From b7b617d1430d21dff20217286a1fe14c6b87345f Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Thu, 15 Oct 2026 10:16:36 +0000 Subject: [PATCH 1/2] chore(deps): bump the rust-dependencies group with 3 updates Bumps the rust-dependencies group with 3 updates: [serde_json](https://github.com/serde-rs/json), [proptest](https://github.com/proptest-rs/proptest) and [syn](https://github.com/dtolnay/syn). Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.151...v1.0.154) Updates `proptest` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/proptest-rs/proptest/releases) - [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md) - [Commits](https://github.com/proptest-rs/proptest/compare/v1.11.0...v1.12.0) Updates `syn` from 3.0.7 to 3.0.8 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](https://github.com/dtolnay/syn/compare/3.0.7...3.0.8) --- updated-dependencies: - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: proptest dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: syn dependency-version: 3.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] --- Cargo.lock | 140 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 107 insertions(+), 33 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d16072f9e..e911dadfd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -253,7 +253,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -478,7 +478,7 @@ dependencies = [ "proc-macro2", "quote", "serde", - "syn 3.0.7", + "syn 3.0.8", "tempfile", "toml", ] @@ -599,7 +599,16 @@ version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3" dependencies = [ - "bit-vec", + "bit-vec 0.8.0", +] + +[[package]] +name = "bit-set" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c" +dependencies = [ + "bit-vec 0.10.1", ] [[package]] @@ -608,6 +617,16 @@ version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" +[[package]] +name = "bit-vec" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269" +dependencies = [ + "borsh", + "serde", +] + [[package]] name = "bitflags" version = "1.3.2" @@ -679,6 +698,30 @@ dependencies = [ "cipher 0.5.2", ] +[[package]] +name = "borsh" +version = "1.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a" +dependencies = [ + "borsh-derive", + "bytes", + "cfg_aliases", +] + +[[package]] +name = "borsh-derive" +version = "1.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56" +dependencies = [ + "once_cell", + "proc-macro-crate", + "proc-macro2", + "quote", + "syn 3.0.8", +] + [[package]] name = "branches" version = "0.4.6" @@ -731,7 +774,7 @@ checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -924,7 +967,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -1066,6 +1109,12 @@ version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" +[[package]] +name = "core_detect" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48" + [[package]] name = "cow-utils" version = "0.1.3" @@ -1583,7 +1632,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -1754,7 +1803,7 @@ version = "0.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8" dependencies = [ - "bit-set", + "bit-set 0.8.0", "regex-automata", "regex-syntax", ] @@ -1765,7 +1814,7 @@ version = "0.19.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912" dependencies = [ - "bit-set", + "bit-set 0.8.0", "regex-automata", "regex-syntax", ] @@ -1909,7 +1958,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -2926,7 +2975,7 @@ checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -3246,7 +3295,7 @@ dependencies = [ "napi-derive-backend", "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -3259,7 +3308,7 @@ dependencies = [ "proc-macro2", "quote", "semver", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -4076,7 +4125,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -4106,6 +4155,15 @@ dependencies = [ "wnaf", ] +[[package]] +name = "proc-macro-crate" +version = "3.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f" +dependencies = [ + "toml_edit", +] + [[package]] name = "proc-macro-utils" version = "0.10.0" @@ -4128,16 +4186,17 @@ dependencies = [ [[package]] name = "proptest" -version = "1.11.0" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744" +checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0" dependencies = [ - "bit-set", - "bit-vec", + "bit-set 0.11.1", + "bit-vec 0.10.1", "bitflags 2.13.2", + "chacha20", + "core_detect", "num-traits", - "rand 0.9.5", - "rand_chacha 0.9.0", + "rand 0.10.3", "rand_xorshift", "regex-syntax", "rusty-fork", @@ -4393,11 +4452,11 @@ dependencies = [ [[package]] name = "rand_xorshift" -version = "0.4.0" +version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a" +checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf" dependencies = [ - "rand_core 0.9.5", + "rand_core 0.10.1", ] [[package]] @@ -5082,14 +5141,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] name = "serde_json" -version = "1.0.151" +version = "1.0.154" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14" +checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6" dependencies = [ "itoa", "memchr", @@ -5152,7 +5211,7 @@ checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -5529,9 +5588,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.7" +version = "3.0.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d62a2e0561533f2ca2561d0cf27fd9fedb640a1bf2616ff5d5c80d99017faadc" +checksum = "01016da373cd8f7ef12624f796309f5c31ba8d646dd08856c02cd741d823c622" dependencies = [ "proc-macro2", "quote", @@ -5600,7 +5659,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", "windows-sys 0.61.2", @@ -5668,7 +5727,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -5740,7 +5799,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] @@ -5812,6 +5871,18 @@ dependencies = [ "serde_core", ] +[[package]] +name = "toml_edit" +version = "0.25.17+spec-1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c" +dependencies = [ + "indexmap", + "toml_datetime", + "toml_parser", + "winnow", +] + [[package]] name = "toml_parser" version = "1.1.5+spec-1.1.0" @@ -6367,7 +6438,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", "wasm-bindgen-shared", ] @@ -6896,6 +6967,9 @@ name = "winnow" version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81" +dependencies = [ + "memchr", +] [[package]] name = "wit-bindgen" @@ -7099,7 +7173,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.7", + "syn 3.0.8", ] [[package]] From 223bfe6f16fda6873b5a21aa6e28da92377b746a Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Thu, 15 Oct 2026 10:22:05 +0000 Subject: [PATCH 2/2] chore(deps): vet the rust-dependencies group bump Carries the group bump dependabot proposed in #2729 plus the supply-chain records it needs. That PR was green on Test, Lint, Examples, Fuzz Compile Check and every WASM/Windows job; only Audit failed, with cargo vet --locked reporting eleven unvetted crates. proptest 1.12.0 is why. A patch-level bump of a dev dependency looks like it should add nothing, but 1.12 pulls in a borsh serialization chain: bit-set, bit-vec, borsh, borsh-derive, core_detect, proc-macro-crate and toml_edit. cargo tree -e normal -i proptest finds no path, so the whole chain is dev-only and takes safe-to-run exemptions, the same way proptest and rand_xorshift were already carried. The stale proptest 1.11.0 and rand_xorshift 0.4.0 exemptions are dropped rather than left behind. The two crates that actually ship took hand delta audits at safe-to-deploy, recorded after reading the diffs: serde_json 1.0.151 -> 1.0.154 is narrowing. "-0" no longer parses to I64(0) so the sign survives under arbitrary_precision, Number::as_f32 filters non-finite results, and invalid UTF-8 is reported at the first bad byte. The new UTF-8 position arithmetic is the one part worth flagging: as_str, which is not feature-gated and is what this tree compiles, uses saturating_sub and cannot underflow, while begin_raw_buffering subtracts from position.column without saturation and needs the raw_value feature, which this tree does not enable. Worst case in either is a wrong column in an error message. syn 3.0.7 -> 3.0.8 only narrows operator parsing: "<-" is rejected with a diagnostic, and "->" is no longer mis-parsed as subtraction nor "<-" as less-than. No unsafe added or changed in either delta, no new ambient access, no new build scripts. Validated: cargo vet --locked exits 0 (94 fully audited, 84 partially, 498 exempted), ./scripts/audit-lockfiles.sh exits 0, cargo deny check licenses sources passes with the new crates, and the property-based security suite is 27/27 on proptest 1.12. --- knowledge/log.md | 2 ++ supply-chain/audits.toml | 12 ++++++++++++ supply-chain/config.toml | 32 ++++++++++++++++++++++++++++++-- supply-chain/imports.lock | 36 ++++++++++++++++++++++++++++++++++++ 4 files changed, 80 insertions(+), 2 deletions(-) diff --git a/knowledge/log.md b/knowledge/log.md index 208d31524..1d7f0f178 100644 --- a/knowledge/log.md +++ b/knowledge/log.md @@ -2,6 +2,8 @@ ## 2026-10-15 +* **Operations / Security**: The `rust-dependencies` group bump (proptest 1.11.0 -> 1.12.0, serde_json 1.0.151 -> 1.0.154, syn 3.0.7 -> 3.0.8, and rand_xorshift 0.4.0 -> 0.5.0 behind proptest) was green on every job except Audit, where `cargo vet --locked` reported eleven unvetted crates. proptest 1.12 is the reason: it pulls a borsh serialization chain into the dev tree, adding `bit-set`, `bit-vec`, `borsh`, `borsh-derive`, `core_detect`, `proc-macro-crate` and `toml_edit` where a patch-level dev bump looks like it should add nothing. `cargo tree -e normal -i proptest` finds no path, so the whole chain is dev-only and takes `safe-to-run` exemptions, matching how proptest and rand_xorshift were already carried; the two shipped crates took hand delta audits at `safe-to-deploy`. serde_json's delta is narrowing (`-0` keeps its sign under arbitrary_precision, `as_f32` filters non-finite, invalid UTF-8 is reported at the first bad byte) and syn's only rejects `<-` and stops mis-parsing `->` as subtraction. The one thing worth remembering about the serde_json audit: its new UTF-8 position arithmetic saturates in `as_str`, which this tree compiles, but not in `begin_raw_buffering`, which needs the `raw_value` feature this tree does not enable - so enabling `raw_value` later means re-checking that subtraction. Stale `proptest` 1.11.0 and `rand_xorshift` 0.4.0 exemptions were dropped rather than left behind. The general rule, same as #2706/#2720: a dependabot group bump that adds crates cannot go green on its own, because nothing in the bump records the audits the new crates need. + * **Security / Operations**: Nightly run 263 went red on the Advisory Audit with 15 vulnerabilities in the root and fuzz lockfiles and 11 in `examples/hyperlight/host` — none from a tree that changed. Two upstream batches landed on 2026-10-14: eleven `wasmtime` advisories against the pinned 48.0.5 (RUSTSEC-2026-0353 through -0359 and -0361 through -0364: host panics reachable from guest code, an unaligned-host-data bug, and an unmetered component-model handle table) and four `rustls` advisories against 0.23.45 (RUSTSEC-2026-0346 through -0349: `Debug` impls exposing TLS secrets, buffered application data sent to the outer server after ECH rejection, pre-authentication Brotli certificate decompression allocating up to 1 GiB, and an unauthenticated `ServerHello` downgrading later connections to classical key exchange). The wasmtime pin moves `=48.0.5` -> `=48.0.6`, which is the fix release on the 48 line and keeps MSRV at 1.95.0, matching `rust-toolchain.toml`; 49.0.3 also carries the fixes but needs rustc 1.96, so the reason the pin exists is unchanged and the dependabot `ignore` entries stay. `rustls` is a caret dependency and moves 0.23.45 -> 0.23.46. All three cargo lockfiles are updated together, since the fuzz lockfile resolves the root workspace and `examples/hyperlight/host` carries its own. No guest rebuild is needed for the wasmtime bump: `build.rs` recompiles the `.cwasm`, per [cpython-wasm](runtimes/cpython-wasm.md). The general point: an exact pin held for an MSRV reason still has to move on the patch line when that line is the advisory fix — the pin is not a reason to stay vulnerable. ## 2026-10-13 diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 982261e61..a60354ff0 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -538,6 +538,12 @@ criteria = "safe-to-deploy" delta = "0.103.14 -> 0.103.15" notes = "Reviewed complete runtime delta: FIPS status reports underlying AWS-LC signature implementation status. Certificate parsing, verification algorithms and input bounds unchanged." +[[audits.serde_json]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "1.0.151 -> 1.0.154" +notes = "Reviewed the published delta across 1.0.152-1.0.154. Behavior changes are narrowing or diagnostic: '-0' no longer parses to I64(0) so the sign survives in arbitrary_precision mode; Number::as_f32 filters non-finite results, fixing comparison of large non-integer values against f32::INFINITY; invalid UTF-8 is reported at the first bad byte instead of the end of the token; lexical/math.rs changes are max_value() to MAX renames in code and comments only. Under preserve_order the IndexMap hasher becomes explicit, std::hash::RandomState with the std feature and foldhash::fast::RandomState without it, which upstream documents as minimal HashDoS resistance; that path needs preserve_order, which this tree does not enable. The new UTF-8 position arithmetic is the only part worth re-checking by a future user: as_str, which is not feature-gated and is what this tree compiles, uses saturating_sub and cannot underflow, while begin_raw_buffering subtracts from position.column without saturation and is reachable only under the raw_value feature, also not enabled here. Worst case in either is a wrong column in an error message. No unsafe anywhere in the diff, no new filesystem, network, process or environment access, no build script, and the only dependency addition is the foldhash hasher behind no-std preserve_order. Source safety review of the delta, not a full crate review." + [[audits.signal-hook]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -568,6 +574,12 @@ criteria = "safe-to-deploy" delta = "3.0.6 -> 3.0.7" notes = "Reviewed complete published package diff: one production change in src/expr.rs, the rest tests and a version stamp. Parsing a labelled construct now also checks that the token after the label is not '::', so 'label: ...' is no longer matched when the source actually continues with a path separator. No unsafe code, no new dependencies, no build scripts, no host access." +[[audits.syn]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.0.7 -> 3.0.8" +notes = "Reviewed the complete published delta: two production files plus a version stamp and tests. Operator parsing is narrowed, not widened. BinOp parsing no longer treats a leading '-' as subtraction when the token is actually '->', nor '<' as less-than when the token is '<-', and the two cast/comparison loops in expr.rs now return a parse error naming '<-' instead of silently breaking out. Token consumption stays bounded and the syntax tree construction is unchanged. No unsafe, no new dependencies, no build script, no host access." + [[audits.thin-vec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 8caabf5e7..99ee679bf 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -178,6 +178,14 @@ criteria = "safe-to-deploy" version = "0.4.10" criteria = "safe-to-deploy" +[[exemptions.bit-set]] +version = "0.11.1" +criteria = "safe-to-run" + +[[exemptions.bit-vec]] +version = "0.10.1" +criteria = "safe-to-run" + [[exemptions.bitflags]] version = "1.3.2" criteria = "safe-to-deploy" @@ -210,6 +218,14 @@ criteria = "safe-to-deploy" version = "0.10.0" criteria = "safe-to-deploy" +[[exemptions.borsh]] +version = "1.8.1" +criteria = "safe-to-run" + +[[exemptions.borsh-derive]] +version = "1.8.1" +criteria = "safe-to-run" + [[exemptions.branches]] version = "0.4.5" criteria = "safe-to-deploy" @@ -368,6 +384,10 @@ criteria = "safe-to-deploy" version = "0.10.1" criteria = "safe-to-deploy" +[[exemptions.core_detect]] +version = "1.0.0" +criteria = "safe-to-run" + [[exemptions.cow-utils]] version = "0.1.3" criteria = "safe-to-deploy" @@ -1419,6 +1439,10 @@ criteria = "safe-to-deploy" version = "0.14.0" criteria = "safe-to-deploy" +[[exemptions.proc-macro-crate]] +version = "3.5.0" +criteria = "safe-to-run" + [[exemptions.proc-macro-utils]] version = "0.10.0" criteria = "safe-to-deploy" @@ -1428,7 +1452,7 @@ version = "1.0.107" criteria = "safe-to-deploy" [[exemptions.proptest]] -version = "1.11.0" +version = "1.12.0" criteria = "safe-to-run" [[exemptions.pyo3]] @@ -1524,7 +1548,7 @@ version = "0.3.1" criteria = "safe-to-deploy" [[exemptions.rand_xorshift]] -version = "0.4.0" +version = "0.5.0" criteria = "safe-to-run" [[exemptions.rapidhash]] @@ -1976,6 +2000,10 @@ criteria = "safe-to-run" version = "0.7.19" criteria = "safe-to-deploy" +[[exemptions.toml_edit]] +version = "0.25.17+spec-1.1.0" +criteria = "safe-to-run" + [[exemptions.tower]] version = "0.5.3" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 8dbbe1595..687226848 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -924,6 +924,24 @@ criteria = "safe-to-deploy" delta = "0.6.0 -> 0.8.0" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.bit-set]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.8.0 -> 0.9.1" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.bit-set]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.9.1 -> 0.10.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.bit-set]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.10.0 -> 0.11.1" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.bit-vec]] who = "Aria Beingessner " criteria = "safe-to-deploy" @@ -943,6 +961,18 @@ criteria = "safe-to-deploy" delta = "0.7.0 -> 0.8.0" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.bit-vec]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.8.0 -> 0.9.1" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.bit-vec]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.9.1 -> 0.10.1" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.cfg_aliases]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -955,6 +985,12 @@ criteria = "safe-to-deploy" delta = "0.8.6 -> 0.8.7" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.core_detect]] +who = "Henri Sivonen " +criteria = "safe-to-deploy" +version = "1.0.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.fallible-iterator]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy"