From 5ef9f350ad23802d4a1b8143f41a6e0a994a5657 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Tue, 20 Oct 2026 09:47:39 +0000 Subject: [PATCH] chore(deps): land the safe rust-dependencies bumps and hold oxc at 0.117.x This week's aggregated `chore(deps)` group (#2758) could not merge as one unit: three patch bumps are fine, and the `oxc_*` 0.117 -> 0.154 jump in the same PR cannot land at all. Landed here: sha2 0.11.0 -> 0.11.1, syn 3.0.8 -> 3.0.9, tokio 1.53.2 -> 1.53.3. Lockfile-only; `cargo build --workspace` is clean. The first two already went in through the fuzz lockfile in #2755. `cargo vet` needed no new exemptions for them. Refreshing `imports.lock` picks up upstream mozilla/bytecodealliance audits that already cover all three, and it retires seven exemptions those imports now subsume (bit-set, bit-vec, core_detect, futures-core, pastey, pkg-config, tracing-core), so the audited share of the graph goes up rather than down. `oxc_*` is added to dependabot's `ignore` list. bashkit declares five oxc crates for the wasm32-unknown-unknown TypeScript path, where `zapcode_browser/parser` walks the oxc AST directly, and the versions exist to match what upstream ZapCode vendors. `zapcode-core` 1.5.1 requires `oxc ^0.117` and does not move with them, so the bump resolved a second copy of all 13 oxc crates and put the two sides of one parser pipeline 37 minor versions apart. oxc 0.154 also requires rustc 1.97.0 against the 1.95.0 pin, which is what reddened the `WASM web package` job, and it pulled in 19 unvetted crates. Ignored outright rather than by update-type: every release past 0.117.x splits the graph the same way, so there is no version to bump to until `zapcode-core` moves upstream. Without the entry dependabot reopens the same unlandable PR every week. --- .github/dependabot.yml | 24 +++++++ Cargo.lock | 84 +++++++++++----------- knowledge/operations/dependencies.md | 25 +++++++ supply-chain/config.toml | 32 +-------- supply-chain/imports.lock | 100 ++++++++++++++++++++++++++- 5 files changed, 191 insertions(+), 74 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b50cfb09c..b210430e8 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -107,6 +107,30 @@ updates: # rationale sits next to the dep in the root Cargo.toml. - dependency-name: "branches" + # oxc_* is held at 0.117.x, and not for API churn alone. bashkit declares + # these five (`oxc_parser`, `oxc_ast`, `oxc_allocator`, `oxc_span`, + # `oxc_syntax`) for the wasm32-unknown-unknown TypeScript path, where + # `zapcode_browser/parser` walks the oxc AST directly. The versions exist + # to match what upstream `zapcode-core` vendors — see the pin comment next + # to the deps in crates/bashkit/Cargo.toml. + # + # `zapcode-core` 1.5.1 requires `oxc ^0.117`, so it does not move with a + # bump of bashkit's declaration. #2758 bumped to 0.154.0 and resolved a + # *second* copy of all 13 oxc crates, leaving the two sides of the same + # parser pipeline on trees 37 minor versions apart — and 0.154 also needs + # rustc 1.97.0 against the 1.95.0 in rust-toolchain.toml, which is what + # reddened the "WASM web package" job, the same shape as the wasmtime + # 49.x failure in #2708. It also pulled in 19 unvetted crates + # (`compact_str` 0.10, `phf` 0.14, `oxc_index` 5.0 and the oxc stack). + # + # Ignore outright rather than by update-type: every release past 0.117.x + # splits the graph the same way, so no bump helps until `zapcode-core` + # moves upstream. Doing it then means bumping the pinned toolchain and + # porting the vendored parser together — a deliberate change, not an + # aggregated `chore(deps)` PR. Without this entry dependabot reopens the + # same unlandable PR every week. + - dependency-name: "oxc_*" + # Fuzz targets are a separate cargo workspace with their own lockfile, so the # "/" entry above never touches them. Without this the fuzz lockfile silently # rots between releases (it drifted onto an unsound `anyhow` and two yanked diff --git a/Cargo.lock b/Cargo.lock index d41ed3467..0c957da92 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -253,7 +253,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -418,7 +418,7 @@ dependencies = [ "serde_norway", "serial_test", "sha1", - "sha2 0.11.0", + "sha2 0.11.1", "tempfile", "thiserror", "tokio", @@ -484,7 +484,7 @@ dependencies = [ "proc-macro2", "quote", "serde", - "syn 3.0.8", + "syn 3.0.9", "tempfile", "toml", ] @@ -585,7 +585,7 @@ checksum = "144e573728da132683b9488acd528274c790e07fc06ff81ee29f9d8f8b1041e0" dependencies = [ "blowfish", "pbkdf2", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -727,7 +727,7 @@ dependencies = [ "proc-macro-crate", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -782,7 +782,7 @@ checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -975,7 +975,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -1029,7 +1029,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1640,7 +1640,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -1696,7 +1696,7 @@ dependencies = [ "ed25519", "rand_core 0.10.1", "serde", - "sha2 0.11.0", + "sha2 0.11.1", "signature", "subtle", "zeroize", @@ -1779,7 +1779,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1966,7 +1966,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -2983,7 +2983,7 @@ checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -3303,7 +3303,7 @@ dependencies = [ "napi-derive-backend", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -3316,7 +3316,7 @@ dependencies = [ "proc-macro2", "quote", "semver", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -3687,7 +3687,7 @@ dependencies = [ "elliptic-curve", "primefield", "primeorder", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -3701,7 +3701,7 @@ dependencies = [ "fiat-crypto", "primefield", "primeorder", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -3715,7 +3715,7 @@ dependencies = [ "elliptic-curve", "primefield", "primeorder", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -3750,7 +3750,7 @@ dependencies = [ "futures", "log", "rand 0.10.3", - "sha2 0.11.0", + "sha2 0.11.1", "thiserror", "tokio", "windows", @@ -3969,7 +3969,7 @@ dependencies = [ "pbkdf2", "rand_core 0.10.1", "scrypt", - "sha2 0.11.0", + "sha2 0.11.1", "spki", ] @@ -4133,7 +4133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -4641,7 +4641,7 @@ dependencies = [ "pkcs1", "pkcs8", "rand_core 0.10.1", - "sha2 0.11.0", + "sha2 0.11.1", "signature", "spki", "zeroize", @@ -4788,7 +4788,7 @@ dependencies = [ "scrypt", "sec1", "sha1", - "sha2 0.11.0", + "sha2 0.11.1", "sha3 0.12.0", "signature", "spki", @@ -4867,7 +4867,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4925,7 +4925,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5040,7 +5040,7 @@ dependencies = [ "cfg-if", "pbkdf2", "salsa20", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -5149,7 +5149,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -5219,7 +5219,7 @@ checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -5252,9 +5252,9 @@ dependencies = [ [[package]] name = "sha2" -version = "0.11.0" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" +checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19" dependencies = [ "cfg-if", "cpufeatures 0.3.1", @@ -5515,7 +5515,7 @@ dependencies = [ "rsa", "sec1", "sha1", - "sha2 0.11.0", + "sha2 0.11.1", "signature", "ssh-cipher", "ssh-encoding", @@ -5596,9 +5596,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.8" +version = "3.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "01016da373cd8f7ef12624f796309f5c31ba8d646dd08856c02cd741d823c622" +checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b" dependencies = [ "proc-macro2", "quote", @@ -5667,10 +5667,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5735,7 +5735,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -5785,9 +5785,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.2" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "libc", @@ -5807,7 +5807,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -6446,7 +6446,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", "wasm-bindgen-shared", ] @@ -6769,7 +6769,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7181,7 +7181,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] diff --git a/knowledge/operations/dependencies.md b/knowledge/operations/dependencies.md index fbbba52c8..cfc18a3b6 100644 --- a/knowledge/operations/dependencies.md +++ b/knowledge/operations/dependencies.md @@ -133,6 +133,31 @@ no runtime surface by itself. Remove it when `branches` compiles on nightly without `std`. +## oxc is held at 0.117.x by the vendored ZapCode parser + +`bashkit` declares five oxc crates (`oxc_parser`, `oxc_ast`, `oxc_allocator`, +`oxc_span`, `oxc_syntax`) for the `wasm32-unknown-unknown` TypeScript path, +where `zapcode_browser/parser` walks the oxc AST directly rather than going +through the published `zapcode-core`. The versions are chosen to match what +upstream ZapCode vendors, so the two sides of the same parser pipeline agree. + +`zapcode-core` 1.5.1 requires `oxc ^0.117`, so it does not move when bashkit's +declaration does. #2758 bumped the declaration to 0.154.0 and Cargo resolved a +**second** copy of all 13 oxc crates — `oxc_parser`, `oxc_ast` and the rest +each appearing at both 0.117.0 and 0.154.0 — putting the vendored parser and +`zapcode-core` 37 minor versions apart. Two further costs came with it: oxc +0.154 requires rustc 1.97.0 against the 1.95.0 in `rust-toolchain.toml` (the +`WASM web package` job failed at resolution, the same shape as the wasmtime +49.x failure in #2708), and it added 19 unvetted crates, including +`compact_str` 0.10, `phf` 0.14 and `oxc_index` 5.0. + +`oxc_*` is therefore in dependabot's `ignore` list outright, not by +update-type: every release past 0.117.x splits the graph the same way, so there +is no version to bump to. Lifting it waits on a `zapcode-core` release built +against a newer oxc, and then means bumping the pinned toolchain and porting +the vendored parser in one deliberate change — not inside an aggregated +`chore(deps)` PR. + ## Measure size and audit surface separately The `idna_adapter` pin removes 21 crates but only **15 KB (0.16%)** from the diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 99ee679bf..f71744dd7 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -178,14 +178,6 @@ criteria = "safe-to-deploy" version = "0.4.10" criteria = "safe-to-deploy" -[[exemptions.bit-set]] -version = "0.11.1" -criteria = "safe-to-run" - -[[exemptions.bit-vec]] -version = "0.10.1" -criteria = "safe-to-run" - [[exemptions.bitflags]] version = "1.3.2" criteria = "safe-to-deploy" @@ -384,10 +376,6 @@ criteria = "safe-to-deploy" version = "0.10.1" criteria = "safe-to-deploy" -[[exemptions.core_detect]] -version = "1.0.0" -criteria = "safe-to-run" - [[exemptions.cow-utils]] version = "0.1.3" criteria = "safe-to-deploy" @@ -652,10 +640,6 @@ criteria = "safe-to-deploy" version = "0.3.34" criteria = "safe-to-deploy" -[[exemptions.futures-core]] -version = "0.3.34" -criteria = "safe-to-deploy" - [[exemptions.futures-executor]] version = "0.3.34" criteria = "safe-to-deploy" @@ -1301,10 +1285,6 @@ criteria = "safe-to-deploy" version = "0.6.1" criteria = "safe-to-deploy" -[[exemptions.pastey]] -version = "0.2.3" -criteria = "safe-to-deploy" - [[exemptions.pbkdf2]] version = "0.13.0" criteria = "safe-to-deploy" @@ -1375,10 +1355,6 @@ criteria = "safe-to-deploy" version = "0.11.0" criteria = "safe-to-deploy" -[[exemptions.pkg-config]] -version = "0.3.34" -criteria = "safe-to-deploy" - [[exemptions.plotters]] version = "0.3.7" criteria = "safe-to-run" @@ -1789,7 +1765,7 @@ version = "0.10.9" criteria = "safe-to-deploy" [[exemptions.sha2]] -version = "0.11.0" +version = "0.11.1" criteria = "safe-to-deploy" [[exemptions.sha3]] @@ -1913,7 +1889,7 @@ version = "2.0.119" criteria = "safe-to-deploy" [[exemptions.syn]] -version = "3.0.4" +version = "3.0.9" criteria = "safe-to-deploy" [[exemptions.sync_wrapper]] @@ -2028,10 +2004,6 @@ criteria = "safe-to-deploy" version = "0.1.31" criteria = "safe-to-deploy" -[[exemptions.tracing-core]] -version = "0.1.36" -criteria = "safe-to-deploy" - [[exemptions.tracing-subscriber]] version = "0.3.23" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 687226848..1d6db1da2 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -112,8 +112,8 @@ user-login = "epage" user-name = "Ed Page" [[publisher.tokio]] -version = "1.53.1" -when = "2026-07-20" +version = "1.53.3" +when = "2026-10-13" user-id = 6741 user-login = "Darksonn" user-name = "Alice Ryhl" @@ -683,6 +683,17 @@ this crate has to do with iterators and `Result` and such. No `unsafe` or anything like that, all looks good. """ +[[audits.bytecodealliance.audits.futures-core]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +version = "0.3.27" +notes = "Unsafe used to implement a concurrency primitive AtomicWaker. Well-commented and not obviously incorrect. Like my other audits of these concurrency primitives inside the futures family, I couldn't certify that it is correct without formal methods, but that is out of scope for this vetting." + +[[audits.bytecodealliance.audits.futures-core]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +delta = "0.3.28 -> 0.3.31" + [[audits.bytecodealliance.audits.heck]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -741,6 +752,12 @@ criteria = "safe-to-deploy" version = "0.2.19" notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected." +[[audits.bytecodealliance.audits.pastey]] +who = "Chris Fallin " +criteria = "safe-to-deploy" +version = "0.2.1" +notes = "No unsafe code." + [[audits.bytecodealliance.audits.percent-encoding]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -751,6 +768,26 @@ a few `unsafe` blocks related to utf-8 validation which are locally verifiable as correct and otherwise this crate is good to go. """ +[[audits.bytecodealliance.audits.pkg-config]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +version = "0.3.25" +notes = "This crate shells out to the pkg-config executable, but it appears to sanitize inputs reasonably." + +[[audits.bytecodealliance.audits.pkg-config]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.3.26 -> 0.3.29" +notes = """ +No `unsafe` additions or anything outside of the purview of the crate in this +change. +""" + +[[audits.bytecodealliance.audits.pkg-config]] +who = "Chris Fallin " +criteria = "safe-to-deploy" +delta = "0.3.29 -> 0.3.32" + [[audits.bytecodealliance.audits.postcard]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -811,6 +848,12 @@ intended to multiplex across the internal representation of a tinyvec, presumably. This trivially doesn't contain anything bad. """ +[[audits.bytecodealliance.audits.tracing-core]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.1.33 -> 0.1.34" +notes = "Mostly just an update with Rust stylistic conventions changing. Nothing awry." + [[audits.bytecodealliance.audits.tracing-log]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -1028,6 +1071,18 @@ criteria = "safe-to-deploy" delta = "1.2.1 -> 1.2.2" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.futures-core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.27 -> 0.3.28" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.futures-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.3.31 -> 0.3.34" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" + [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -1084,6 +1139,12 @@ version = "11.1.5" notes = "Small random number generator, explicitly not cryptographically secure, no use of unsafe code, no dependencies" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" +[[audits.mozilla.audits.pastey]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +delta = "0.2.1 -> 0.2.3" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.percent-encoding]] who = "Valentin Gosu " criteria = "safe-to-deploy" @@ -1102,6 +1163,18 @@ criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.pkg-config]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.25 -> 0.3.26" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.pkg-config]] +who = "Max Inden " +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.34" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.rustc_version]] who = "Nika Layzell " criteria = "safe-to-deploy" @@ -1218,6 +1291,29 @@ criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.tracing-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.1.30" +notes = """ +Most unsafe code is in implementing non-std sync primitives. Unsafe impls are +logically correct and justified in comments, and unsafe code is sound and +justified in comments. +""" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Mark Hammond " +criteria = "safe-to-deploy" +delta = "0.1.30 -> 0.1.33" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.1.34 -> 0.1.36" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" + [[audits.mozilla.audits.unicode-linebreak]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy"