diff --git a/Cargo.lock b/Cargo.lock index 47da8f4b8..b8fc76fc7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -253,7 +253,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -478,7 +478,7 @@ dependencies = [ "proc-macro2", "quote", "serde", - "syn 3.0.6", + "syn 3.0.7", "tempfile", "toml", ] @@ -731,7 +731,7 @@ checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -924,7 +924,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -1583,7 +1583,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -1909,7 +1909,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -2926,7 +2926,7 @@ checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -3214,9 +3214,9 @@ dependencies = [ [[package]] name = "napi" -version = "3.14.0" +version = "3.14.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "15301c22171e8397a7b17beb3c75bf486bf67ca3bdad8ea347835b770df61969" +checksum = "a4e2cf85c02d9b057898c485b824c3c416b65193689e2b7f517efc94b86ed24c" dependencies = [ "bitflags 2.13.2", "ctor", @@ -3246,7 +3246,7 @@ dependencies = [ "napi-derive-backend", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -3259,7 +3259,7 @@ dependencies = [ "proc-macro2", "quote", "semver", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -4076,7 +4076,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -4666,9 +4666,9 @@ dependencies = [ [[package]] name = "russh" -version = "0.63.3" +version = "0.64.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce" +checksum = "ba61e87b9ec9a39a59a6bbed4c0b8ff7fb07073405b24a767a1f2c8560ac8f58" dependencies = [ "aes 0.9.3", "aws-lc-rs", @@ -5082,7 +5082,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5113,9 +5113,9 @@ dependencies = [ [[package]] name = "serde_spanned" -version = "1.1.1" +version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26" +checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c" dependencies = [ "serde_core", ] @@ -5152,7 +5152,7 @@ checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5252,9 +5252,9 @@ dependencies = [ [[package]] name = "signal-hook" -version = "0.4.4" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b2a0c28ca5908dbdbcd52e6fdaa00358ab88637f8ab33e1f188dd510eb44b53d" +checksum = "b29ffa27d3d59a049bb328258de100f8012848d1b08d444e08bbc02ac468435e" dependencies = [ "libc", "signal-hook-registry", @@ -5529,9 +5529,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.6" +version = "3.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" +checksum = "d62a2e0561533f2ca2561d0cf27fd9fedb640a1bf2616ff5d5c80d99017faadc" dependencies = [ "proc-macro2", "quote", @@ -5668,7 +5668,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5740,7 +5740,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] @@ -5790,9 +5790,9 @@ dependencies = [ [[package]] name = "toml" -version = "1.1.6+spec-1.1.0" +version = "1.1.8+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a" +checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d" dependencies = [ "indexmap", "serde_core", @@ -5805,27 +5805,27 @@ dependencies = [ [[package]] name = "toml_datetime" -version = "1.1.1+spec-1.1.0" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7" +checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053" dependencies = [ "serde_core", ] [[package]] name = "toml_parser" -version = "1.1.3+spec-1.1.0" +version = "1.1.5+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56" +checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c" dependencies = [ "winnow", ] [[package]] name = "toml_writer" -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" +checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770" [[package]] name = "tower" @@ -6367,7 +6367,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", "wasm-bindgen-shared", ] @@ -7063,9 +7063,9 @@ dependencies = [ [[package]] name = "zeroize" -version = "1.9.0" +version = "1.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e" +checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879" [[package]] name = "zerotrie" @@ -7099,7 +7099,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.7", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 8f1a9a349..90ed78ac3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -142,7 +142,7 @@ tracing = "0.1" tower = { version = "0.5", features = ["util"] } # SSH client (for ssh/scp/sftp builtins) -russh = "0.63" +russh = "0.64" # Embedded SQLite engine (Turso, pure Rust). Upstream is BETA — gated behind # the `sqlite` feature and disabled by default; see knowledge/runtimes/sqlite-builtin.md. turso_core = "0.8.0-pre.1" diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index c7973901a..ba9ea357a 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -329,6 +329,12 @@ criteria = "safe-to-deploy" delta = "3.13.0 -> 3.14.0" notes = "Reviewed registry delta including new WASI heap-break arithmetic and allocator wrappers: serialized allocator access, checked page growth below 2 GiB, target-gated shared-memory refresh and crash reporting. Native handoff is a no-op; allocator tests cover overflow and growth failures." +[[audits.napi]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.14.0 -> 3.14.2" +notes = "Reviewed complete published package diff across 3.14.1 and 3.14.2: no new dependencies, no build scripts, no new host filesystem, network or process access. Four upstream fixes, all hardening. NativeBorrowScope now owns its storage through NonNull instead of aliasing a reference, removing an aliasing violation. serde_json::Value conversion is bounded at 128 levels of nesting, so deeply nested JSON from a caller can no longer recurse without limit - the change that matters most for this tree, where the binding converts untrusted input. The wasm cleanup is registered through the env cleanup hook rather than ad hoc. Object creation uses napi_define_properties on every Node version. Existing unsafe in the js_values conversions is refactored in place; no new unsafe