From b6baacb04e63b4a107328bd365b8069efc921d8b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 00:44:42 +0000 Subject: [PATCH 1/3] chore(deps): bump the rust-dependencies group across 1 directory with 6 updates Bumps the rust-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [insta](https://github.com/mitsuhiko/insta) | `1.48.0` | `1.49.0` | | [pyo3](https://github.com/pyo3/pyo3) | `0.29.2` | `0.29.3` | | [napi](https://github.com/napi-rs/napi-rs) | `3.13.0` | `3.14.0` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.9` | `3.6.10` | | [napi-build](https://github.com/napi-rs/napi-rs) | `2.5.0` | `2.6.0` | Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.53.1...tokio-1.53.2) Updates `insta` from 1.48.0 to 1.49.0 - [Release notes](https://github.com/mitsuhiko/insta/releases) - [Changelog](https://github.com/mitsuhiko/insta/blob/master/CHANGELOG.md) - [Commits](https://github.com/mitsuhiko/insta/compare/1.48.0...1.49.0) Updates `pyo3` from 0.29.2 to 0.29.3 - [Release notes](https://github.com/pyo3/pyo3/releases) - [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md) - [Commits](https://github.com/pyo3/pyo3/compare/v0.29.2...v0.29.3) Updates `napi` from 3.13.0 to 3.14.0 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-v3.13.0...napi-v3.14.0) Updates `napi-derive` from 3.6.9 to 3.6.10 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-derive-v3.6.9...napi-derive-v3.6.10) Updates `napi-build` from 2.5.0 to 2.6.0 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-build-v2.5.0...napi-build-v2.6.0) --- updated-dependencies: - dependency-name: insta dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: napi dependency-version: 3.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: napi-build dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: napi-derive dependency-version: 3.6.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: pyo3 dependency-version: 0.29.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] --- Cargo.lock | 66 +++++++++++++++++++++++++++--------------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 9a5aa6713..1aba128f5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -976,7 +976,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1705,7 +1705,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2547,9 +2547,9 @@ dependencies = [ [[package]] name = "insta" -version = "1.48.0" +version = "1.49.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82" +checksum = "b67d3d2e287e4b86c10b3f3b641033d1f89b74bdb39d05f34952e2b9a6fe21cd" dependencies = [ "console", "once_cell", @@ -3187,9 +3187,9 @@ dependencies = [ [[package]] name = "napi" -version = "3.13.0" +version = "3.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b12638855cec016784a7e17cc4ecbdee7ca8b0a3456aa50640d0ee5ed1a42f8" +checksum = "15301c22171e8397a7b17beb3c75bf486bf67ca3bdad8ea347835b770df61969" dependencies = [ "bitflags 2.13.2", "ctor", @@ -3204,42 +3204,42 @@ dependencies = [ [[package]] name = "napi-build" -version = "2.5.0" +version = "2.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0941983559cd62bfa7f04646a16428967a847365adeef27711e4e3927046bbed" +checksum = "b899b545d3aa6dca985939059f258c5488d34e4ecf39c274e20009748f4b846d" [[package]] name = "napi-derive" -version = "3.6.9" +version = "3.6.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b1d232c24dc6754979b27efdf2047a5849efc7c92c1245de87e6bedbb9f5c3c" +checksum = "92cec6048ac04041ac8055bdce1ec4f353416cd443ba9222bf73af790c3d4495" dependencies = [ "convert_case", "ctor", "napi-derive-backend", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", ] [[package]] name = "napi-derive-backend" -version = "6.1.4" +version = "6.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fd6856fe1686867da90ed0dc292d7c0c87a695eb7c578b913360f33619ee01e3" +checksum = "fae2444f4ba7333754bb73414ff8059dec2cb23b83a95bd1a0bf08169eed1be0" dependencies = [ "convert_case", "proc-macro2", "quote", "semver", - "syn 2.0.119", + "syn 3.0.6", ] [[package]] name = "napi-sys" -version = "3.3.2" +version = "3.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6801fc65ba4d7035636e93635e281113f00410401a237dcd4f55b1565ead2115" +checksum = "e22a4f25c16a5c5411d987cd6fbd48313522ae1789ade2d6dd3efdc6d40a0fc8" dependencies = [ "libloading 0.9.0", ] @@ -4143,9 +4143,9 @@ dependencies = [ [[package]] name = "pyo3" -version = "0.29.2" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b" +checksum = "700d18fa267b73b9b521fd7e13580e2f446916f176cacee1ab63fcc8191f1655" dependencies = [ "libc", "num-bigint 0.4.8", @@ -4173,18 +4173,18 @@ dependencies = [ [[package]] name = "pyo3-build-config" -version = "0.29.2" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9" +checksum = "7b3fc0c4d08f6bb10e71fe39dfb9e2f59c6eb6854e22ec8092f50c69a4499adb" dependencies = [ "target-lexicon", ] [[package]] name = "pyo3-ffi" -version = "0.29.2" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327" +checksum = "dfc0b8e19df29aad7086cf977bb0c2a2f143e30567eb113e9cf72b62ca698330" dependencies = [ "libc", "pyo3-build-config", @@ -4192,9 +4192,9 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.29.2" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c" +checksum = "6100e8a4b5eba53afaa5ed078364851a0b2499c553a44c31026b929049b49dc6" dependencies = [ "proc-macro2", "pyo3-macros-backend", @@ -4204,9 +4204,9 @@ dependencies = [ [[package]] name = "pyo3-macros-backend" -version = "0.29.2" +version = "0.29.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952" +checksum = "6143877a16e82b5a727b7127ff4cd86858a24a28d745d72f43e6f227c7b1bdb3" dependencies = [ "heck", "proc-macro2", @@ -4773,7 +4773,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4831,7 +4831,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5573,10 +5573,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5691,9 +5691,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.1" +version = "1.53.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" dependencies = [ "bytes", "libc", @@ -6663,7 +6663,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] From 571387b94b51b423298420d098532a2fbd4fc533 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Tue, 6 Oct 2026 23:24:15 -0500 Subject: [PATCH 2/3] chore(deps): audit updated Rust dependency sources Co-Authored-By: yolop --- supply-chain/audits.toml | 72 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index b04511698..9e14c3eef 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -226,6 +226,12 @@ criteria = "safe-to-deploy" delta = "2.14.0 -> 2.14.2" notes = "Reviewed disjoint mutable references: all indices bounds-checked and duplicates excluded before references formed. Lifetimes preserved, centralized assertions, exact-key Eq and safe constructor insertions. No ambient changes." +[[audits.insta]] +who = "Mykhailo Chalyi " +criteria = "safe-to-run" +delta = "1.48.0 -> 1.49.0" +notes = "Reviewed registry delta: escaped unit-variant JSON map keys, OsStr snapshot names, macro trailing-semicolon fixes and update hints; regression tests included. No new execution or unsafe code." + [[audits.iri-string]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -317,6 +323,12 @@ criteria = "safe-to-deploy" delta = "3.12.7 -> 3.13.0" notes = "External now checks a native-payload registry before casting the tagged object, turning a type-confusion cast into an InvalidArg error, and frees obj_ptr/size_hint_ptr when napi_wrap fails. Remaining additions are the wasm-only two-phase env-cleanup exports. New unsafe stays inside the existing NAPI FFI idiom and is now better guarded; the only std::process uses are abort() guards against unwinding across the FFI boundary. No new fs or net access." +[[audits.napi]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.13.0 -> 3.14.0" +notes = "Reviewed registry delta including new WASI heap-break arithmetic and allocator wrappers: serialized allocator access, checked page growth below 2 GiB, target-gated shared-memory refresh and crash reporting. Native handoff is a no-op; allocator tests cover overflow and growth failures." + [[audits.napi-build]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -329,6 +341,12 @@ criteria = "safe-to-deploy" delta = "2.4.4 -> 2.5.0" notes = "Adds the napi_wasi_threads cfg via rustc-check-cfg plus an exact-triple rustc-cfg for wasm32-wasip1-threads, and three --export-if-defined link args for the two-phase wasm env-cleanup entry points. Build script only prints cargo directives; no fs or net access." +[[audits.napi-build]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "2.5.0 -> 2.6.0" +notes = "Reviewed target-gated linker wrapping and feature/rustflag detection. Bundled wasm object disassembled: two forwarding malloc/free exports matching included C source. No new build-time subprocess or network access." + [[audits.napi-derive]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -347,6 +365,12 @@ criteria = "safe-to-deploy" delta = "3.6.8 -> 3.6.9" notes = "No source changes; the release only bumps the napi/napi-derive-backend dependency versions in Cargo.toml." +[[audits.napi-derive]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.6.9 -> 3.6.12" +notes = "Reviewed syn 3 parser migration: function arguments read their type field, new AST attributes initialized and non-exhaustive path fields ignored. No new unsafe or build-time execution." + [[audits.napi-derive-backend]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -359,12 +383,24 @@ criteria = "safe-to-deploy" delta = "6.1.3 -> 6.1.4" notes = "Reviewed redundant-borrow removals and too_many_arguments allow; generated bindings unchanged in behavior, no new unsafe or ambient access." +[[audits.napi-derive-backend]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "6.1.4 -> 6.1.5" +notes = "Reviewed syn 3 AST adaptation and generated enum property flags changed to writable/enumerable/configurable. No new unsafe or external execution." + [[audits.napi-sys]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" delta = "3.3.1 -> 3.3.2" notes = "Reviewed single const addition napi_cannot_run_js=23 matching Node API; FFI declarations only, no code or ambient access." +[[audits.napi-sys]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.3.2 -> 3.4.0" +notes = "Reviewed exact-target build cfg, atomic shared-memory refresh and worker-crash flag modules. Checked pointer/page bounds and target gating; native code unchanged outside tests." + [[audits.num-bigint]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -395,6 +431,36 @@ criteria = "safe-to-deploy" delta = "0.2.7 -> 0.2.8" notes = "Reviewed Arc map uniqueness and equal size/alignment checks. Old T moves local and allocation becomes MaybeUninit U guard before closure, preserving allocation cleanup and preventing double-drop on panic. No ambient capability changes." +[[audits.pyo3]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.29.2 -> 0.29.3" +notes = "Reviewed registry delta: critical sections pin bytearray/dict access, checked CPython Unicode initialization with cleanup on invalid characters, gated CPython native iterators, Python finalization guard and deterministic test adjustments. Reviewed pointer/refcount lifetimes and unsafe access changes." + +[[audits.pyo3-build-config]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.29.2 -> 0.29.3" +notes = "Reviewed registry delta: package-version and synchronized workspace dependency metadata only; build configuration source unchanged." + +[[audits.pyo3-ffi]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.29.2 -> 0.29.3" +notes = "Reviewed registry delta: package-version and synchronized workspace dependency metadata only; FFI declarations unchanged." + +[[audits.pyo3-macros]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.29.2 -> 0.29.3" +notes = "Reviewed registry delta: package-version and synchronized workspace dependency metadata only; macro entry-point source unchanged." + +[[audits.pyo3-macros-backend]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.29.2 -> 0.29.3" +notes = "Reviewed registry delta: explicit literal macro input validation and syn literal destructuring updates. No new unsafe or build-time external execution." + [[audits.rand]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -507,6 +573,12 @@ criteria = "safe-to-deploy" delta = "1.52.0 -> 1.52.1" notes = "Reviewed delta: reverts blocking-pool sharded queue to mutex/condvar VecDeque to fix spawn_blocking hang, adjusts fastrand cfg, and adds no new unsafe blocks or ambient capabilities." +[[audits.tokio]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "1.53.1 -> 1.53.2" +notes = "Reviewed registry delta: buffered-file partial-read retention, vectored-write progress handling, semaphore CAS success ordering, mpsc/task-trace state fixes, nonblocking JoinSet poll and shutdown-safe timer registration. Reviewed unsafe timer pinning/shutdown locks and associated regression tests; no new external execution." + [[audits.tokio-rustls]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" From 6bd12bbc6261a79753ecb12ecb5a8939312e9d8a Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Tue, 6 Oct 2026 23:28:27 -0500 Subject: [PATCH 3/3] chore(deps): audit Turso patch update from latest main Co-Authored-By: yolop --- supply-chain/audits.toml | 24 ++++++++++ supply-chain/imports.lock | 94 +++++++++++++++++++-------------------- 2 files changed, 71 insertions(+), 47 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 9e14c3eef..20610d2c7 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -603,6 +603,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (295 files, 293 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_core]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed published 0.8.1 -> 0.8.2 source delta. Core CDC insert/update/delete emission now uses ColumnLayout physical register offsets and skips virtual columns, preventing virtual-column values from being read as physical registers; record sizing uses non-virtual columns. No new unsafe, ambient IO, execution, or dependencies. Extension, macros and parser source unchanged; manifests update package and sibling versions only." + [[audits.turso_ext]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -621,6 +627,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (8 files, 6 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_ext]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed published 0.8.1 -> 0.8.2 source delta. Core CDC insert/update/delete emission now uses ColumnLayout physical register offsets and skips virtual columns, preventing virtual-column values from being read as physical registers; record sizing uses non-virtual columns. No new unsafe, ambient IO, execution, or dependencies. Extension, macros and parser source unchanged; manifests update package and sibling versions only." + [[audits.turso_macros]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -639,6 +651,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (13 files, 12 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_macros]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed published 0.8.1 -> 0.8.2 source delta. Core CDC insert/update/delete emission now uses ColumnLayout physical register offsets and skips virtual columns, preventing virtual-column values from being read as physical registers; record sizing uses non-virtual columns. No new unsafe, ambient IO, execution, or dependencies. Extension, macros and parser source unchanged; manifests update package and sibling versions only." + [[audits.turso_parser]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -657,6 +675,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.14 -> 0.8.1" notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (11 files, 9 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." +[[audits.turso_parser]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" +notes = "Reviewed published 0.8.1 -> 0.8.2 source delta. Core CDC insert/update/delete emission now uses ColumnLayout physical register offsets and skips virtual columns, preventing virtual-column values from being read as physical registers; record sizing uses non-virtual columns. No new unsafe, ambient IO, execution, or dependencies. Extension, macros and parser source unchanged; manifests update package and sibling versions only." + [[audits.twox-hash]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index f4d16232f..bde79b474 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -843,7 +843,7 @@ start = "2020-10-14" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-normalization]] who = "Manish Goregaokar " @@ -852,7 +852,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-11-06" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-segmentation]] who = "Manish Goregaokar " @@ -861,7 +861,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-05-15" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-width]] who = "Manish Goregaokar " @@ -870,7 +870,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-12-05" end = "2026-02-01" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.utf8_iter]] who = "Makoto Kato " @@ -879,81 +879,81 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2022-04-19" end = "2024-06-16" notes = "Maintained by Henri Sivonen who works at Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.adler2]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.0.0 -> 2.0.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.2.18" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.2.20 -> 0.2.21" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.5.2" notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.5.2 -> 0.5.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.5.3 -> 0.6.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.6.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.6.3" notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.6.3 -> 0.7.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.7.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.2.1 -> 0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-foundation-sys]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.8.6 -> 0.8.7" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.fallible-iterator]] who = "Jan-Erik Rediger " @@ -966,73 +966,73 @@ who = "Bobby Holley " criteria = "safe-to-deploy" version = "1.0.7" notes = "Simple hasher implementation with no unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foldhash]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.5 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" version = "1.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.2.0 -> 1.2.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "edgul " criteria = "safe-to-deploy" delta = "1.2.1 -> 1.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.5 -> 0.16.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.0 -> 0.16.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.1 -> 0.17.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.17.0 -> 0.17.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.heck]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.4.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hex]] who = "Simon Friedberger " criteria = "safe-to-deploy" version = "0.4.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.itertools]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.14.0 -> 0.15.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.libloading]] who = "Jan-Erik Rediger " @@ -1052,19 +1052,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.2.0 -> 2.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.3.0 -> 2.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "edgul " criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.rustc_version]] who = "Nika Layzell " @@ -1081,25 +1081,25 @@ who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "1.0.16 -> 1.0.28" notes = "Very few changes, mostly removes support for older Rust versions. Some unsafe code refactored, but it seemed to be functionally equivalent to me." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.semver]] who = "Bobby Holley " criteria = "safe-to-deploy" delta = "1.0.17 -> 1.0.16" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sharded-slab]] who = "Mark Hammond " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.7" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Max Inden " criteria = "safe-to-deploy" delta = "1.1.0 -> 1.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Emilio Cobos Álvarez " @@ -1108,14 +1108,14 @@ delta = "1.3.0 -> 2.0.1" notes = """ Mostly removes some deprecated and unsound APIs. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.simdutf8]] who = "Henri Sivonen " criteria = "safe-to-deploy" version = "0.1.5" notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -1126,19 +1126,19 @@ I am the primary author of the `synstructure` crate, and its current maintainer. The one use of `unsafe` is unnecessary, but documented and harmless. It will be removed in the next version. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.12.6 -> 0.13.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.13.0 -> 0.13.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -1156,19 +1156,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.15.0 -> 0.15.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.textwrap]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.15.2 -> 0.16.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.textwrap]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy" delta = "0.16.0 -> 0.16.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.textwrap]] who = "Nika Layzell " @@ -1180,7 +1180,7 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supp who = "Drew Willcoxon " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.unicode-linebreak]] who = "Jan-Erik Rediger " @@ -1193,11 +1193,11 @@ who = "Henri Sivonen " criteria = "safe-to-deploy" version = "1.0.5" notes = "I, Henri Sivonen, wrote this crate." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.write16]] who = "Henri Sivonen " criteria = "safe-to-deploy" version = "1.0.0" notes = "I, Henri Sivonen, wrote this (safe-code-only) crate." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml"