diff --git a/Cargo.lock b/Cargo.lock index 5d9ea8b..8593a3e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -11,6 +11,15 @@ dependencies = [ "memchr", ] +[[package]] +name = "alloca" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e5a7d05ea6aea7e9e64d25b9156ba2fee3fdd659e34e41063cd2fc7cd020d7f4" +dependencies = [ + "cc", +] + [[package]] name = "anes" version = "0.1.6" @@ -47,6 +56,15 @@ version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5" +[[package]] +name = "cc" +version = "1.2.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c31a0499c1dc64f458ad13872de75c0eb7e3fdb0e67964610c914b034fc5956e" +dependencies = [ + "shlex", +] + [[package]] name = "cfg-if" version = "1.0.0" @@ -116,10 +134,11 @@ dependencies = [ [[package]] name = "criterion" -version = "0.7.0" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e1c047a62b0cc3e145fa84415a3191f628e980b194c2755aa12300a4e6cbd928" +checksum = "4d883447757bb0ee46f233e9dc22eb84d93a9508c9b868687b274fc431d886bf" dependencies = [ + "alloca", "anes", "cast", "ciborium", @@ -128,6 +147,7 @@ dependencies = [ "itertools", "num-traits", "oorandom", + "page_size", "plotters", "rayon", "regex", @@ -139,9 +159,9 @@ dependencies = [ [[package]] name = "criterion-plot" -version = "0.6.0" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b1bcc0dc7dfae599d84ad0b1a55f80cde8af3725da8313b528da95ef783e338" +checksum = "ed943f81ea2faa8dcecbbfa50164acf95d555afec96a27871663b300e387b2e4" dependencies = [ "cast", "itertools", @@ -343,6 +363,16 @@ version = "11.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e" +[[package]] +name = "page_size" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da" +dependencies = [ + "libc", + "winapi", +] + [[package]] name = "plotters" version = "0.3.7" @@ -510,6 +540,12 @@ dependencies = [ "serde", ] +[[package]] +name = "shlex" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" + [[package]] name = "syn" version = "2.0.100" @@ -643,6 +679,22 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "winapi" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" +dependencies = [ + "winapi-i686-pc-windows-gnu", + "winapi-x86_64-pc-windows-gnu", +] + +[[package]] +name = "winapi-i686-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" + [[package]] name = "winapi-util" version = "0.1.11" @@ -652,6 +704,12 @@ dependencies = [ "windows-sys", ] +[[package]] +name = "winapi-x86_64-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" + [[package]] name = "windows-link" version = "0.2.0" diff --git a/Cargo.toml b/Cargo.toml index 2f2a1a4..a8894ec 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -15,7 +15,7 @@ regex = ">= 0.2.7, < 2" unicase = "2" [dev-dependencies] -criterion = ">= 0.1.2, < 0.8" +criterion = ">= 0.1.2, < 0.9" tempfile = "3" [lints] diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 8925d7a..c1b4e80 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -34,10 +34,6 @@ criteria = "safe-to-deploy" version = "0.7.0" criteria = "safe-to-run" -[[exemptions.criterion-plot]] -version = "0.6.0" -criteria = "safe-to-run" - [[exemptions.errno]] version = "0.3.14" criteria = "safe-to-run" @@ -137,3 +133,15 @@ version = "0.3.77" criteria = "safe-to-run" suggest = false notes = "At time of review this was only built if targeting WASM, which is not an intended target." + +[[exemptions.winapi-i686-pc-windows-gnu]] +version = "0.4.0" +criteria = "safe-to-run" +suggest = false +notes = "It's a collection of static library binaries and a build script that configures Cargo to use them, so it's not really reviewable." + +[[exemptions.winapi-x86_64-pc-windows-gnu]] +version = "0.4.0" +criteria = "safe-to-run" +suggest = false +notes = "It's a collection of static library binaries and a build script that configures Cargo to use them, so it's not really reviewable." diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 699b409..130deef 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -66,6 +66,23 @@ criteria = "safe-to-deploy" version = "0.1.6" notes = "Contains no unsafe code, no IO, no build.rs." +[[audits.bytecode-alliance.audits.cc]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "1.0.73" +notes = "I am the author of this crate." + +[[audits.bytecode-alliance.audits.cc]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "1.0.83 -> 1.1.6" + +[[audits.bytecode-alliance.audits.cc]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "1.1.6 -> 1.2.5" +notes = "Lots of minor updates here and there along with refactorings and such. Everything in line with what `cc` is expected to do." + [[audits.bytecode-alliance.audits.cfg-if]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -128,6 +145,12 @@ criteria = "safe-to-deploy" version = "0.2.19" notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected." +[[audits.bytecode-alliance.audits.shlex]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +version = "1.1.0" +notes = "Only minor `unsafe` code blocks which look valid and otherwise does what it says on the tin." + [[audits.bytecode-alliance.audits.tempfile]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -1152,6 +1175,12 @@ delta = "1.0.138 -> 1.0.140" notes = "Only minor fixes for clippy and documentation updates." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.shlex]] +who = "Daniel Verkamp " +criteria = "safe-to-run" +delta = "1.1.0 -> 1.3.0" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + [[audits.google.audits.syn]] who = "ChromeOS" criteria = "safe-to-run" @@ -1238,6 +1267,17 @@ criteria = "safe-to-run" version = "2.3.2" aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" +[[audits.google.audits.winapi]] +who = "danakj@chromium.org" +criteria = "safe-to-run" +version = "0.3.9" +notes = """ +Reviewed in https://crrev.com/c/5171063 + +Previously reviewed during security review and the audit is grandparented in. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.winapi-util]] who = "danakj@chromium.org" criteria = "safe-to-run" @@ -1262,6 +1302,26 @@ delta = "0.1.8 -> 0.1.9" notes = "The delta only changes Cargo.toml." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.isrg.audits.alloca]] +who = "David Cook " +criteria = "safe-to-run" +version = "0.4.0" + +[[audits.isrg.audits.criterion]] +who = "David Cook " +criteria = "safe-to-run" +delta = "0.7.0 -> 0.8.0" + +[[audits.isrg.audits.criterion]] +who = "J.C. Jones " +criteria = "safe-to-run" +delta = "0.8.0 -> 0.8.1" + +[[audits.isrg.audits.criterion-plot]] +who = "J.C. Jones " +criteria = "safe-to-run" +version = "0.8.1" + [[audits.isrg.audits.getrandom]] who = "David Cook " criteria = "safe-to-deploy" @@ -1284,6 +1344,11 @@ criteria = "safe-to-deploy" delta = "1.21.1 -> 1.21.3" notes = "The unsafe code has moved from `compare_exchange` to a new `init` function, which makes it easier to reason about." +[[audits.isrg.audits.page_size]] +who = "David Cook " +criteria = "safe-to-run" +version = "0.6.0" + [[audits.isrg.audits.rayon]] who = "Brandon Pitman " criteria = "safe-to-deploy" @@ -1323,6 +1388,18 @@ end = "2025-10-23" notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.cc]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.73 -> 1.0.78" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.cc]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.78 -> 1.0.83" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + [[audits.mozilla.audits.crossbeam-utils]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy"