From a3fab8f8c7ab6eaf5083beb17dd7fcdfbf9ac71f Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Sat, 20 Sep 2025 19:34:37 +0100 Subject: [PATCH] Downgrade crossbeam-deque to an audited version The differences don't seem to be significant for LCI's usage. --- Cargo.lock | 5 +++-- supply-chain/config.toml | 4 ---- supply-chain/imports.lock | 6 ++++++ 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 791d40e..4bc31ca 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -149,10 +149,11 @@ dependencies = [ [[package]] name = "crossbeam-deque" -version = "0.8.6" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51" +checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef" dependencies = [ + "cfg-if", "crossbeam-epoch", "crossbeam-utils", ] diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 9bcd2da..cf8b8d4 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -38,10 +38,6 @@ criteria = "safe-to-run" version = "0.6.0" criteria = "safe-to-run" -[[exemptions.crossbeam-deque]] -version = "0.8.6" -criteria = "safe-to-run" - [[exemptions.dataview]] version = "1.0.1" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 0676168..8d5a7b7 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -524,6 +524,12 @@ criteria = "safe-to-run" delta = "0.7.3 -> 0.7.4" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.crossbeam-deque]] +who = "George Burgess IV " +criteria = "safe-to-run" +version = "0.8.3" +aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" + [[audits.google.audits.crossbeam-epoch]] who = "George Burgess IV " criteria = "safe-to-run"