From 82da52e23bf9dabb7e82e12aa139ffba2844d7aa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 09:35:29 +0000 Subject: [PATCH 1/2] chore(deps): bump the rust-dependencies group with 5 updates Bumps the rust-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [clap](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` | | [napi](https://github.com/napi-rs/napi-rs) | `3.12.4` | `3.12.6` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.5` | `3.6.7` | | [napi-build](https://github.com/napi-rs/napi-rs) | `2.4.2` | `2.4.4` | | [syn](https://github.com/dtolnay/syn) | `3.0.5` | `3.0.6` | Updates `clap` from 4.6.6 to 4.6.7 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.6...clap_complete-v4.6.7) Updates `napi` from 3.12.4 to 3.12.6 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-v3.12.4...napi-v3.12.6) Updates `napi-derive` from 3.6.5 to 3.6.7 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-derive-v3.6.5...napi-derive-v3.6.7) Updates `napi-build` from 2.4.2 to 2.4.4 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/napi-build-v2.4.2...napi-build-v2.4.4) Updates `syn` from 3.0.5 to 3.0.6 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](https://github.com/dtolnay/syn/compare/3.0.5...3.0.6) --- updated-dependencies: - dependency-name: clap dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi dependency-version: 3.12.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi-derive dependency-version: 3.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: napi-build dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: syn dependency-version: 3.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] --- Cargo.lock | 76 +++++++++++++++++++++++++++--------------------------- 1 file changed, 38 insertions(+), 38 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6250bef36..eda6c0379 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -238,7 +238,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -450,7 +450,7 @@ dependencies = [ "proc-macro2", "quote", "serde", - "syn 3.0.5", + "syn 3.0.6", "tempfile", "toml", ] @@ -664,7 +664,7 @@ checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -830,9 +830,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.6.6" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca" +checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946" dependencies = [ "clap_builder", "clap_derive", @@ -840,9 +840,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.6" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889" +checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d" dependencies = [ "anstyle", "clap_lex", @@ -850,14 +850,14 @@ dependencies = [ [[package]] name = "clap_derive" -version = "4.6.4" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061" +checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0" dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -911,7 +911,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1336,7 +1336,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -1475,7 +1475,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1668,7 +1668,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -2675,7 +2675,7 @@ checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -2938,9 +2938,9 @@ dependencies = [ [[package]] name = "napi" -version = "3.12.4" +version = "3.12.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d2c1d080c842ec1347ebf3cfb9347c15f8c2262f143cc30eea41ddf1c7da720" +checksum = "b7d3c1107f2fda46a7bd2676d65221b7b8160054494b38554b0e055c731714db" dependencies = [ "bitflags 2.13.2", "ctor", @@ -2955,15 +2955,15 @@ dependencies = [ [[package]] name = "napi-build" -version = "2.4.2" +version = "2.4.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "860e7c40864f95cfb83cde99f9ebadd88ef3d9bdccd7dd2cee0cc96a2dd4ffa7" +checksum = "9befcb51d87271051c0c11aaf625d09340266b7f1ac3fef5975e62274dc2813f" [[package]] name = "napi-derive" -version = "3.6.5" +version = "3.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "350057056a30368aa76c11a0d406b0aa61321710be2c36656ab4f6efe0b785a2" +checksum = "7e332e701386d8101b093203e296059ad8aeef58ddd4c75594f3c84ce637405e" dependencies = [ "convert_case", "ctor", @@ -2975,9 +2975,9 @@ dependencies = [ [[package]] name = "napi-derive-backend" -version = "6.1.3" +version = "6.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c1c87a71568f3fe5c736b10878ff55064b250bb4ea4b48c8055713e07b9e463" +checksum = "fd6856fe1686867da90ed0dc292d7c0c87a695eb7c578b913360f33619ee01e3" dependencies = [ "convert_case", "proc-macro2", @@ -2988,9 +2988,9 @@ dependencies = [ [[package]] name = "napi-sys" -version = "3.3.1" +version = "3.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4d29a242104e456960e6c6479847570be731c1a92b8f8c05ddfb5439e5c09915" +checksum = "6801fc65ba4d7035636e93635e281113f00410401a237dcd4f55b1565ead2115" dependencies = [ "libloading 0.9.0", ] @@ -3788,7 +3788,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -4468,7 +4468,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4526,7 +4526,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4746,7 +4746,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -4816,7 +4816,7 @@ checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -5182,9 +5182,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.5" +version = "3.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9" +checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" dependencies = [ "proc-macro2", "quote", @@ -5256,7 +5256,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5312,7 +5312,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -5384,7 +5384,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -5990,7 +5990,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", "wasm-bindgen-shared", ] @@ -6067,7 +6067,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6438,7 +6438,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] From 954a3e63b7357f2e50d4b9607dc8781ba10285e0 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Mon, 21 Sep 2026 18:28:47 -0500 Subject: [PATCH 2/2] chore(supply-chain): audit syn/clap/napi deltas for rust-dependencies group --- supply-chain/audits.toml | 54 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index a43983c97..3c97fa4a5 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -66,12 +66,30 @@ criteria = "safe-to-deploy" delta = "4.6.0 -> 4.6.1" notes = "Reviewed delta: version/dependency metadata plus generated env! guard for derive defaults; clap remains unsafe-forbidden and no new ambient capabilities." +[[audits.clap]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "4.6.6 -> 4.6.7" +notes = "Reviewed derive Command-to-Self renames, defer builder plumbing, and docs; CLI parsing stays bounded with no new unsafe, fs, net, or ambient access." + +[[audits.clap_builder]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "4.6.6 -> 4.6.7" +notes = "Reviewed defer builder support (Arg::defer, Command::defer) plus docs; argument parsing remains in-memory with no new unsafe, IO, or ambient access." + [[audits.clap_derive]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" delta = "4.6.0 -> 4.6.1" notes = "Reviewed delta: derive macro emits compile-time env! guards for Cargo metadata and otherwise metadata/dependency updates; crate forbids unsafe code and adds no new runtime capabilities." +[[audits.clap_derive]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "4.6.4 -> 4.6.7" +notes = "Reviewed defer attribute codegen (Defer magic attr, bool-lit helper, initial/final method ordering); proc-macro output only, no new unsafe or ambient access." + [[audits.combine]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -281,18 +299,48 @@ criteria = "safe-to-deploy" delta = "3.8.4 -> 3.8.5" notes = "Reviewed delta: iterator prototype setup moves to class registration, threadsafe callback error handling preserves causes and avoids shutdown panics, and new unsafe N-API calls operate on env/value handles obtained from Node without new ambient capabilities." +[[audits.napi]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.12.4 -> 3.12.7" +notes = "Reviewed wasm-gated teardown handshake (async-work pending/cancel registry, settlement drain barrier, env null-guard on teardown, threadsafe fatal status); no new fs/net, only existing NAPI unsafe calls." + +[[audits.napi-build]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "2.4.2 -> 2.4.4" +notes = "Reviewed wasi link args for async-work teardown handshake and android format nit; build script only emits link args, no new fs/net access." + [[audits.napi-derive]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" delta = "3.5.3 -> 3.5.4" notes = "Reviewed delta: dependency metadata updates for ctor/napi backend only; proc-macro source unchanged." +[[audits.napi-derive]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.6.5 -> 3.6.8" +notes = "Reviewed parser lint fix removing unused ident binding; proc-macro codegen unchanged, no runtime or ambient access." + [[audits.napi-derive-backend]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" delta = "5.0.2 -> 5.0.3" notes = "Reviewed delta: register_class call now forwards async iterator metadata; no new filesystem/process/network capabilities and generated N-API unsafe shape remains through existing napi abstractions." +[[audits.napi-derive-backend]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "6.1.3 -> 6.1.4" +notes = "Reviewed redundant-borrow removals and too_many_arguments allow; generated bindings unchanged in behavior, no new unsafe or ambient access." + +[[audits.napi-sys]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.3.1 -> 3.3.2" +notes = "Reviewed single const addition napi_cannot_run_js=23 matching Node API; FFI declarations only, no code or ambient access." + [[audits.num-bigint]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -388,6 +436,12 @@ criteria = "safe-to-deploy" delta = "3.0.4 -> 3.0.5" notes = "Reviewed parser diagnostic span adjustments; token consumption and syntax tree construction remain safe and bounded. No unsafe or ambient access." +[[audits.syn]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "3.0.5 -> 3.0.6" +notes = "Reviewed lifetime-group parse guard in expr.rs (Lifetime+End lookahead) plus version bump; token consumption stays bounded. No new unsafe, deps, build scripts, or ambient access." + [[audits.thin-vec]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy"