diff --git a/Cargo.lock b/Cargo.lock index 6274e054f..6ed7a0172 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5567,9 +5567,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "turso_core" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f164caffe00e4708c52b60dd3e28fd43ba2c96118f95c3c1991febef557fea2" +checksum = "58e5f09aaead5dfc87c5a22a2b3e95fb85e2d666e27e5f4a2474c42198af20ec" dependencies = [ "aegis", "aes 0.8.4", @@ -5639,9 +5639,9 @@ dependencies = [ [[package]] name = "turso_ext" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a8875338b1a32565e29eeb3edf653a9d0072c153c03c7f787d2de7d3fa14e250" +checksum = "3902472c63d19191d5982d28542595d1babef787a8482175422ecf7f28100261" dependencies = [ "chrono", "getrandom 0.4.3", @@ -5650,9 +5650,9 @@ dependencies = [ [[package]] name = "turso_macros" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69152450bbc46492069cec2f960b2f17b799dfffc273874a653c024fddea1e4f" +checksum = "63bd5f0f7186707a8b4cf54bbaddff9056c218823befab15508ef6e7502c2340" dependencies = [ "proc-macro2", "quote", @@ -5661,9 +5661,9 @@ dependencies = [ [[package]] name = "turso_parser" -version = "0.8.0-pre.14" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2170ba7e2fafdd0187ae8d39456b782b9c7c890b4b256504e826f6ce91d41b43" +checksum = "25b6d3428f16fff69a13bf7f966628d9fc8e0d097fec6cd84ce1af3d5a9be6b1" dependencies = [ "bitflags 2.13.2", "memchr", diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 0998c2050..b04511698 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -525,6 +525,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.7 -> 0.8.0-pre.8" notes = "Reviewed production delta: unchecked UTF8 requires all-ASCII aggregate; unique uninitialized Arc chunk assembly checks every index and complete size before assume_init. IO children link before submission, builder token prevents premature callbacks, SeqCst completion fires once with owned buffers. Transaction retry/abandonment retains write ownership and releases writer leases. Attached database sync is explicit; FTS storage remains in memory with descriptor bounds. No new host filesystem, network or process access. Source safety review, not formal transactional proof." +[[audits.turso_core]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (295 files, 293 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.turso_ext]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -537,6 +543,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.11 -> 0.8.0-pre.14" notes = "Reviewed the complete package diff: package versions, the vendored commit id, and one build-script fix replacing a cfg!(target_os = ...) test, which reports the *host* in a build script, with the CARGO_CFG_TARGET_OS env var, which reports the target. Extension source is otherwise unchanged; no new runtime, unsafe, or ambient capability." +[[audits.turso_ext]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (8 files, 6 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.turso_macros]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -549,6 +561,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.11 -> 0.8.0-pre.14" notes = "Reviewed the complete package diff: only the package version and the vendored commit id change. Macro source is byte-identical. No runtime, unsafe, host access, or build-script changes." +[[audits.turso_macros]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (13 files, 12 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.turso_parser]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" @@ -561,6 +579,12 @@ criteria = "safe-to-deploy" delta = "0.8.0-pre.11 -> 0.8.0-pre.14" notes = "Reviewed the complete package diff. Adds GENERATED ALWAYS to the column-constraint AST and its formatter; adds blob_literal_bytes, which decodes already-validated hex with chunks_exact(2) so the pairing is bounded (its expect() calls rest on the parser's prior validation); quotes identifiers that begin with a digit, which previously round-tripped as invalid unquoted SQL; and makes an unrecognised STORED/VIRTUAL token a parse error instead of silently yielding None. All safe Rust, fail-closed, no new unsafe or host capability." +[[audits.turso_parser]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.8.0-pre.14 -> 0.8.1" +notes = "Reviewed the 0.8.0-pre.14 -> 0.8.1 delta: the published source trees are byte-identical. Every file except Cargo.toml, Cargo.lock and .cargo_vcs_info.json hashes the same across the two releases (11 files, 9 of them Rust), and the three that differ carry only version strings plus the upstream release commit sha. Nothing to review beyond the version stamp; this is the stable cut of the pre-release already in use." + [[audits.twox-hash]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy"