From d8bbc7858622b6d9c278469aab701ca0b609cddf Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 15 May 2024 05:35:49 +0200 Subject: Merging upstream version 126.0. Signed-off-by: Daniel Baumann --- supply-chain/audits.toml | 54 +++++++- supply-chain/config.toml | 8 +- supply-chain/imports.lock | 316 +++++++++++++++++++++++++++++++--------------- 3 files changed, 268 insertions(+), 110 deletions(-) (limited to 'supply-chain') diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 31ca3fcf0f..b21bde4f10 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -1329,7 +1329,7 @@ who = [ "Erich Gubler ", ] criteria = "safe-to-deploy" -delta = "0.7.0 -> 0.19.0@git:6040820099bc72b827a6a5f53d66dda3e301f944" +delta = "0.7.0 -> 0.19.0@git:0c5bebca514eb06d9387f87666c1c658f3f673b4" importable = false [[audits.darling]] @@ -1533,6 +1533,12 @@ who = "Mike Hommey " criteria = "safe-to-deploy" delta = "1.8.0 -> 1.8.1" +[[audits.embed-manifest]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "1.4.0" +notes = "Necessary dependencies, all environment variable access is for build script vars set by cargo." + [[audits.encoding_c]] who = "Henri Sivonen " criteria = "safe-to-deploy" @@ -2386,6 +2392,12 @@ criteria = "safe-to-deploy" version = "0.5.4" notes = "I own this crate (I am contain-rs) and 0.5.4 passes miri. This code is very old and used by lots of people, so I'm pretty confident in it, even though it's in maintenance-mode and missing some nice-to-have APIs." +[[audits.linked-hash-map]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.5.4 -> 0.5.6" +notes = "New unsafe code has debug assertions and meets invariants. All other changes are formatting-related." + [[audits.linked-hash-map]] who = "Mike Hommey " criteria = "safe-to-run" @@ -2671,7 +2683,7 @@ who = [ "Erich Gubler ", ] criteria = "safe-to-deploy" -delta = "0.14.0 -> 0.19.0@git:6040820099bc72b827a6a5f53d66dda3e301f944" +delta = "0.14.0 -> 0.19.0@git:0c5bebca514eb06d9387f87666c1c658f3f673b4" importable = false [[audits.net2]] @@ -3738,6 +3750,11 @@ who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.15.2 -> 0.16.0" +[[audits.textwrap]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "0.16.0 -> 0.16.1" + [[audits.thin-vec]] who = "Aria Beingessner " criteria = "safe-to-deploy" @@ -4485,7 +4502,7 @@ who = [ "Erich Gubler ", ] criteria = "safe-to-deploy" -delta = "0.18.0 -> 0.19.0@git:6040820099bc72b827a6a5f53d66dda3e301f944" +delta = "0.18.0 -> 0.19.0@git:0c5bebca514eb06d9387f87666c1c658f3f673b4" importable = false [[audits.wgpu-hal]] @@ -4539,7 +4556,7 @@ who = [ "Erich Gubler ", ] criteria = "safe-to-deploy" -delta = "0.18.0 -> 0.19.0@git:6040820099bc72b827a6a5f53d66dda3e301f944" +delta = "0.18.0 -> 0.19.0@git:0c5bebca514eb06d9387f87666c1c658f3f673b4" importable = false [[audits.wgpu-types]] @@ -4593,7 +4610,7 @@ who = [ "Erich Gubler ", ] criteria = "safe-to-deploy" -delta = "0.18.0 -> 0.19.0@git:6040820099bc72b827a6a5f53d66dda3e301f944" +delta = "0.18.0 -> 0.19.0@git:0c5bebca514eb06d9387f87666c1c658f3f673b4" importable = false [[audits.whatsys]] @@ -4708,6 +4725,15 @@ who = "Makoto Kato " criteria = "safe-to-deploy" version = "0.10.1" +[[audits.zip]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.6.4" +notes = """ +No unsafe code nor unwarranted dependencies. Side-effectful std usage is only +present where expected (zip archive reading/writing and unpacking) +""" + [[audits.zip]] who = "Mike Hommey " criteria = "safe-to-run" @@ -5108,6 +5134,24 @@ user-id = 1 # Alex Crichton (alexcrichton) start = "2020-06-03" end = "2024-05-05" +[[trusted.wasm-encoder]] +criteria = "safe-to-deploy" +user-id = 73222 # wasmtime-publish +start = "2024-02-15" +end = "2025-03-11" + +[[trusted.wasm-smith]] +criteria = "safe-to-deploy" +user-id = 73222 # wasmtime-publish +start = "2024-02-15" +end = "2025-03-11" + +[[trusted.wast]] +criteria = "safe-to-deploy" +user-id = 73222 # wasmtime-publish +start = "2024-02-15" +end = "2025-03-11" + [[trusted.winapi-util]] criteria = "safe-to-deploy" user-id = 189 # Andrew Gallant (BurntSushi) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 2692f61bc2..20b62a8210 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -233,6 +233,10 @@ notes = "Local override of the crates.io crate that uses a non-vendored local co [policy.wr_malloc_size_of] audit-as-crates-io = false +[policy.zip] +audit-as-crates-io = true +notes = "Locally patched version of the zip crate to allow for reading omnijars." + [[exemptions.ahash]] version = "0.7.6" criteria = "safe-to-deploy" @@ -805,7 +809,3 @@ criteria = "safe-to-deploy" [[exemptions.xml-rs]] version = "0.8.4" criteria = "safe-to-deploy" - -[[exemptions.zip]] -version = "0.6.2" -criteria = "safe-to-run" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 5913bc8915..73065c6c4f 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -37,8 +37,8 @@ user-login = "Amanieu" user-name = "Amanieu d'Antras" [[publisher.audio_thread_priority]] -version = "0.31.0" -when = "2024-01-17" +version = "0.32.0" +when = "2024-03-14" user-id = 1258 user-login = "padenot" user-name = "Paul Adenot" @@ -57,6 +57,13 @@ user-id = 128763 user-login = "martinthomson" user-name = "Martin Thomson" +[[publisher.bumpalo]] +version = "3.15.4" +when = "2024-03-07" +user-id = 696 +user-login = "fitzgen" +user-name = "Nick Fitzgerald" + [[publisher.byteorder]] version = "1.4.3" when = "2021-03-10" @@ -219,15 +226,15 @@ user-login = "jrmuizel" user-name = "Jeff Muizelaar" [[publisher.glean]] -version = "58.1.0" -when = "2024-03-12" +version = "59.0.0" +when = "2024-03-28" user-id = 48 user-login = "badboy" user-name = "Jan-Erik Rediger" [[publisher.glean-core]] -version = "58.1.0" -when = "2024-03-12" +version = "59.0.0" +when = "2024-03-28" user-id = 48 user-login = "badboy" user-name = "Jan-Erik Rediger" @@ -595,58 +602,67 @@ user-login = "Manishearth" user-name = "Manish Goregaokar" [[publisher.uniffi]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_bindgen]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_build]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_checksum_derive]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_core]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_macros]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_meta]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_testing]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.uniffi_udl]] -version = "0.25.3" -when = "2023-12-07" -user-id = 127697 -user-login = "bendk" +version = "0.27.1" +when = "2024-04-03" +user-id = 111105 +user-login = "mhammond" +user-name = "Mark Hammond" [[publisher.utf8_iter]] version = "1.0.3" @@ -677,25 +693,28 @@ user-login = "alexcrichton" user-name = "Alex Crichton" [[publisher.wasm-encoder]] -version = "0.40.0" -when = "2024-01-24" -user-id = 1 -user-login = "alexcrichton" -user-name = "Alex Crichton" +version = "0.201.0" +when = "2024-02-27" +user-id = 73222 +user-login = "wasmtime-publish" [[publisher.wasm-smith]] -version = "0.15.0" -when = "2024-01-24" -user-id = 1 -user-login = "alexcrichton" -user-name = "Alex Crichton" +version = "0.201.0" +when = "2024-02-27" +user-id = 73222 +user-login = "wasmtime-publish" [[publisher.wast]] -version = "70.0.1" +version = "201.0.0" +when = "2024-02-27" +user-id = 73222 +user-login = "wasmtime-publish" + +[[publisher.weedle2]] +version = "5.0.0" when = "2024-01-24" -user-id = 1 -user-login = "alexcrichton" -user-name = "Alex Crichton" +user-id = 127697 +user-login = "bendk" [[publisher.winapi-util]] version = "0.1.5" @@ -740,6 +759,13 @@ start = "2020-01-14" end = "2024-04-21" notes = "I am an author of this crate." +[[audits.bytecode-alliance.wildcard-audits.bumpalo]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +user-id = 696 # Nick Fitzgerald (fitzgen) +start = "2019-03-16" +end = "2024-03-10" + [[audits.bytecode-alliance.wildcard-audits.derive_arbitrary]] who = "Nick Fitzgerald " criteria = "safe-to-deploy" @@ -748,45 +774,6 @@ start = "2020-01-14" end = "2024-04-27" notes = "I am an author of this crate" -[[audits.bytecode-alliance.wildcard-audits.wasm-encoder]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -user-id = 1 # Alex Crichton (alexcrichton) -start = "2020-12-11" -end = "2024-04-14" -notes = """ -This is a Bytecode Alliance authored crate maintained in the `wasm-tools` -repository of which I'm one of the primary maintainers and publishers for. -I am employed by a member of the Bytecode Alliance and plan to continue doing -so and will actively maintain this crate over time. -""" - -[[audits.bytecode-alliance.wildcard-audits.wasm-smith]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -user-id = 1 # Alex Crichton (alexcrichton) -start = "2020-09-03" -end = "2024-04-14" -notes = """ -This is a Bytecode Alliance authored crate maintained in the `wasm-tools` -repository of which I'm one of the primary maintainers and publishers for. -I am employed by a member of the Bytecode Alliance and plan to continue doing -so and will actively maintain this crate over time. -""" - -[[audits.bytecode-alliance.wildcard-audits.wast]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -user-id = 1 # Alex Crichton (alexcrichton) -start = "2019-10-16" -end = "2024-04-14" -notes = """ -This is a Bytecode Alliance authored crate maintained in the `wasm-tools` -repository of which I'm one of the primary maintainers and publishers for. -I am employed by a member of the Bytecode Alliance and plan to continue doing -so and will actively maintain this crate over time. -""" - [[audits.bytecode-alliance.audits.adler]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -841,12 +828,6 @@ who = "Benjamin Bouvier " criteria = "safe-to-deploy" delta = "0.9.0 -> 0.10.2" -[[audits.bytecode-alliance.audits.bumpalo]] -who = "Nick Fitzgerald " -criteria = "safe-to-deploy" -version = "3.11.1" -notes = "I am the author of this crate." - [[audits.bytecode-alliance.audits.cargo-platform]] who = "Pat Hickey " criteria = "safe-to-deploy" @@ -1303,6 +1284,20 @@ criteria = "safe-to-run" version = "0.2.3" aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" +[[audits.google.audits.unicode-linebreak]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.1.5" +notes = """ +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'`` +and there were no hits. + +Version `0.1.2` of this crate has been added to Chromium in +https://source.chromium.org/chromium/chromium/src/+/591a0f30c5eac93b6a3d981c2714ffa4db28dbcb +The CL description contains a link to a Google-internal document with audit details. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.version_check]] who = "George Burgess IV " criteria = "safe-to-deploy" @@ -1408,6 +1403,87 @@ who = "Brandon Pitman " criteria = "safe-to-deploy" delta = "0.10.7 -> 0.10.8" +[[audits.mozilla.wildcard-audits.uniffi]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2021-11-22" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_bindgen]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2021-11-22" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_build]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2021-11-22" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_checksum_derive]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2023-11-20" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_core]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2023-11-20" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_macros]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2021-11-22" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_meta]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2023-11-20" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_testing]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2023-11-20" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.uniffi_udl]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 111105 # Mark Hammond (mhammond) +start = "2023-11-20" +end = "2024-11-28" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.wildcard-audits.weedle2]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +user-id = 127697 # bendk +start = "2022-06-16" +end = "2025-03-05" +notes = "Maintained by Mozilla" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + [[audits.mozilla.wildcard-audits.zeitstempel]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy" @@ -1455,6 +1531,13 @@ no unsafe code. """ aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" +[[audits.mozilla.audits.goblin]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "0.7.1 -> 0.8.0" +notes = "MSRV bump, no unsafe changes" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + [[audits.mozilla.audits.lazy_static]] who = "Nika Layzell " criteria = "safe-to-deploy" @@ -1476,9 +1559,40 @@ delta = "0.4.18 -> 0.4.20" notes = "Only cfg attribute and internal macro changes and module refactorings" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" +[[audits.mozilla.audits.oneshot-uniffi]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "0.1.5 -> 0.1.6" +notes = "Synced with the orginal crate, no new unsafe" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + [[audits.mozilla.audits.rkv]] who = "Kagami Sascha Rosylight " criteria = "safe-to-deploy" delta = "0.18.4 -> 0.19.0" notes = "Maintained by Mozilla, no addition of unsafe blocks" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.scroll]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "0.11.0 -> 0.12.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.scroll_derive]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "0.11.1 -> 0.12.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.smawk]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +version = "0.3.2" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.textwrap]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +version = "0.15.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -- cgit v1.2.3