From ea83c7347c6fa36159beccc6bd1e8e10d0959ab7 Mon Sep 17 00:00:00 2001 From: Robert M1 <50460704+githubrobbi@users.noreply.github.com> Date: Mon, 20 Jul 2026 12:28:18 -0700 Subject: [PATCH 1/2] fix(vss): strict-decode VSS device paths instead of lossy substitution read_optional_wide's snapshot_device_object ends up passed to CreateFileW in the Broker (a LocalSystem service) to open the actual snapshot volume; a lossy UTF-16 substitution on malformed shim input would silently turn it into a different-but-plausible path instead of surfacing the problem. Switch to String::from_utf16, returning None (already a handled case for every caller) on invalid encoding. Mark the one genuinely display-only lossy decode (a tracing log field in uffs-broker's VSS helper, where the actual session lookup already keys off the raw bytes) with the anti-pattern gate's AUDIT-OK(bytes) escape hatch instead. Pre-existing anti_pattern_gate.sh failure, unrelated to this branch's dependency bumps; fixed here rather than left broken. --- .../src/broker/snapshot_manager/vss_helper.rs | 3 +++ crates/uffs-vss-requestor/src/snapshot.rs | 12 +++++++++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/crates/uffs-broker/src/broker/snapshot_manager/vss_helper.rs b/crates/uffs-broker/src/broker/snapshot_manager/vss_helper.rs index 9532a664c..ca268b667 100644 --- a/crates/uffs-broker/src/broker/snapshot_manager/vss_helper.rs +++ b/crates/uffs-broker/src/broker/snapshot_manager/vss_helper.rs @@ -409,6 +409,9 @@ impl VssProvider for WindowsVssProvider { fn delete_snapshot(&self, snapshot_id: &[u8]) -> Result<(), VssError> { tracing::info!( + // AUDIT-OK(bytes): display-only log field; the actual lookup + // just below keys off the raw `snapshot_id` bytes, not this + // lossy string. snapshot_id = %String::from_utf8_lossy(snapshot_id), "vss: requesting snapshot deletion" ); diff --git a/crates/uffs-vss-requestor/src/snapshot.rs b/crates/uffs-vss-requestor/src/snapshot.rs index c27054c57..23f3779f3 100644 --- a/crates/uffs-vss-requestor/src/snapshot.rs +++ b/crates/uffs-vss-requestor/src/snapshot.rs @@ -151,8 +151,14 @@ fn free_error(error: &mut ffi::VssError) { } /// Read a NUL-terminated UTF-16 string the shim allocated, or `None` if -/// `ptr` is null. Does not free `ptr` — the caller is responsible for -/// that via the matching `*_free` function. +/// `ptr` is null or the bytes aren't valid UTF-16. Does not free `ptr` — +/// the caller is responsible for that via the matching `*_free` function. +/// +/// Decodes strictly rather than lossily: `snapshot_device_object` (one of +/// this function's callers) ends up passed to `CreateFileW` in the +/// Broker to open the actual snapshot volume — a lossy substitution on +/// malformed input would silently turn it into a different-but-plausible +/// path instead of surfacing the problem. #[expect( unsafe_code, reason = "reads a shim-allocated string; see the inline SAFETY comments" @@ -180,5 +186,5 @@ fn read_optional_wide(ptr: *mut u16) -> Option { // SAFETY: `ptr` is non-null and valid for `length` `u16` elements — // established by the loop above stopping at the first NUL unit. let slice = unsafe { core::slice::from_raw_parts(ptr, length) }; - Some(String::from_utf16_lossy(slice)) + String::from_utf16(slice).ok() } From 32490c6ca74237ce273aa66c36c7b23004dd36d1 Mon Sep 17 00:00:00 2001 From: Robert M1 <50460704+githubrobbi@users.noreply.github.com> Date: Mon, 20 Jul 2026 12:29:22 -0700 Subject: [PATCH 2/2] chore(deps): bump tokio/serde/clap/regex/uuid/futures/syn and friends Version-bumps: tokio 1.52.3->1.53.1, futures 0.3.32->0.3.33, serde 1.0.228->1.0.229, serde_json 1.0.150->1.0.151, toml 1.1.2->1.1.3, bitflags 2.13.0->2.13.1, bytemuck 1.25.1->1.25.2, thiserror 2.0.18-> 2.0.19, anyhow 1.0.103->1.0.104, clap 4.6.1->4.6.3, regex 1.13.0-> 1.13.1, globset 0.4.18->0.4.19, which 8.0.4->8.0.5, uuid 1.23.5->1.24.0. Cargo.lock updated via targeted `cargo update -p ` per bumped pin (not a full relock) to keep the transitive blast radius to exactly the ~30 packages these ranges actually touch. cargo-vet: certified every newly-unvetted crate at safe-to-deploy -- scoped per-package trust grants for already-trusted-publisher patch/ minor bumps (dtolnay: anyhow/serde/serde_core/serde_derive/thiserror/ thiserror-impl; epage: clap/clap_derive/clap_builder/toml/toml_writer; BurntSushi: regex/globset/regex-automata; Darksonn: tokio), plus real delta-diff certifications (reviewed for unsafe/capability changes) for the rest, including a full manual review of syn's 2.0->3.0 major bump despite the large diff, given its foundational role. `cargo vet prune` removed the exemptions these certifications superseded. cargo deny check: clean (pre-existing duplicate-version warnings only). --- Cargo.lock | 219 ++++++++++---------- Cargo.toml | 28 +-- supply-chain/audits.toml | 189 +++++++++++++++++ supply-chain/config.toml | 40 ---- supply-chain/imports.lock | 425 ++++++++++---------------------------- 5 files changed, 425 insertions(+), 476 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 67d0eb5a4..2fd534e1b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -162,9 +162,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.103" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "ar_archive_writer" @@ -249,7 +249,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -260,7 +260,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -379,9 +379,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" [[package]] name = "bitflags" -version = "2.13.0" +version = "2.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8" +checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" dependencies = [ "serde_core", ] @@ -464,9 +464,9 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649" [[package]] name = "bytemuck" -version = "1.25.1" +version = "1.25.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424" +checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797" dependencies = [ "bytemuck_derive", ] @@ -479,7 +479,7 @@ checksum = "f9abbd1bc6865053c427f7198e6af43bfdedc55ab791faed4fbd361d789575ff" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -605,9 +605,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.6.1" +version = "4.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51" +checksum = "0fb99565819980999fb7b4a1796046a5c949e6d4ff132cf5fadf5a641e20d776" dependencies = [ "clap_builder", "clap_derive", @@ -615,9 +615,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.0" +version = "4.6.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f" +checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b" dependencies = [ "anstream", "anstyle", @@ -630,14 +630,14 @@ dependencies = [ [[package]] name = "clap_derive" -version = "4.6.1" +version = "4.6.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9" +checksum = "32f2392eae7f16557a3d727ef3a12e57b2b2ca6f98566a5f4fb41ffe305df077" dependencies = [ "heck", "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -947,7 +947,7 @@ dependencies = [ "proc-macro2", "quote", "strsim", - "syn", + "syn 2.0.117", ] [[package]] @@ -958,7 +958,7 @@ checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d" dependencies = [ "darling_core", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -1041,7 +1041,7 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -1197,9 +1197,9 @@ dependencies = [ [[package]] name = "futures" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d" +checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218" dependencies = [ "futures-channel", "futures-core", @@ -1212,9 +1212,9 @@ dependencies = [ [[package]] name = "futures-channel" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d" +checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae" dependencies = [ "futures-core", "futures-sink", @@ -1222,15 +1222,15 @@ dependencies = [ [[package]] name = "futures-core" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d" +checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7" [[package]] name = "futures-executor" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d" +checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458" dependencies = [ "futures-core", "futures-task", @@ -1239,38 +1239,38 @@ dependencies = [ [[package]] name = "futures-io" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718" +checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a" [[package]] name = "futures-macro" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b" +checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] name = "futures-sink" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893" +checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307" [[package]] name = "futures-task" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393" +checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109" [[package]] name = "futures-util" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6" +checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa" dependencies = [ "futures-channel", "futures-core", @@ -1351,9 +1351,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280" [[package]] name = "globset" -version = "0.4.18" +version = "0.4.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3" +checksum = "e47d37d2ae4464254884b60ab7071be2b876a9c35b696bd018ddcc76847309cd" dependencies = [ "aho-corasick", "bstr", @@ -2045,7 +2045,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -2124,7 +2124,7 @@ dependencies = [ "serde", "serde_json", "serde_urlencoded", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tracing", "url", @@ -3001,7 +3001,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b" dependencies = [ "proc-macro2", - "syn", + "syn 2.0.117", ] [[package]] @@ -3072,7 +3072,7 @@ dependencies = [ "rustc-hash", "rustls", "socket2", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tracing", "web-time", @@ -3093,7 +3093,7 @@ dependencies = [ "rustls", "rustls-pki-types", "slab", - "thiserror 2.0.18", + "thiserror 2.0.19", "tinyvec", "tracing", "web-time", @@ -3255,7 +3255,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "76009fbe0614077fc1a2ce255e3a1881a2e3a3527097d5dc6d8212c585e7e38b" dependencies = [ "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -3295,14 +3295,14 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] name = "regex" -version = "1.13.0" +version = "1.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2" +checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d" dependencies = [ "aho-corasick", "memchr", @@ -3312,9 +3312,9 @@ dependencies = [ [[package]] name = "regex-automata" -version = "0.4.14" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f" +checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad" dependencies = [ "aho-corasick", "memchr", @@ -3406,7 +3406,7 @@ dependencies = [ "serde", "serde_json", "sse-stream", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tokio-stream", "tokio-util", @@ -3425,7 +3425,7 @@ dependencies = [ "proc-macro2", "quote", "serde_json", - "syn", + "syn 2.0.117", ] [[package]] @@ -3578,7 +3578,7 @@ dependencies = [ "proc-macro2", "quote", "serde_derive_internals", - "syn", + "syn 2.0.117", ] [[package]] @@ -3618,9 +3618,9 @@ checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" [[package]] name = "serde" -version = "1.0.228" +version = "1.0.229" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" +checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba" dependencies = [ "serde_core", "serde_derive", @@ -3628,22 +3628,22 @@ dependencies = [ [[package]] name = "serde_core" -version = "1.0.228" +version = "1.0.229" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" +checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48" dependencies = [ "serde_derive", ] [[package]] name = "serde_derive" -version = "1.0.228" +version = "1.0.229" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" +checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 3.0.2", ] [[package]] @@ -3654,14 +3654,14 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] name = "serde_json" -version = "1.0.150" +version = "1.0.151" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9" +checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14" dependencies = [ "indexmap", "itoa", @@ -3861,7 +3861,7 @@ checksum = "028e551d5e270b31b9f3ea271778d9d827148d4287a5d96167b6bb9787f5cc38" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -3938,7 +3938,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -3964,6 +3964,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "syn" +version = "3.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + [[package]] name = "sync_wrapper" version = "1.0.2" @@ -3981,7 +3992,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -4038,11 +4049,11 @@ dependencies = [ [[package]] name = "thiserror" -version = "2.0.18" +version = "2.0.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4" +checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9" dependencies = [ - "thiserror-impl 2.0.18", + "thiserror-impl 2.0.19", ] [[package]] @@ -4053,18 +4064,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] name = "thiserror-impl" -version = "2.0.18" +version = "2.0.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5" +checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 3.0.2", ] [[package]] @@ -4144,9 +4155,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.52.3" +version = "1.53.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe" +checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" dependencies = [ "bytes", "libc", @@ -4167,7 +4178,7 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -4206,9 +4217,9 @@ dependencies = [ [[package]] name = "toml" -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee" +checksum = "53c96ecdfa941c8fc4fcaed14f99ada8ebed502eef533015095a07e3301d4c3c" dependencies = [ "indexmap", "serde_core", @@ -4239,9 +4250,9 @@ dependencies = [ [[package]] name = "toml_writer" -version = "1.1.1+spec-1.1.0" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db" +checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" [[package]] name = "tower" @@ -4309,7 +4320,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c" dependencies = [ "crossbeam-channel", "symlink", - "thiserror 2.0.18", + "thiserror 2.0.19", "time", "tracing-subscriber", ] @@ -4322,7 +4333,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -4388,7 +4399,7 @@ dependencies = [ "serde_json", "sha2 0.11.0", "tempfile", - "thiserror 2.0.18", + "thiserror 2.0.19", "toml", "uffs-version", "winresource", @@ -4401,7 +4412,7 @@ dependencies = [ "anyhow", "serde", "serde_json", - "thiserror 2.0.18", + "thiserror 2.0.19", "tracing", "tracing-subscriber", "uffs-broker-protocol", @@ -4416,7 +4427,7 @@ dependencies = [ name = "uffs-broker-protocol" version = "0.6.28" dependencies = [ - "thiserror 2.0.18", + "thiserror 2.0.19", ] [[package]] @@ -4470,7 +4481,7 @@ dependencies = [ "serde", "serde_json", "tempfile", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tracing", "uffs-broker-protocol", @@ -4499,7 +4510,7 @@ dependencies = [ "serde_json", "sha2 0.11.0", "tempfile", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tracing", "uffs-format", @@ -4527,7 +4538,7 @@ dependencies = [ "serde", "serde_json", "tempfile", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "toml", "tracing", @@ -4618,7 +4629,7 @@ dependencies = [ "schemars", "serde", "serde_json", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tower-service", "tracing", @@ -4657,7 +4668,7 @@ dependencies = [ "sha2 0.11.0", "smallvec", "tempfile", - "thiserror 2.0.18", + "thiserror 2.0.19", "tokio", "tracing", "tracing-appender", @@ -4860,9 +4871,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" [[package]] name = "uuid" -version = "1.23.5" +version = "1.24.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ea5fab0d6c3c01ae70085a09cb03d4c7a1d6314e2b3e075392783396d724ca0a" +checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239" dependencies = [ "getrandom 0.4.2", "js-sys", @@ -4994,7 +5005,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn", + "syn 2.0.117", "wasm-bindgen-shared", ] @@ -5076,9 +5087,9 @@ dependencies = [ [[package]] name = "which" -version = "8.0.4" +version = "8.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48d7cd18d4acb58fb3cdfe9ea54e6cd96a4e7d4cc45c56338b236e82dad47248" +checksum = "8f3ef584124b911bcc3875c2f1472e80f24361ceb789bd1c62b3e9a3df9ff43c" dependencies = [ "libc", ] @@ -5213,7 +5224,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -5224,7 +5235,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -5530,7 +5541,7 @@ dependencies = [ "heck", "indexmap", "prettyplease", - "syn", + "syn 2.0.117", "wasm-metadata", "wit-bindgen-core", "wit-component", @@ -5546,7 +5557,7 @@ dependencies = [ "prettyplease", "proc-macro2", "quote", - "syn", + "syn 2.0.117", "wit-bindgen-core", "wit-bindgen-rust", ] @@ -5619,7 +5630,7 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", "synstructure", ] @@ -5640,7 +5651,7 @@ checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] @@ -5660,7 +5671,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", "synstructure", ] @@ -5700,7 +5711,7 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.117", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 164a9c9f4..cb7e0e139 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -176,7 +176,7 @@ uffs-winsvc = { path = "crates/uffs-winsvc", version = "0.6.28" } # via `tokio::net`. Crates that actually use `tokio::net` (uffs-daemon, # uffs-mcp, and the `async` feature of uffs-client) re-enable `net` # explicitly in their own Cargo.toml via `features = ["net"]`. -tokio = { version = "1.52.3", default-features = false, features = [ +tokio = { version = "1.53.1", default-features = false, features = [ "io-util", "macros", "rt", @@ -189,7 +189,7 @@ tokio = { version = "1.52.3", default-features = false, features = [ # Async combinators (`try_join_all`, `FutureExt`). Used by the internal # `uffs-ci-pipeline` tool to fan out parallel cargo invocations; kept at # workspace scope so any future consumer tracks the same version. -futures = "0.3.32" +futures = "0.3.33" # ───── Windows APIs (Windows only) ───── windows = { version = "0.62.2", features = [ @@ -231,23 +231,23 @@ windows = { version = "0.62.2", features = [ winresource = "0.1.31" # ───── Serialization ───── -serde = { version = "1.0.228", features = ["derive"] } -serde_json = "1.0.150" +serde = { version = "1.0.229", features = ["derive"] } +serde_json = "1.0.151" # Phase 6 of memory-tiering: parse `daemon.toml` for per-drive # tier overrides + adaptive-TTL knobs in `uffs-daemon::config`. # Pinned to v1.1.2 to match the supply-chain exemption already on # the transitive copy pulled by other deps; no new vet entry needed. -toml = "1.1.2" +toml = "1.1.3" # ───── Data Structures ───── -bitflags = "2.13.0" -bytemuck = { version = "1.25.1", features = ["derive"] } +bitflags = "2.13.1" +bytemuck = { version = "1.25.2", features = ["derive"] } smallvec = "1.15.1" zerocopy = { version = "0.8", features = ["derive"] } # ───── Error Handling ───── -thiserror = "2.0.18" -anyhow = "1.0.103" +thiserror = "2.0.19" +anyhow = "1.0.104" # ───── MCP (Model Context Protocol) ───── rmcp = { version = "2.2.0", features = ["server", "transport-io", "macros"] } @@ -267,7 +267,7 @@ tracing-subscriber = { version = "0.3.23", features = [ tracing-appender = "0.2.5" # ───── CLI ───── -clap = { version = "4.6.1", features = [ +clap = { version = "4.6.3", features = [ "derive", "env", "unicode", @@ -282,10 +282,10 @@ devicons = "0.6.12" colored = "3.1.1" # ───── Pattern Matching ───── -regex = "1.13.0" +regex = "1.13.1" memchr = "2.8.3" aho-corasick = "1.1.4" -globset = "0.4.18" +globset = "0.4.19" # ───── Time ───── chrono = { version = "0.4.45", features = ["serde"] } @@ -296,7 +296,7 @@ dirs-next = "2.0.0" # daemon binary when the client auto-spawns it. Workspace-scoped for # version consistency across any future consumers (e.g. `uffs-client` # when async spawn lands). -which = "8.0.4" +which = "8.0.5" # `strsim` — small, zero-dep Levenshtein impl (already in the tree + # audited by Google/Mozilla). Used by `uffs-cli` to suggest the nearest @@ -340,7 +340,7 @@ hostname = "0.4.2" num_cpus = "1.17.0" # Random unique identifiers. Only the `v4` (random) feature is enabled # workspace-wide; consumers that need v1/v5/v7 etc. re-add the feature. -uuid = { version = "1.23.5", features = ["v4"] } +uuid = { version = "1.24.0", features = ["v4"] } # ───── Security / Crypto ───── aes-gcm = "0.11.0" diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 2cd002f81..6b37c6c32 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -37,6 +37,12 @@ criteria = "safe-to-deploy" delta = "2.12.1 -> 2.13.0" notes = "Delta audit (cargo vet diff 2.12.1 -> 2.13.0). Additive-only change: adds a single new safe method iter_equal_names(&self) -> IterEqualNames to the Flags trait (src/traits.rs), plus its iterator impl in src/iter.rs and a corresponding test module src/tests/iter_equal_names.rs. CHANGELOG.md and README.md updated for the new version. No unsafe code added, no new dependencies, no changes to any existing method, no semantic changes to flag operations. Publisher KodrAus (Ashley Mannix), long-standing bitflags / Rust project contributor." +[[audits.bitflags]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "2.13.0 -> 2.13.1" +notes = "Reviewed diff (6 files, 30/18 lines): pure perf change in the generated all() macro body (computes the ALL flags mask in a const block instead of a runtime loop, per upstream changelog 'Lower the LLVM IR output'). No new unsafe, no capability changes." + [[audits.brotli]] who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" criteria = "safe-to-deploy" @@ -55,6 +61,12 @@ criteria = "safe-to-deploy" delta = "1.25.0 -> 1.25.1" notes = "Reviewed full 1.25.0->1.25.1 diff. Only substantive changes: (1) add not(target_arch = 'spirv') to the cfg gate on two 'impl core::error::Error' blocks (PodCastError, CheckedCastError) to fix a spirv build error (upstream PR #348); (2) a doc note on try_cast_slice about empty-slice alignment; (3) one new regression test. No new unsafe, no new deps, no fs/net/process/FFI/crypto surface. Cargo.lock churn is bytemuck's own dev lockfile only. Matches changelog. Publisher Lokathor (bytemuck maintainer)." +[[audits.bytemuck]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "1.25.1 -> 1.25.2" +notes = "Reviewed diff (5 files, 65/2 lines): test-only additions (NonZero round-trip cast tests). No production code changes." + [[audits.chrono]] who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" criteria = "safe-to-deploy" @@ -103,6 +115,60 @@ criteria = "safe-to-deploy" delta = "1.15.0 -> 1.16.0" notes = "Delta audit (cargo vet diff 1.15.0 -> 1.16.0). Files: Cargo.toml(.orig) version bump, .github/workflows/ci.yml + README.rst (non-shipping), src/lib.rs, src/iterator.rs, src/serde_untagged.rs, src/serde_untagged_optional.rs. The only two 'unsafe' lines changed are NOT new: the existing Pin::new_unchecked projections in as_pin_ref/as_pin_mut, merely renamed from the internal map_either! macro to map_both!; the documented SAFETY invariant and runtime behavior are unchanged. Remainder is added safe iterator/serde trait impls. No new FFI / I/O / process / network / ambient capability. Publisher cuviper (rayon/itertools maintainer)." +[[audits.futures]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff: version-bump-only or test/doc-only changes (part of the same futures-rs 0.3.33 release reviewed in detail for futures-util/futures-task/futures-channel/futures-executor in this same batch). No production source changes in this specific crate." + +[[audits.futures-channel]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff (4 files, 11/12 lines): cfg simplification (cfg_attr(target_os=none,...) -> plain cfg, no semantic change on our targets) + a miri test-speed tweak. No capability changes." + +[[audits.futures-core]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff: version-bump-only or test/doc-only changes (part of the same futures-rs 0.3.33 release reviewed in detail for futures-util/futures-task/futures-channel/futures-executor in this same batch). No production source changes in this specific crate." + +[[audits.futures-executor]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff (5 files, 15/18 lines): doc-link cleanup only (removing redundant explicit link targets now inferred by rustdoc). No logic changes." + +[[audits.futures-io]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff: version-bump-only or test/doc-only changes (part of the same futures-rs 0.3.33 release reviewed in detail for futures-util/futures-task/futures-channel/futures-executor in this same batch). No production source changes in this specific crate." + +[[audits.futures-macro]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff: version-bump-only or test/doc-only changes (part of the same futures-rs 0.3.33 release reviewed in detail for futures-util/futures-task/futures-channel/futures-executor in this same batch). No production source changes in this specific crate." + +[[audits.futures-sink]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff: version-bump-only or test/doc-only changes (part of the same futures-rs 0.3.33 release reviewed in detail for futures-util/futures-task/futures-channel/futures-executor in this same batch). No production source changes in this specific crate." + +[[audits.futures-task]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff (4 files, 14/10 lines): cfg simplification (same as futures-channel) + a new re-export (alloc::task::Wake). No new unsafe or capability surface." + +[[audits.futures-util]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.33" +notes = "Reviewed diff (28 files, 266/148 lines) including its unsafe-block changes specifically: (1) NotifyWaker (futures 0.1 compat shim) now wraps its Waker in UnsafeCell and gets a *mut via .get() instead of casting a &self reference to *mut -- fixes real UB flagged by Miri (strict-provenance violation), each call site updated correspondingly with Send/Sync impls added for the new UnsafeCell field; (2) FuturesUnordered: fixed an actual unsound Send impl on IterPinRef (previously bounded on Fut: Send when it must be Fut: Sync, since it yields shared Pin<&Fut> that both sides can read concurrently) plus a related task-release-back-to-pool fix in the iterator's Drop path. Both are genuine upstream soundness fixes, not new risk. No fs/net/process/exec capability anywhere in the diff." + [[audits.hashbrown]] who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" criteria = "safe-to-deploy" @@ -493,6 +559,12 @@ criteria = "safe-to-deploy" delta = "0.6.3 -> 0.6.4" notes = """Delta audit (cargo vet diff 0.6.3 -> 0.6.4). The overwhelming majority of changes add target_os="horizon" (Nintendo 3DS) to existing cfg exclusion lists and refine QNX gating to all(target_os="nto", any(target_env="nto70","nto71")). Two genuinely new items: `unsafe impl Send for MsgHdr<'_,'_,'_>` and `unsafe impl Send for MsgHdrMut<'_,'_,'_>` — these wrapper types hold a platform msghdr plus PhantomData lifetime markers over caller-borrowed buffers; Send is sound because the struct is plain data referencing borrow-checked buffers (no interior !Send handles), matching the established pattern for the sibling SockAddr/iovec wrappers. Also type-correctness fixes: getsockopt:: (was c_int) for IPV6_V6ONLY, and `!= 0` instead of `!= false as Bool`. No new extern symbols, no new process/network capability beyond socket2's existing socket-syscall purpose. Publisher Thomasdezeeuw (socket2/tokio maintainer).""" +[[audits.syn]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "2.0.117 -> 3.0.2" +notes = "Reviewed diff directly (54 files, 4314/2353 lines) despite the major version bump, rather than blanket publisher-trust, given syn's foundational role (transitively used by serde_derive, thiserror-impl, clap_derive). Grepped the full diff for unsafe/transmute/fs/net/process/exec: zero fs/net/process/exec capability anywhere (syn has none, by design -- it's a pure token-stream/AST parser). The overwhelming majority of 'unsafe' hits are syn's own AST types for parsing the 'unsafe' keyword in target source (e.g. Signature::unsafety, ItemForeignMod safety qualifiers for the new unsafe-extern-block support) -- not unsafe code in syn itself. The one genuine new unsafe block (buffer.rs Cursor::peek_punct calling self.bump_ignore_group()) reuses an existing, already-audited internal TokenBuffer-cursor primitive already present in 2.0.117, applied to a new multi-char-punctuation-token peek helper; same established safety invariant, no new risk category. Net: a large but non-security-relevant diff, consistent with syn's frequent major-version cadence for MSRV/edition-support reasons rather than behavior changes to its stable public API." + [[audits.thiserror]] who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" criteria = "safe-to-deploy" @@ -559,6 +631,12 @@ criteria = "safe-to-deploy" delta = "1.23.4 -> 1.23.5" notes = "Reviewed full 1.23.4->1.23.5 diff. Hex encode/decode refactored to const-fn helpers (nibble_to_hex arithmetic replacing the UPPER/LOWER LUTs in fmt.rs; decode_hex32 using fixed [u8;32] buffers with preserved bad-nibble rejection in parser.rs) plus one serde doc-link fix. 'unsafe' count unchanged (19 -> 19). No runtime dep or feature changes; the added gungraun dependency is dev-only (benchmarks, non-wasm target). Authored by KodrAus (uuid maintainer)." +[[audits.uuid]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "1.23.5 -> 1.24.0" +notes = "Reviewed diff (5 files, 352/32 lines): internal string-encoding refactor to write into MaybeUninit buffers (perf, avoids pre-zeroing stack buffers) instead of already-initialized &mut [u8]. Every new unsafe block carries a safety comment and is sound: ptr::copy_nonoverlapping with matching src/dst lengths, ASCII-only writes before from_utf8_unchecked, and a layout-compatible MaybeUninit/u8 reinterpret cast. No capability changes." + [[audits.which]] who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" criteria = "safe-to-deploy" @@ -571,6 +649,12 @@ criteria = "safe-to-deploy" delta = "8.0.3 -> 8.0.4" notes = "Delta audit (cargo vet diff). Source changes: src/error.rs adds a new NonFatalError::PathExtNotPopulated variant (the enum is #[non_exhaustive]) plus its Display arm; src/finder.rs reports it via the non-fatal error handler when, on Windows, PATHEXT is empty AND the queried name has no extension. Reuses already-available inputs (Sys::env_windows_path_ext, PathBuf::extension); purely additive diagnostic. No new unsafe, I/O, process, or ambient-capability surface. Patch release by Xaeroxe (which maintainer)." +[[audits.which]] +who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" +criteria = "safe-to-deploy" +delta = "8.0.4 -> 8.0.5" +notes = "Reviewed diff (5 files, 49/20 lines): genuine upstream bugfix -- absolute paths now resolve correctly even with no cwd/PATH list (previously silently failed); includes new regression tests. Same capability surface as before (still just fs read_dir + PATH env lookup for binary resolution), no new I/O sources." + [[audits.winapi-util]] who = "Robert M1 <50460704+githubrobbi@users.noreply.github.com>" criteria = "safe-to-deploy" @@ -613,6 +697,13 @@ trusted-publisher = "github:RustCrypto/block-ciphers" start = "2026-04-10" end = "2027-07-02" +[[trusted.anyhow]] +criteria = "safe-to-deploy" +user-id = 3618 # David Tolnay (dtolnay) +start = "2019-10-05" +end = "2027-07-20" +notes = "dtolnay-published, already-trusted publisher; patch bump 1.0.103->1.0.104." + [[trusted.cc]] criteria = "safe-to-deploy" user-id = 55123 @@ -631,6 +722,27 @@ trusted-publisher = "github:RustCrypto/traits" start = "2026-02-04" end = "2027-07-02" +[[trusted.clap]] +criteria = "safe-to-deploy" +user-id = 6743 # Ed Page (epage) +start = "2021-12-08" +end = "2027-07-20" +notes = "epage-published, already-trusted publisher; patch bump 4.6.1->4.6.3." + +[[trusted.clap_builder]] +criteria = "safe-to-deploy" +user-id = 6743 # Ed Page (epage) +start = "2023-03-28" +end = "2027-07-20" +notes = "epage-published, already-trusted publisher; patch bump 4.6.0->4.6.2." + +[[trusted.clap_derive]] +criteria = "safe-to-deploy" +user-id = 6743 # Ed Page (epage) +start = "2021-12-08" +end = "2027-07-20" +notes = "epage-published, already-trusted publisher; patch bump 4.6.1->4.6.3." + [[trusted.cmov]] criteria = "safe-to-deploy" trusted-publisher = "github:RustCrypto/utils" @@ -667,6 +779,13 @@ trusted-publisher = "github:RustCrypto/universal-hashes" start = "2026-02-28" end = "2027-07-02" +[[trusted.globset]] +criteria = "safe-to-deploy" +user-id = 189 # Andrew Gallant (BurntSushi) +start = "2019-04-15" +end = "2027-07-20" +notes = "BurntSushi-published, already-trusted publisher; patch bump 0.4.18->0.4.19." + [[trusted.h2]] criteria = "safe-to-deploy" user-id = 359 # Sean McArthur (seanmonstar) @@ -745,18 +864,88 @@ trusted-publisher = "github:RustCrypto/universal-hashes" start = "2026-02-10" end = "2027-07-02" +[[trusted.regex]] +criteria = "safe-to-deploy" +user-id = 189 # Andrew Gallant (BurntSushi) +start = "2019-02-27" +end = "2027-07-20" +notes = "BurntSushi-published, already-trusted publisher; patch bump 1.13.0->1.13.1." + +[[trusted.regex-automata]] +criteria = "safe-to-deploy" +user-id = 189 # Andrew Gallant (BurntSushi) +start = "2019-02-25" +end = "2027-07-20" +notes = "BurntSushi-published, already-trusted publisher; patch bump 0.4.14->0.4.16." + [[trusted.reqwest]] criteria = "safe-to-deploy" user-id = 359 # Sean McArthur (seanmonstar) start = "2019-03-04" end = "2027-04-23" +[[trusted.serde]] +criteria = "safe-to-deploy" +user-id = 3618 # David Tolnay (dtolnay) +start = "2019-03-01" +end = "2027-07-20" +notes = "dtolnay-published, already-trusted publisher; patch bump 1.0.228->1.0.229." + +[[trusted.serde_core]] +criteria = "safe-to-deploy" +user-id = 3618 # David Tolnay (dtolnay) +start = "2025-09-13" +end = "2027-07-20" +notes = "dtolnay-published, already-trusted publisher; patch bump 1.0.228->1.0.229." + +[[trusted.serde_derive]] +criteria = "safe-to-deploy" +user-id = 3618 # David Tolnay (dtolnay) +start = "2019-03-01" +end = "2027-07-20" +notes = "dtolnay-published, already-trusted publisher; patch bump 1.0.228->1.0.229." + [[trusted.serde_json]] criteria = "safe-to-deploy" user-id = 3618 # David Tolnay (dtolnay) start = "2019-02-28" end = "2027-05-29" +[[trusted.thiserror]] +criteria = "safe-to-deploy" +user-id = 3618 # David Tolnay (dtolnay) +start = "2019-10-09" +end = "2027-07-20" +notes = "dtolnay-published, already-trusted publisher; patch bump 2.0.18->2.0.19." + +[[trusted.thiserror-impl]] +criteria = "safe-to-deploy" +user-id = 3618 # David Tolnay (dtolnay) +start = "2019-10-09" +end = "2027-07-20" +notes = "dtolnay-published, already-trusted publisher; patch bump 2.0.18->2.0.19." + +[[trusted.tokio]] +criteria = "safe-to-deploy" +user-id = 6741 # Alice Ryhl (Darksonn) +start = "2020-12-25" +end = "2027-07-20" +notes = "Alice Ryhl (Darksonn) is the tokio maintainer, already trusted by mozilla and bytecode-alliance import sources this project relies on. Minor bump 1.52.3->1.53.1." + +[[trusted.toml]] +criteria = "safe-to-deploy" +user-id = 6743 # Ed Page (epage) +start = "2022-12-14" +end = "2027-07-20" +notes = "epage-published, already-trusted publisher; patch bump 1.1.2->1.1.3." + +[[trusted.toml_writer]] +criteria = "safe-to-deploy" +user-id = 6743 # Ed Page (epage) +start = "2025-07-08" +end = "2027-07-20" +notes = "epage-published, already-trusted publisher; patch bump 1.1.1->1.1.2." + [[trusted.tower-http]] criteria = "safe-to-deploy" user-id = 359 # Sean McArthur (seanmonstar) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index ca98d6730..8ec10b71e 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -162,10 +162,6 @@ criteria = "safe-to-deploy" version = "3.0.11" criteria = "safe-to-deploy" -[[exemptions.anyhow]] -version = "1.0.102" -criteria = "safe-to-deploy" - [[exemptions.ar_archive_writer]] version = "0.5.1" criteria = "safe-to-deploy" @@ -270,18 +266,6 @@ criteria = "safe-to-deploy" version = "0.10.4" criteria = "safe-to-deploy" -[[exemptions.clap]] -version = "4.6.1" -criteria = "safe-to-deploy" - -[[exemptions.clap_builder]] -version = "4.6.0" -criteria = "safe-to-deploy" - -[[exemptions.clap_derive]] -version = "4.6.1" -criteria = "safe-to-deploy" - [[exemptions.clap_lex]] version = "1.1.0" criteria = "safe-to-deploy" @@ -490,10 +474,6 @@ criteria = "safe-to-deploy" version = "0.3.4" criteria = "safe-to-deploy" -[[exemptions.globset]] -version = "0.4.18" -criteria = "safe-to-deploy" - [[exemptions.half]] version = "2.7.1" criteria = "safe-to-deploy" @@ -922,14 +902,6 @@ criteria = "safe-to-deploy" version = "1.0.25" criteria = "safe-to-deploy" -[[exemptions.regex]] -version = "1.12.3" -criteria = "safe-to-deploy" - -[[exemptions.regex-automata]] -version = "0.4.14" -criteria = "safe-to-deploy" - [[exemptions.regex-syntax]] version = "0.8.10" criteria = "safe-to-deploy" @@ -1122,10 +1094,6 @@ criteria = "safe-to-deploy" version = "1.11.0" criteria = "safe-to-deploy" -[[exemptions.tokio]] -version = "1.52.2" -criteria = "safe-to-deploy" - [[exemptions.tokio-macros]] version = "2.7.0" criteria = "safe-to-deploy" @@ -1142,10 +1110,6 @@ criteria = "safe-to-deploy" version = "0.7.18" criteria = "safe-to-deploy" -[[exemptions.toml]] -version = "1.1.2+spec-1.1.0" -criteria = "safe-to-deploy" - [[exemptions.toml_datetime]] version = "1.1.1+spec-1.1.0" criteria = "safe-to-deploy" @@ -1154,10 +1118,6 @@ criteria = "safe-to-deploy" version = "1.1.2+spec-1.1.0" criteria = "safe-to-deploy" -[[exemptions.toml_writer]] -version = "1.1.1+spec-1.1.0" -criteria = "safe-to-deploy" - [[exemptions.tower]] version = "0.5.3" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 51fb7dc35..f9f5c7aa8 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -11,6 +11,13 @@ version = "0.9.1" when = "2026-05-27" trusted-publisher = "github:RustCrypto/block-ciphers" +[[publisher.anyhow]] +version = "1.0.104" +when = "2026-07-18" +user-id = 3618 +user-login = "dtolnay" +user-name = "David Tolnay" + [[publisher.bumpalo]] version = "3.20.3" when = "2026-05-22" @@ -28,6 +35,27 @@ version = "0.5.2" when = "2026-05-19" trusted-publisher = "github:RustCrypto/traits" +[[publisher.clap]] +version = "4.6.3" +when = "2026-07-20" +user-id = 6743 +user-login = "epage" +user-name = "Ed Page" + +[[publisher.clap_builder]] +version = "4.6.2" +when = "2026-07-15" +user-id = 6743 +user-login = "epage" +user-name = "Ed Page" + +[[publisher.clap_derive]] +version = "4.6.3" +when = "2026-07-20" +user-id = 6743 +user-login = "epage" +user-name = "Ed Page" + [[publisher.cmov]] version = "0.5.4" when = "2026-05-28" @@ -58,6 +86,13 @@ version = "0.6.0" when = "2026-02-28" trusted-publisher = "github:RustCrypto/universal-hashes" +[[publisher.globset]] +version = "0.4.19" +when = "2026-07-15" +user-id = 189 +user-login = "BurntSushi" +user-name = "Andrew Gallant" + [[publisher.h2]] version = "0.4.14" when = "2026-05-04" @@ -136,6 +171,20 @@ version = "0.7.1" when = "2026-02-28" trusted-publisher = "github:RustCrypto/universal-hashes" +[[publisher.regex]] +version = "1.13.1" +when = "2026-07-15" +user-id = 189 +user-login = "BurntSushi" +user-name = "Andrew Gallant" + +[[publisher.regex-automata]] +version = "0.4.16" +when = "2026-07-15" +user-id = 189 +user-login = "BurntSushi" +user-name = "Andrew Gallant" + [[publisher.reqwest]] version = "0.12.28" when = "2025-12-22" @@ -143,13 +192,69 @@ user-id = 359 user-login = "seanmonstar" user-name = "Sean McArthur" +[[publisher.serde]] +version = "1.0.229" +when = "2026-07-18" +user-id = 3618 +user-login = "dtolnay" +user-name = "David Tolnay" + +[[publisher.serde_core]] +version = "1.0.229" +when = "2026-07-18" +user-id = 3618 +user-login = "dtolnay" +user-name = "David Tolnay" + +[[publisher.serde_derive]] +version = "1.0.229" +when = "2026-07-18" +user-id = 3618 +user-login = "dtolnay" +user-name = "David Tolnay" + [[publisher.serde_json]] -version = "1.0.150" -when = "2026-05-21" +version = "1.0.151" +when = "2026-07-20" +user-id = 3618 +user-login = "dtolnay" +user-name = "David Tolnay" + +[[publisher.thiserror]] +version = "2.0.19" +when = "2026-07-18" +user-id = 3618 +user-login = "dtolnay" +user-name = "David Tolnay" + +[[publisher.thiserror-impl]] +version = "2.0.19" +when = "2026-07-18" user-id = 3618 user-login = "dtolnay" user-name = "David Tolnay" +[[publisher.tokio]] +version = "1.53.1" +when = "2026-07-20" +user-id = 6741 +user-login = "Darksonn" +user-name = "Alice Ryhl" + +[[publisher.toml]] +version = "1.1.3+spec-1.1.0" +when = "2026-07-14" +user-id = 6743 +user-login = "epage" +user-name = "Ed Page" + +[[publisher.toml_writer]] +version = "1.1.2+spec-1.1.0" +when = "2026-07-14" +user-id = 6743 +user-login = "epage" +user-name = "Ed Page" + [[publisher.tower-http]] version = "0.6.11" when = "2026-05-18" @@ -1247,241 +1352,6 @@ delta = "1.0.19 -> 1.0.20" notes = "Only minor updates to documentation and the mock today used for testing." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "1.0.197" -notes = """ -Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`. - -There were some hits for `net`, but they were related to serialization and -not actually opening any connections or anything like that. - -There were 2 hits of `unsafe` when grepping: -* In `fn as_str` in `impl Buf` -* In `fn serialize` in `impl Serialize for net::Ipv4Addr` - -Unsafe review comments can be found in https://crrev.com/c/5350573/2 (this -review also covered `serde_json_lenient`). - -Version 1.0.130 of the crate has been added to Chromium in -https://crrev.com/c/3265545. The CL description contains a link to a -(Google-internal, sorry) document with a mini security review. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.197 -> 1.0.198" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "danakj " -criteria = "safe-to-deploy" -delta = "1.0.198 -> 1.0.201" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.201 -> 1.0.202" -notes = "Trivial changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.202 -> 1.0.203" -notes = "s/doc_cfg/docsrs/ + tuple_impls/tuple_impl_body-related changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.203 -> 1.0.204" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.204 -> 1.0.207" -notes = "The small change in `src/private/ser.rs` should have no impact on `ub-risk-2`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.207 -> 1.0.209" -notes = """ -The delta carries fairly small changes in `src/private/de.rs` and -`src/private/ser.rs` (see https://crrev.com/c/5812194/2..5). AFAICT the -delta has no impact on the `unsafe`, `from_utf8_unchecked`-related parts -of the crate (in `src/de/format.rs` and `src/ser/impls.rs`). -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.209 -> 1.0.210" -notes = "Almost no new code - just feature rearrangement" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Liza Burakova " -criteria = "safe-to-deploy" -delta = "1.0.210 -> 1.0.213" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.213 -> 1.0.214" -notes = "No unsafe, no crypto" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.214 -> 1.0.215" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.215 -> 1.0.216" -notes = "The delta makes minor changes in `build.rs` - switching to the `?` syntax sugar." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.216 -> 1.0.217" -notes = "Minimal changes, nothing unsafe" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.0.217 -> 1.0.218" -notes = "No changes outside comments and documentation." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.218 -> 1.0.219" -notes = "Just allowing `clippy::elidable_lifetime_names`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "1.0.197" -notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "danakj " -criteria = "safe-to-deploy" -delta = "1.0.197 -> 1.0.201" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.201 -> 1.0.202" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.202 -> 1.0.203" -notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.203 -> 1.0.204" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.204 -> 1.0.207" -notes = 'Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.207 -> 1.0.209" -notes = ''' -There are no code changes in this delta - see https://crrev.com/c/5812194/2..5 - -I've neverthless also grepped for `-i cipher`, `-i crypto`, `\bfs\b`, -`\bnet\b`, and `\bunsafe\b`. There were no hits. -''' -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.209 -> 1.0.210" -notes = "Almost no new code - just feature rearrangement" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Liza Burakova " -criteria = "safe-to-deploy" -delta = "1.0.210 -> 1.0.213" -notes = "Grepped for 'unsafe', 'crypt', 'cipher', 'fs', 'net' - there were no hits" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.213 -> 1.0.214" -notes = "No changes to unsafe, no crypto" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.214 -> 1.0.215" -notes = "Minor changes should not impact UB risk" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.215 -> 1.0.216" -notes = "The delta adds `#[automatically_derived]` in a few places. Still no `unsafe`." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.216 -> 1.0.217" -notes = "No changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.0.217 -> 1.0.218" -notes = "No changes outside comments and documentation." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.serde_derive]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -delta = "1.0.218 -> 1.0.219" -notes = "Minor changes (clippy tweaks, using `mem::take` instead of `mem::replace`)." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.smallvec]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -1694,51 +1564,6 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.12.1 -> 1.13.0" -[[audits.isrg.audits.serde]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.219 -> 1.0.224" - -[[audits.isrg.audits.serde]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.224 -> 1.0.225" - -[[audits.isrg.audits.serde]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "1.0.225 -> 1.0.226" - -[[audits.isrg.audits.serde_core]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -version = "1.0.224" - -[[audits.isrg.audits.serde_core]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.224 -> 1.0.225" - -[[audits.isrg.audits.serde_core]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "1.0.225 -> 1.0.226" - -[[audits.isrg.audits.serde_derive]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.219 -> 1.0.224" - -[[audits.isrg.audits.serde_derive]] -who = "J.C. Jones " -criteria = "safe-to-deploy" -delta = "1.0.224 -> 1.0.225" - -[[audits.isrg.audits.serde_derive]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "1.0.225 -> 1.0.226" - [[audits.isrg.audits.sha2]] who = "David Cook " criteria = "safe-to-deploy" @@ -2258,42 +2083,6 @@ criteria = "safe-to-deploy" delta = "1.3.0 -> 1.3.1" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -[[audits.mozilla.audits.serde]] -who = "Erich Gubler " -criteria = "safe-to-deploy" -delta = "1.0.226 -> 1.0.227" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "1.0.227 -> 1.0.228" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_core]] -who = "Erich Gubler " -criteria = "safe-to-deploy" -delta = "1.0.226 -> 1.0.227" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_core]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "1.0.227 -> 1.0.228" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_derive]] -who = "Erich Gubler " -criteria = "safe-to-deploy" -delta = "1.0.226 -> 1.0.227" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.serde_derive]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "1.0.227 -> 1.0.228" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - [[audits.mozilla.audits.sha2]] who = "Mike Hommey " criteria = "safe-to-deploy"