blocks." + [[audits.napi-build]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -508,6 +514,12 @@ criteria = "safe-to-deploy" delta = "0.63.1 -> 0.63.2" notes = "Reviewed credentials redaction/zeroization; negotiated RSA certificate hashes; rekey staging and peer non-transport flood rejection/bounds. Compression drains progress with existing maximum packet limit; PTY lengths count actual entries. No new unsafe or ambient destinations." +[[audits.russh]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.63.3 -> 0.64.1" +notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no new host filesystem, network or process access, and no new unsafe blocks anywhere in src. The substantive change is a server-side authentication fix: a publickey request's signature must now use the algorithm the request announced (RFC 4252 section 7, RFC 8332 section 3). Before, a client could announce rsa-sha2-512 and sign with ssh-rsa (SHA-1) and the server accepted it; the delta adds the comparison and a regression test asserting both the rejection and that a matching signature is still accepted. One dependency is removed, not added: the legacy-ed25519-pkcs8-parser feature and its yasna ASN.1 dependency are gone, so the PKCS8 path no longer falls back to a second parser on error. This tree uses russh as a client with default features, so it never enabled that feature and is not exposed to the server-side bug; both changes are a reduction in attack surface for it. Partial-success auth now carries proceed_with_methods as an Option, removing password from the offered set when none is given, and resets partial_success per request. The remainder is mechanical: let-chain rewrites in keys/known_hosts.rs and kex/dh/mod.rs with identical semantics, saturating arithmetic for the cipher byte counter, and new integration tests. Source safety review, not a cryptographic audit." + [[audits.rustls-webpki]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -520,6 +532,12 @@ criteria = "safe-to-deploy" delta = "0.103.14 -> 0.103.15" notes = "Reviewed complete runtime delta: FIPS status reports underlying AWS-LC signature implementation status. Certificate parsing, verification algorithms and input bounds unchanged." +[[audits.signal-hook]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.4.4 -> 0.4.5" +notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no new host access beyond the libc signal and pipe calls the crate already made. low_level/pipe.rs hoists the raw file descriptor out of the borrowed pipe before the unsafe libc::send wake, so the descriptor is read once rather than through a borrow held across the call, and the unsafe block is narrowed to the call itself. signal_details.rs and the iterator test follow. No new unsafe blocks and no change to which signals are handled." + [[audits.smallvec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -538,6 +556,12 @@ criteria = "safe-to-deploy" delta = "3.0.5 -> 3.0.6" notes = "Reviewed lifetime-group parse guard in expr.rs (Lifetime+End lookahead) plus version bump; token consumption stays bounded. No new unsafe, deps, build scripts, or ambient access." +[[audits.syn]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.0.6 -> 3.0.7" +notes = "Reviewed complete published package diff: one production change in src/expr.rs, the rest tests and a version stamp. Parsing a labelled construct now also checks that the token after the label is not '::', so 'label: ...' is no longer matched when the source actually continues with a path separator. No unsafe code, no new dependencies, no build scripts, no host access." + [[audits.thin-vec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -759,6 +783,12 @@ criteria = "safe-to-deploy" delta = "0.14.0 -> 0.14.1" notes = "Reviewed replacement of unconditional representation reversal by PrimeFieldExt to_le_repr with correct bounds. No unsafe or algorithm-loop changes, no new ambient access." +[[audits.zeroize]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "1.9.0 -> 1.9.1" +notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no host filesystem, network or process access. Three fixes, all narrowing rather than widening behaviour. Zeroizing's derived Debug is replaced with an opaque impl, so a wrapped secret no longer renders its contents through '{:?}'. The Vec impl no longer zeroizes initialized elements twice. The optimization_barrier fallback read volatile memory as u8 that could be uninitialized; it now reads MaybeUninit through a cast, removing the UB, and the internal use of that barrier is dropped. Remaining changes are the aarch64/x86 barrier modules following the same cast, a lint allowance, and the version stamp. Existing unsafe is refactored in place; no new unsafe blocks." + [[audits.zerovec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index bde79b474..f3cbdcbfb 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -105,8 +105,8 @@ user-login = "cfallin" user-name = "Chris Fallin" [[publisher.serde_spanned]] -version = "1.1.1" -when = "2026-03-31" +version = "1.1.2" +when = "2026-10-08" user-id = 6743 user-login = "epage" user-name = "Ed Page" @@ -119,29 +119,29 @@ user-login = "Darksonn" user-name = "Alice Ryhl" [[publisher.toml]] -version = "1.1.6+spec-1.1.0" -when = "2026-09-10" +version = "1.1.8+spec-1.1.0" +when = "2026-10-09" user-id = 6743 user-login = "epage" user-name = "Ed Page" [[publisher.toml_datetime]] -version = "1.1.1+spec-1.1.0" -when = "2026-03-31" +version = "1.1.2+spec-1.1.0" +when = "2026-10-08" user-id = 6743 user-login = "epage" user-name = "Ed Page" [[publisher.toml_parser]] -version = "1.1.3+spec-1.1.0" -when = "2026-07-27" +version = "1.1.5+spec-1.1.0" +when = "2026-10-09" user-id = 6743 user-login = "epage" user-name = "Ed Page" [[publisher.toml_writer]] -version = "1.1.2+spec-1.1.0" -when = "2026-07-14" +version = "1.1.3+spec-1.1.0" +when = "2026-10-08" user-id = 6743 user-login = "epage" user-name = "Ed Page"