From 185dd20834cd484e2d0d58f07b507b8a894912ee Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Sat, 20 Sep 2025 12:26:50 +0100 Subject: [PATCH] Downgrade syn to an audited version The differences don't seem to be significant for LCI's usage. --- Cargo.lock | 4 ++-- supply-chain/config.toml | 4 ---- supply-chain/imports.lock | 36 ++++++++++++++++++++++++++++++++++++ 3 files changed, 38 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6d23a36..dbfde8f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -553,9 +553,9 @@ dependencies = [ [[package]] name = "syn" -version = "2.0.101" +version = "2.0.100" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf" +checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0" dependencies = [ "proc-macro2", "quote", diff --git a/supply-chain/config.toml b/supply-chain/config.toml index b020b9d..a68bdc0 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -128,10 +128,6 @@ notes = "At time of review this was only built if targeting WASM, which is not a version = "1.0.20" criteria = "safe-to-run" -[[exemptions.syn]] -version = "2.0.101" -criteria = "safe-to-run" - [[exemptions.walkdir]] version = "2.5.0" criteria = "safe-to-run" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index e214d6d..3aba183 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -241,6 +241,11 @@ criteria = "safe-to-deploy" delta = "1.0.94 -> 1.0.95" notes = "The only changes were to reflect changes in semver-exempt APIs to support nightly Rust changes." +[[audits.esplugin.audits.syn]] +who = "Oliver Hamlet " +criteria = "safe-to-deploy" +delta = "2.0.98 -> 2.0.100" + [[audits.esplugin.audits.tempfile]] who = "Oliver Hamlet " criteria = "safe-to-deploy" @@ -1186,6 +1191,24 @@ delta = "1.0.138 -> 1.0.140" notes = "Only minor fixes for clippy and documentation updates." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.syn]] +who = "ChromeOS" +criteria = "safe-to-run" +version = "1.0.107" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.syn]] +who = "George Burgess IV " +criteria = "safe-to-run" +delta = "1.0.107 -> 2.0.14" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + +[[audits.google.audits.syn]] +who = "George Burgess IV " +criteria = "safe-to-run" +delta = "2.0.14 -> 2.0.18" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + [[audits.google.audits.tempfile]] who = "Ying Hsu " criteria = "safe-to-run" @@ -1443,6 +1466,19 @@ criteria = "safe-to-deploy" delta = "1.5.3 -> 1.6.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.syn]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "2.0.18 -> 2.0.26" +notes = "Dependency update & internal refactorings" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.syn]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "2.0.26 -> 2.0.98" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + [[audits.mozilla.audits.tempfile]] who = "Chris Martin " criteria = "safe-to-deploy"