From 630d38d58dcd5ea42f92d5bc287018c646eccddd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 2 Oct 2026 10:19:00 +0000 Subject: [PATCH 1/2] chore(deps): bump bigdecimal Bumps the rust-dependencies group with 1 update: [bigdecimal](https://github.com/akubera/bigdecimal-rs). Updates `bigdecimal` from 0.4.10 to 0.4.11 - [Release notes](https://github.com/akubera/bigdecimal-rs/releases) - [Commits](https://github.com/akubera/bigdecimal-rs/commits) --- updated-dependencies: - dependency-name: bigdecimal dependency-version: 0.4.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] --- Cargo.lock | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index bff366edc..6274e054f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -534,9 +534,9 @@ dependencies = [ [[package]] name = "bigdecimal" -version = "0.4.10" +version = "0.4.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4d6867f1565b3aad85681f1015055b087fcfd840d6aeee6eee7f2da317603695" +checksum = "8fa3f3d8cbf4dffcfe4991de61d012bef509a409ecbe9dd41049bfe32b4d4653" dependencies = [ "autocfg", "libm", @@ -918,7 +918,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1482,7 +1482,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4450,7 +4450,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4508,7 +4508,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5235,10 +5235,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5680,7 +5680,7 @@ version = "2.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a" dependencies = [ - "rand 0.9.5", + "rand 0.10.3", ] [[package]] @@ -6049,7 +6049,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] From 125f7366377217747466151de424f13c76a7cab4 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sat, 3 Oct 2026 09:18:12 +0000 Subject: [PATCH 2/2] chore(deps): certify bigdecimal 0.4.11 for cargo-vet The bump itself is green except for `cargo vet --locked`, which had no path to 0.4.11 and failed the Audit job (and with it the aggregate Check gate). This adds the delta audit off the existing 0.4.10 exemption, which stays: removing it breaks the chain and vetting fails again, verified. 0.4.11 is an allocation-reduction release. New in-place assign paths (`addassign_scaled_biguint`, `mulassign_bigdecimal_ref`, `mulassign_bigint_biguint_ref`) and a `WithScale` wrapper replace clone-and-rebuild, `BigDecimalRef` is used where a `BigDecimal` was materialized, and the inverse Newton iteration reuses one scratch value instead of allocating per step. Two new modules, `division` and `exp`: the exp series loop is bounded by `2 * precision` with a floor of 10, division asserts a non-zero denominator and uses `checked_sub` on bit counts, and the digit/bit count helpers round-trip through f64 where Rust's saturating casts bound the result. No unsafe, no filesystem, network, process or env access, build.rs unchanged, and no new dependencies. Cargo.toml's only non-version change is a clippy lint level. Source safety review, not a numerical-correctness proof. The three transitive moves in this lockfile (tempfile's getrandom 0.3.4 -> 0.4.3, uuid's rand 0.9.5 -> 0.10.3, windows-sys 0.52.0 -> 0.61.2) are the resolver consolidating onto versions already in the graph; none is a direct dependency and all were already vetted. Tests: `cargo vet --locked` succeeds (26 fully audited, 71 partially audited, 519 exempted). Claude-Session: https://claude.ai/code/session_011LreyTqM6VT51zNTJSD4Pi --- supply-chain/audits.toml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 07d0ce730..0998c2050 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -42,6 +42,12 @@ criteria = "safe-to-deploy" delta = "0.44.0 -> 0.45.0" notes = "Reviewed C/FFI and generated symbol-prefix delta. EVP buffers final padded block; GCM checks IV length before subtraction; ML-DSA exact signature/extmu sizes, ML-KEM constant-time validation and parameter bounds retained. Keccak contexts bounded and cleansed; Brainpool immutable once groups. Builder flags preserve jitterentropy O0; fixed CPU discovery and existing compiler toolchain only. Source safety review, not cryptographic proof." +[[audits.bigdecimal]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.4.10 -> 0.4.11" +notes = "Reviewed allocation-reduction delta: new in-place assign paths (addassign_scaled_biguint, mulassign_bigdecimal_ref, mulassign_bigint_biguint_ref) and a WithScale wrapper replace clone-and-rebuild, and the inverse Newton iteration reuses one scratch BigDecimal. New division and exp modules: the exp series loop is bounded by 2*precision with a minimum of 10, division asserts a non-zero denominator and uses checked_sub on bit counts. Digit/bit count helpers go through f64, where Rust's saturating casts bound the result. No unsafe, no fs/net/process/env access, build.rs unchanged, no new dependencies; Cargo.toml adds only a clippy lint level." + [[audits.blake2]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy"