were no hits"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.213 -> 1.0.214"
|
|
notes = "No changes to unsafe, no crypto"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.214 -> 1.0.215"
|
|
notes = "Minor changes should not impact UB risk"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.215 -> 1.0.216"
|
|
notes = "The delta adds `#[automatically_derived]` in a few places. Still no `unsafe`."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.216 -> 1.0.217"
|
|
notes = "No changes"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Daniel Cheng <dcheng@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.217 -> 1.0.218"
|
|
notes = "No changes outside comments and documentation."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.serde_derive]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.218 -> 1.0.219"
|
|
notes = "Minor changes (clippy tweaks, using `mem::take` instead of `mem::replace`)."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.tempfile]]
|
|
who = "Ying Hsu <yinghsu@chromium.org>"
|
|
criteria = "safe-to-run"
|
|
version = "3.10.1"
|
|
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.unicode-ident]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.12"
|
|
notes = '''
|
|
I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.
|
|
|
|
All two functions from the public API of this crate use `unsafe` to avoid bound
|
|
checks for an array access. Cross-module analysis shows that the offsets can
|
|
be statically proven to be within array bounds. More details can be found in
|
|
the unsafe review CL at https://crrev.com/c/5350386.
|
|
|
|
This crate has been added to Chromium in https://crrev.com/c/3891618.
|
|
'''
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.unicode-ident]]
|
|
who = "Dustin J. Mitchell <djmitche@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.12 -> 1.0.13"
|
|
notes = "Lots of table updates, and tables are assumed correct with unsafe `.get_unchecked()`, so ub-risk-2 is appropriate"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.unicode-ident]]
|
|
who = "Lukasz Anforowicz <lukasza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.13 -> 1.0.14"
|
|
notes = "Minimal delta in `.rs` files: new test assertions + doc changes."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.unicode-ident]]
|
|
who = "Adrian Taylor <adetaylor@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.14 -> 1.0.15"
|
|
notes = "No changes relevant to any of these criteria."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.unicode-ident]]
|
|
who = "Liza Burakova <liza@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.15 -> 1.0.16"
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.google.audits.unicode-ident]]
|
|
who = "Daniel Cheng <dcheng@chromium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.16 -> 1.0.18"
|
|
notes = "Only minor comment and documentation updates."
|
|
aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
|
|
|
|
[[audits.isrg.audits.cfg-if]]
|
|
who = "David Cook <dcook@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.0 -> 1.0.1"
|
|
|
|
[[audits.isrg.audits.cfg-if]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.1 -> 1.0.3"
|
|
|
|
[[audits.isrg.audits.cfg-if]]
|
|
who = "David Cook <dcook@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.3 -> 1.0.4"
|
|
|
|
[[audits.isrg.audits.getrandom]]
|
|
who = "David Cook <dcook@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.1 -> 0.3.2"
|
|
|
|
[[audits.isrg.audits.once_cell]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.21.3 -> 1.21.4"
|
|
notes = "The addition is a safe while loop around prior behavior. I don't see any way for that to become malicious."
|
|
|
|
[[audits.isrg.audits.rayon]]
|
|
who = "Brandon Pitman <bran@bran.land>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.6.1 -> 1.7.0"
|
|
|
|
[[audits.isrg.audits.rayon]]
|
|
who = "David Cook <dcook@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.7.0 -> 1.8.0"
|
|
|
|
[[audits.isrg.audits.rayon]]
|
|
who = "Ameer Ghani <inahga@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.8.0 -> 1.8.1"
|
|
|
|
[[audits.isrg.audits.rayon]]
|
|
who = "Brandon Pitman <bran@bran.land>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.8.1 -> 1.9.0"
|
|
|
|
[[audits.isrg.audits.rayon]]
|
|
who = "Brandon Pitman <bran@bran.land>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.9.0 -> 1.10.0"
|
|
|
|
[[audits.isrg.audits.rayon]]
|
|
who = "David Cook <dcook@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.10.0 -> 1.11.0"
|
|
notes = """
|
|
I compared src/slice/sort.rs against the file library/core/src/slice/sort.rs
|
|
from the standard library, as of commit e501add.
|
|
"""
|
|
|
|
[[audits.isrg.audits.rayon-core]]
|
|
who = "Ameer Ghani <inahga@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.12.1"
|
|
|
|
[[audits.isrg.audits.rayon-core]]
|
|
who = "David Cook <dcook@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.12.1 -> 1.13.0"
|
|
|
|
[[audits.isrg.audits.serde]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.219 -> 1.0.224"
|
|
|
|
[[audits.isrg.audits.serde]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.224 -> 1.0.225"
|
|
|
|
[[audits.isrg.audits.serde]]
|
|
who = "Tim Geoghegan <timg@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.225 -> 1.0.226"
|
|
|
|
[[audits.isrg.audits.serde_core]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.224"
|
|
|
|
[[audits.isrg.audits.serde_core]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.224 -> 1.0.225"
|
|
|
|
[[audits.isrg.audits.serde_core]]
|
|
who = "Tim Geoghegan <timg@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.225 -> 1.0.226"
|
|
|
|
[[audits.isrg.audits.serde_derive]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.219 -> 1.0.224"
|
|
|
|
[[audits.isrg.audits.serde_derive]]
|
|
who = "J.C. Jones <jc@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.224 -> 1.0.225"
|
|
|
|
[[audits.isrg.audits.serde_derive]]
|
|
who = "Tim Geoghegan <timg@divviup.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.225 -> 1.0.226"
|
|
|
|
[[audits.loot.audits.proc-macro2]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.95 -> 1.0.101"
|
|
aggregated-from = "https://raw.githubusercontent.com/loot/metadata-validator/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.loot.audits.quote]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.43 -> 1.0.45"
|
|
aggregated-from = "https://raw.githubusercontent.com/loot/metadata-validator/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.loot.audits.syn]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.114 -> 2.0.117"
|
|
aggregated-from = "https://raw.githubusercontent.com/loot/metadata-validator/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.wildcard-audits.encoding_rs]]
|
|
who = "Henri Sivonen <hsivonen@hsivonen.fi>"
|
|
criteria = "safe-to-deploy"
|
|
user-id = 4484 # Henri Sivonen (hsivonen)
|
|
start = "2019-02-26"
|
|
end = "2025-10-23"
|
|
notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.wildcard-audits.unicode-segmentation]]
|
|
who = "Manish Goregaokar <manishsmail@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
user-id = 1139 # Manish Goregaokar (Manishearth)
|
|
start = "2019-05-15"
|
|
end = "2027-04-23"
|
|
notes = "All code written or reviewed by Manish"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.wildcard-audits.unicode-width]]
|
|
who = "Manish Goregaokar <manishsmail@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
user-id = 1139 # Manish Goregaokar (Manishearth)
|
|
start = "2019-12-05"
|
|
end = "2026-02-01"
|
|
notes = "All code written or reviewed by Manish"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.allocator-api2]]
|
|
who = "Nicolas Silva <nical@fastmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.18"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.allocator-api2]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.20 -> 0.2.21"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.arraydeque]]
|
|
who = "Lars Eggert <lars@eggert.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.5.1"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = "Alex Franchuk <afranchuk@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.3.2 -> 2.0.2"
|
|
notes = "Removal of some unsafe code/methods. No changes to externals, just some refactoring (mostly internal)."
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = "Nicolas Silva <nical@fastmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.2 -> 2.1.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.2.1 -> 2.3.2"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.3.3 -> 2.4.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.4.0 -> 2.4.1"
|
|
notes = "Only allowing new clippy lints"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = [
|
|
"Teodor Tanasoaia <ttanasoaia@mozilla.com>",
|
|
"Erich Gubler <erichdongubler@gmail.com>",
|
|
]
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.6.0 -> 2.7.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.bitflags]]
|
|
who = "Benjamin VanderSloot <bvandersloot@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.9.4 -> 2.10.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.codespan-reporting]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.11.1 -> 0.12.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.crunchy]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.3"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.fastrand]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.9.0 -> 2.0.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.fastrand]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.1 -> 2.1.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.fastrand]]
|
|
who = "Chris Martin <cmartin@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.1.0 -> 2.1.1"
|
|
notes = "Fairly trivial changes, no chance of security regression."
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.foldhash]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.5 -> 0.2.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.futures-core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.27 -> 0.3.28"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.futures-sink]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.27 -> 0.3.28"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.getrandom]]
|
|
who = "Chris Martin <cmartin@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.15 -> 0.3.1"
|
|
notes = """
|
|
I've looked over all unsafe code, and it appears to be safe, fully initializing the rng buffers.
|
|
In addition, I've checked Linux, Windows, Mac, and Android more thoroughly against API
|
|
documentation.
|
|
"""
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.hashbrown]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.15.2 -> 0.15.5"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.hashbrown]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.15.5 -> 0.16.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.indexmap]]
|
|
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.8.0 -> 2.9.0"
|
|
notes = "Doc update, a new API, one carefully annotated unsafe code block with all preconditions checked"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.option-ext]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.pin-project-lite]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.14 -> 0.2.16"
|
|
notes = """
|
|
Only functional change is to work around a bug in the negative_impls feature
|
|
(https://github.com/taiki-e/pin-project/issues/340#issuecomment-2432146009)
|
|
"""
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.rayon]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.5.3"
|
|
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.rayon]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.5.3 -> 1.6.1"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.regex]]
|
|
who = "Benjamin VanderSloot <bvandersloot@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.11.1 -> 1.12.3"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.regex-automata]]
|
|
who = "Benjamin VanderSloot <bvandersloot@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.9 -> 0.4.14"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.rustc-hash]]
|
|
who = "Bobby Holley <bobbyholley@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.1.0"
|
|
notes = "Straightforward crate with no unsafe code, does what it says on the tin."
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.rustc-hash]]
|
|
who = "Ben Dean-Kawamura <bdk@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.1.0 -> 2.1.1"
|
|
notes = "Simple hashing crate, no unsafe code."
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.serde]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.226 -> 1.0.227"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.serde]]
|
|
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.227 -> 1.0.228"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.serde_core]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.226 -> 1.0.227"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.serde_core]]
|
|
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.227 -> 1.0.228"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.serde_derive]]
|
|
who = "Erich Gubler <erichdongubler@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.226 -> 1.0.227"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.serde_derive]]
|
|
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.227 -> 1.0.228"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.shlex]]
|
|
who = "Max Inden <mail@max-inden.de>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.1.0 -> 1.3.0"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.slab]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.6 -> 0.4.7"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.slab]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.7 -> 0.4.8"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.tempfile]]
|
|
who = "Chris Martin <cmartin@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "3.10.1 -> 3.16.0"
|
|
notes = "Big change, but nothing unsafe and lots of it is documentation and convenience APIs"
|
|
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.tempfile]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "3.19.1 -> 3.20.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
|
|
|
|
[[audits.mozilla.audits.unicase]]
|
|
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.6.0 -> 2.8.1"
|
|
notes = "Update to Unicode 15.0.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.autocfg]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.4.0 -> 1.5.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/svg_to_ico/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.errno]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.14"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/svg_to_ico/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.keyvalues-parser]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.0 -> 0.2.1"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/libloadorder/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.memchr]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.7.5 -> 2.8.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/svg_to_ico/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.proc-macro2]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.94 -> 1.0.95"
|
|
notes = "The only changes were to reflect changes in semver-exempt APIs to support nightly Rust changes."
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.proc-macro2]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.101 -> 1.0.105"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.quote]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.40 -> 1.0.43"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.rayon]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.11.0 -> 1.12.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.rust-ini]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.21.1 -> 0.21.3"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/libloadorder/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.rustix]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-run"
|
|
delta = "1.1.2 -> 1.1.3"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.syn]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.106 -> 2.0.112"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.syn]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.112 -> 2.0.113"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.syn]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.0.113 -> 2.0.114"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.tempfile]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-run"
|
|
delta = "3.23.0 -> 3.25.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.unicase]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "2.8.1 -> 2.9.0"
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|
|
|
|
[[audits.ortham.audits.winapi-util]]
|
|
who = "Oliver Hamlet <git@ortham.net>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.9 -> 0.1.11"
|
|
notes = "The only change is to the allowed range of windows-sys dependency versions."
|
|
aggregated-from = "https://raw.githubusercontent.com/Ortham/esplugin/refs/heads/master/supply-chain/audits.toml"
|