From 3ed999c39709f874422ebaebb359df0ebb331932 Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Tue, 10 Jan 2023 14:54:54 +0000 Subject: [PATCH] qa: Import Rust crate audits from Firefox --- qa/supply-chain/config.toml | 51 +-- qa/supply-chain/imports.lock | 679 ++++++++++++++++++++++++++++++++++- 2 files changed, 681 insertions(+), 49 deletions(-) diff --git a/qa/supply-chain/config.toml b/qa/supply-chain/config.toml index 621bbf538..6aabef5f4 100644 --- a/qa/supply-chain/config.toml +++ b/qa/supply-chain/config.toml @@ -1,6 +1,9 @@ # cargo-vet config file +[imports.firefox] +url = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [policy.equihash] audit-as-crates-io = true @@ -67,10 +70,6 @@ criteria = "safe-to-deploy" version = "0.7.2" criteria = "safe-to-deploy" -[[exemptions.autocfg]] -version = "1.1.0" -criteria = "safe-to-deploy" - [[exemptions.backtrace]] version = "0.3.66" criteria = "safe-to-deploy" @@ -263,10 +262,6 @@ criteria = "safe-to-deploy" version = "0.7.0" criteria = "safe-to-deploy" -[[exemptions.fnv]] -version = "1.0.7" -criteria = "safe-to-deploy" - [[exemptions.fpe]] version = "0.5.1" criteria = "safe-to-deploy" @@ -319,10 +314,6 @@ criteria = "safe-to-deploy" version = "0.8.1" criteria = "safe-to-deploy" -[[exemptions.hashbrown]] -version = "0.12.3" -criteria = "safe-to-deploy" - [[exemptions.hdwallet]] version = "0.3.1" criteria = "safe-to-deploy" @@ -331,10 +322,6 @@ criteria = "safe-to-deploy" version = "0.1.19" criteria = "safe-to-deploy" -[[exemptions.hex]] -version = "0.4.3" -criteria = "safe-to-deploy" - [[exemptions.hmac]] version = "0.11.0" criteria = "safe-to-deploy" @@ -411,10 +398,6 @@ criteria = "safe-to-deploy" version = "0.4.7" criteria = "safe-to-deploy" -[[exemptions.log]] -version = "0.4.16" -criteria = "safe-to-deploy" - [[exemptions.mach]] version = "0.3.2" criteria = "safe-to-deploy" @@ -475,18 +458,6 @@ criteria = "safe-to-deploy" version = "0.46.0" criteria = "safe-to-deploy" -[[exemptions.num-bigint]] -version = "0.4.3" -criteria = "safe-to-deploy" - -[[exemptions.num-integer]] -version = "0.1.44" -criteria = "safe-to-deploy" - -[[exemptions.num-traits]] -version = "0.2.15" -criteria = "safe-to-deploy" - [[exemptions.num_cpus]] version = "1.13.1" criteria = "safe-to-deploy" @@ -595,10 +566,6 @@ criteria = "safe-to-deploy" version = "0.9.3" criteria = "safe-to-deploy" -[[exemptions.quote]] -version = "1.0.21" -criteria = "safe-to-deploy" - [[exemptions.radium]] version = "0.7.0" criteria = "safe-to-deploy" @@ -639,14 +606,6 @@ criteria = "safe-to-deploy" version = "10.6.0" criteria = "safe-to-deploy" -[[exemptions.rayon]] -version = "1.5.3" -criteria = "safe-to-deploy" - -[[exemptions.rayon-core]] -version = "1.9.3" -criteria = "safe-to-deploy" - [[exemptions.reddsa]] version = "0.3.0" criteria = "safe-to-deploy" @@ -763,10 +722,6 @@ criteria = "safe-to-deploy" version = "1.0.102" criteria = "safe-to-deploy" -[[exemptions.synstructure]] -version = "0.12.6" -criteria = "safe-to-deploy" - [[exemptions.tap]] version = "1.0.1" criteria = "safe-to-deploy" diff --git a/qa/supply-chain/imports.lock b/qa/supply-chain/imports.lock index 428c8adae..eb23a10ca 100644 --- a/qa/supply-chain/imports.lock +++ b/qa/supply-chain/imports.lock @@ -1,5 +1,682 @@ # cargo-vet imports lock -[audits] +[[audits.firefox.audits.aho-corasick]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.7.18 -> 0.7.20" + +[[audits.firefox.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.57 -> 1.0.61" + +[[audits.firefox.audits.anyhow]] +who = "Bobby Holley " +criteria = "safe-to-deploy" +delta = "1.0.58 -> 1.0.57" +notes = "No functional differences, just CI config and docs." + +[[audits.firefox.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.61 -> 1.0.62" + +[[audits.firefox.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.62 -> 1.0.68" + +[[audits.firefox.audits.autocfg]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "1.1.0" +notes = "All code written or reviewed by Josh Stone." + +[[audits.firefox.audits.block-buffer]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.10.2 -> 0.10.3" + +[[audits.firefox.audits.bumpalo]] +who = "Bobby Holley " +criteria = "safe-to-run" +delta = "3.9.1 -> 3.10.0" +notes = """ +Some nontrivial functional changes but certainly meets the no-malware bar of +safe-to-run. If we needed safe-to-deploy for this in m-c I'd ask Nick to re- +certify this version, but we don't, so this is fine for now. +""" + +[[audits.firefox.audits.bytes]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.1.0 -> 1.2.1" + +[[audits.firefox.audits.bytes]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.2.1 -> 1.3.0" + +[[audits.firefox.audits.cpufeatures]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.2 -> 0.2.4" + +[[audits.firefox.audits.cpufeatures]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.4 -> 0.2.5" + +[[audits.firefox.audits.crossbeam-channel]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.5.4 -> 0.5.6" + +[[audits.firefox.audits.crossbeam-deque]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.8.1 -> 0.8.2" + +[[audits.firefox.audits.crossbeam-epoch]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.9.8 -> 0.9.10" + +[[audits.firefox.audits.crossbeam-epoch]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.9.10 -> 0.9.13" + +[[audits.firefox.audits.crossbeam-utils]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.8.8 -> 0.8.11" + +[[audits.firefox.audits.crossbeam-utils]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.8.11 -> 0.8.14" + +[[audits.firefox.audits.crypto-common]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.3 -> 0.1.6" + +[[audits.firefox.audits.digest]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.10.3 -> 0.10.6" + +[[audits.firefox.audits.either]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.6.1 -> 1.7.0" + +[[audits.firefox.audits.either]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.7.0 -> 1.8.0" + +[[audits.firefox.audits.fnv]] +who = "Bobby Holley " +criteria = "safe-to-deploy" +version = "1.0.7" +notes = "Simple hasher implementation with no unsafe code." + +[[audits.firefox.audits.futures-channel]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.21 -> 0.3.23" + +[[audits.firefox.audits.futures-channel]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.23 -> 0.3.25" + +[[audits.firefox.audits.futures-core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.21 -> 0.3.23" + +[[audits.firefox.audits.futures-core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.23 -> 0.3.25" + +[[audits.firefox.audits.futures-task]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.21 -> 0.3.23" + +[[audits.firefox.audits.futures-task]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.23 -> 0.3.25" + +[[audits.firefox.audits.futures-util]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.21 -> 0.3.23" + +[[audits.firefox.audits.futures-util]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.23 -> 0.3.25" + +[[audits.firefox.audits.generic-array]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.14.5 -> 0.14.6" + +[[audits.firefox.audits.getrandom]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.6 -> 0.2.7" + +[[audits.firefox.audits.getrandom]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.7 -> 0.2.8" + +[[audits.firefox.audits.hashbrown]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +version = "0.12.3" +notes = "This version is used in rust's libstd, so effectively we're already trusting it" + +[[audits.firefox.audits.hex]] +who = "Simon Friedberger " +criteria = "safe-to-deploy" +version = "0.4.3" + +[[audits.firefox.audits.httparse]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "1.7.1 -> 1.8.0" + +[[audits.firefox.audits.hyper]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.14.19 -> 0.14.20" + +[[audits.firefox.audits.hyper]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.14.20 -> 0.14.22" + +[[audits.firefox.audits.hyper]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.14.22 -> 0.14.23" + +[[audits.firefox.audits.indexmap]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.8.2 -> 1.9.1" + +[[audits.firefox.audits.indexmap]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.9.1 -> 1.9.2" + +[[audits.firefox.audits.itoa]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.2 -> 1.0.3" + +[[audits.firefox.audits.itoa]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.3 -> 1.0.5" + +[[audits.firefox.audits.libc]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.126 -> 0.2.132" + +[[audits.firefox.audits.libc]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.132 -> 0.2.138" + +[[audits.firefox.audits.libc]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.138 -> 0.2.139" + +[[audits.firefox.audits.lock_api]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.4.7 -> 0.4.9" + +[[audits.firefox.audits.log]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +version = "0.4.17" + +[[audits.firefox.audits.memoffset]] +who = "Gabriele Svelto " +criteria = "safe-to-deploy" +delta = "0.6.5 -> 0.7.1" + +[[audits.firefox.audits.miniz_oxide]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.5.3 -> 0.6.2" + +[[audits.firefox.audits.nix]] +who = "Gabriele Svelto " +criteria = "safe-to-deploy" +delta = "0.15.0 -> 0.25.0" +notes = "Plenty of new bindings but also several important bug fixes (including buffer overflows). New unsafe sections are restricted to wrappers and are no more dangerous than calling the C functions." + +[[audits.firefox.audits.nix]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.25.0 -> 0.25.1" + +[[audits.firefox.audits.num-bigint]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "0.2.6" +notes = "All code written or reviewed by Josh Stone." + +[[audits.firefox.audits.num-bigint]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "0.4.3" +notes = "All code written or reviewed by Josh Stone." + +[[audits.firefox.audits.num-integer]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "0.1.45" +notes = "All code written or reviewed by Josh Stone." + +[[audits.firefox.audits.num-traits]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "0.2.15" +notes = "All code written or reviewed by Josh Stone." + +[[audits.firefox.audits.num_cpus]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.13.1 -> 1.14.0" + +[[audits.firefox.audits.object]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.28.4 -> 0.30.0" + +[[audits.firefox.audits.once_cell]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.12.0 -> 1.13.1" + +[[audits.firefox.audits.once_cell]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.13.1 -> 1.16.0" + +[[audits.firefox.audits.parking_lot_core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.8.5 -> 0.8.6" + +[[audits.firefox.audits.ppv-lite86]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.16 -> 0.2.17" + +[[audits.firefox.audits.proc-macro2]] +who = "Nika Layzell " +criteria = "safe-to-deploy" +version = "1.0.39" +notes = """ +`proc-macro2` acts as either a thin(-ish) wrapper around the std-provided +`proc_macro` crate, or as a fallback implementation of the crate, depending on +where it is used. + +If using this crate on older versions of rustc (1.56 and earlier), it will +temporarily replace the panic handler while initializing in order to detect if +it is running within a `proc_macro`, which could lead to surprising behaviour. +This should not be an issue for more recent compiler versions, which support +`proc_macro::is_available()`. + +The `proc-macro2` crate's fallback behaviour is not identical to the complex +behaviour of the rustc compiler (e.g. it does not perform unicode normalization +for identifiers), however it behaves well enough for its intended use-case +(tests and scripts processing rust code). + +`proc-macro2` does not use unsafe code, however exposes one `unsafe` API to +allow bypassing checks in the fallback implementation when constructing +`Literal` using `from_str_unchecked`. This was intended to only be used by the +`quote!` macro, however it has been removed +(https://github.com/dtolnay/quote/commit/f621fe64a8a501cae8e95ebd6848e637bbc79078), +and is likely completely unused. Even when used, this API shouldn't be able to +cause unsoundness. +""" + +[[audits.firefox.audits.proc-macro2]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.39 -> 1.0.43" + +[[audits.firefox.audits.proc-macro2]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.43 -> 1.0.49" + +[[audits.firefox.audits.quote]] +who = "Nika Layzell " +criteria = "safe-to-deploy" +version = "1.0.18" +notes = """ +`quote` is a utility crate used by proc-macros to generate TokenStreams +conveniently from source code. The bulk of the logic is some complex +interlocking `macro_rules!` macros which are used to parse and build the +`TokenStream` within the proc-macro. + +This crate contains no unsafe code, and the internal logic, while difficult to +read, is generally straightforward. I have audited the the quote macros, ident +formatter, and runtime logic. +""" + +[[audits.firefox.audits.quote]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.18 -> 1.0.21" + +[[audits.firefox.audits.quote]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.21 -> 1.0.23" + +[[audits.firefox.audits.radium]] +who = "Nika Layzell " +criteria = "safe-to-deploy" +version = "0.5.3" +notes = """ +I am no longer the primary maintainer of `radium`, however I have audited the +code to ensure it is still correct. The implementation contains no `unsafe` +logic, and will not abstract away `Sync` trait bounds. + +The core logic is very simple, and acts as an abstraction trait for `Cell` +and `AtomicT`. +""" + +[[audits.firefox.audits.rand_core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.6.3 -> 0.6.4" + +[[audits.firefox.audits.rayon]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "1.5.3" +notes = "All code written or reviewed by Josh Stone or Niko Matsakis." + +[[audits.firefox.audits.rayon]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.5.3 -> 1.6.1" + +[[audits.firefox.audits.rayon-core]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "1.9.3" +notes = "All code written or reviewed by Josh Stone or Niko Matsakis." + +[[audits.firefox.audits.rayon-core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.9.3 -> 1.10.1" + +[[audits.firefox.audits.redox_syscall]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.13 -> 0.2.16" + +[[audits.firefox.audits.regex]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.5.6 -> 1.6.0" + +[[audits.firefox.audits.regex]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.6.0 -> 1.7.0" + +[[audits.firefox.audits.regex-syntax]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.6.26 -> 0.6.27" + +[[audits.firefox.audits.regex-syntax]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.6.27 -> 0.6.28" + +[[audits.firefox.audits.ryu]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.10 -> 1.0.11" + +[[audits.firefox.audits.ryu]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.11 -> 1.0.12" + +[[audits.firefox.audits.serde]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.137 -> 1.0.143" + +[[audits.firefox.audits.serde]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.143 -> 1.0.144" + +[[audits.firefox.audits.serde]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.144 -> 1.0.151" + +[[audits.firefox.audits.serde]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.151 -> 1.0.152" + +[[audits.firefox.audits.serde_derive]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.137 -> 1.0.143" + +[[audits.firefox.audits.serde_derive]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.143 -> 1.0.144" + +[[audits.firefox.audits.serde_derive]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.144 -> 1.0.151" + +[[audits.firefox.audits.serde_derive]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.151 -> 1.0.152" + +[[audits.firefox.audits.serde_json]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.81 -> 1.0.83" + +[[audits.firefox.audits.serde_json]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.83 -> 1.0.85" + +[[audits.firefox.audits.serde_json]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.85 -> 1.0.91" + +[[audits.firefox.audits.sha2]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.10.2 -> 0.10.6" + +[[audits.firefox.audits.smallvec]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.8.0 -> 1.9.0" + +[[audits.firefox.audits.smallvec]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.9.0 -> 1.10.0" + +[[audits.firefox.audits.socket2]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.4.4 -> 0.4.7" + +[[audits.firefox.audits.syn]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.96 -> 1.0.99" + +[[audits.firefox.audits.syn]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.99 -> 1.0.107" + +[[audits.firefox.audits.synstructure]] +who = "Nika Layzell " +criteria = "safe-to-deploy" +version = "0.12.6" +notes = """ +I am the primary author of the `synstructure` crate, and its current +maintainer. The one use of `unsafe` is unnecessary, but documented and +harmless. It will be removed in the next version. +""" + +[[audits.firefox.audits.thiserror]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.31 -> 1.0.32" + +[[audits.firefox.audits.thiserror]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.32 -> 1.0.38" + +[[audits.firefox.audits.thiserror-impl]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.31 -> 1.0.32" + +[[audits.firefox.audits.thiserror-impl]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.32 -> 1.0.38" + +[[audits.firefox.audits.time]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.44 -> 0.1.45" + +[[audits.firefox.audits.time]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.3.9 -> 0.3.17" + +[[audits.firefox.audits.time-macros]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.2.4 -> 0.2.6" + +[[audits.firefox.audits.toml]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.5.9 -> 0.5.10" + +[[audits.firefox.audits.tower-service]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.3.1 -> 0.3.2" + +[[audits.firefox.audits.tracing]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.1.35 -> 0.1.36" + +[[audits.firefox.audits.tracing]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.1.36 -> 0.1.37" + +[[audits.firefox.audits.tracing-attributes]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.1.21 -> 0.1.22" + +[[audits.firefox.audits.tracing-attributes]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.1.22 -> 0.1.23" + +[[audits.firefox.audits.tracing-core]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.1.27 -> 0.1.29" + +[[audits.firefox.audits.tracing-core]] +who = "Mike Hommey " +criteria = "safe-to-run" +delta = "0.1.29 -> 0.1.30" + +[[audits.firefox.audits.typenum]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.15.0 -> 1.16.0" + +[[audits.firefox.audits.unicode-ident]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.0 -> 1.0.1" + +[[audits.firefox.audits.unicode-ident]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.1 -> 1.0.3" + +[[audits.firefox.audits.unicode-ident]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.3 -> 1.0.6" + +[[audits.firefox.audits.unicode-normalization]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.19 -> 0.1.20" +notes = "I am the author of most of these changes upstream, and prepared the release myself, at which point I looked at the other changes since 0.1.19." + +[[audits.firefox.audits.unicode-normalization]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.20 -> 0.1.21" + +[[audits.firefox.audits.unicode-normalization]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.21 -> 0.1.22" + +[[audits.firefox.audits.unicode-xid]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.2.3 -> 0.2.4"