diff --git a/.github/workflows/audits.yml b/.github/workflows/audits.yml index 374d70ae5..ab19a3dc4 100644 --- a/.github/workflows/audits.yml +++ b/.github/workflows/audits.yml @@ -14,5 +14,5 @@ jobs: - uses: dtolnay/rust-toolchain@stable id: toolchain - run: rustup override set ${{steps.toolchain.outputs.name}} - - run: cargo install cargo-vet + - run: cargo install cargo-vet --version ~0.6 - run: cargo vet --locked diff --git a/qa/supply-chain/audits.toml b/qa/supply-chain/audits.toml index 7dbd48eba..f66bf9762 100644 --- a/qa/supply-chain/audits.toml +++ b/qa/supply-chain/audits.toml @@ -36,12 +36,27 @@ who = "Jack Grigg " criteria = "safe-to-deploy" delta = "1.0.68 -> 1.0.69" +[[audits.anyhow]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "1.0.69 -> 1.0.70" + +[[audits.arrayref]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.3.6 -> 0.3.7" + [[audits.bellman]] who = "Jack Grigg " criteria = ["crypto-reviewed", "safe-to-deploy"] delta = "0.13.0 -> 0.13.1" notes = "Adds multi-threaded batch validation, which I checked against the existing single-threaded batch validation." +[[audits.bellman]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.13.1 -> 0.14.0" + [[audits.blake2b_simd]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -65,6 +80,12 @@ who = "Jack Grigg " criteria = "safe-to-deploy" delta = "0.7.0 -> 0.7.1" +[[audits.bls12_381]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.7.1 -> 0.8.0" +notes = "I previously reviewed the crypto-sensitive portions of these changes as well." + [[audits.bumpalo]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -149,6 +170,11 @@ criteria = "safe-to-deploy" delta = "0.2.2 -> 0.2.5" notes = "Unsafe changes just introduce `#[inline(never)]` wrappers." +[[audits.cpufeatures]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.2.5 -> 0.2.6" + [[audits.crossbeam-channel]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -343,6 +369,11 @@ who = "Jack Grigg " criteria = "safe-to-deploy" delta = "0.12.0 -> 0.12.1" +[[audits.ff]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.12.1 -> 0.13.0" + [[audits.futures-channel]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -385,6 +416,11 @@ Changes to `unsafe` usage are to split `Either::project` into `Either::as_pin_re documentation. """ +[[audits.generic-array]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.14.6 -> 0.14.7" + [[audits.getrandom]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -404,6 +440,11 @@ who = "Kris Nuttycombe " criteria = "safe-to-deploy" delta = "0.12.0 -> 0.12.1" +[[audits.group]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.12.1 -> 0.13.0" + [[audits.halo2_gadgets]] who = "Jack Grigg " criteria = ["crypto-reviewed", "safe-to-deploy"] @@ -416,6 +457,12 @@ criteria = ["crypto-reviewed", "safe-to-deploy"] delta = "0.1.0 -> 0.2.0" notes = "The ECC core team maintains this crate, and we have reviewed every line." +[[audits.halo2_legacy_pdqsort]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +version = "0.1.0" +notes = "The ECC core team maintains this crate, and we have reviewed every line." + [[audits.halo2_proofs]] who = "Jack Grigg " criteria = ["crypto-reviewed", "safe-to-deploy"] @@ -454,6 +501,11 @@ criteria = "safe-to-deploy" delta = "1.8.1 -> 1.9.1" notes = "I'm satisfied that the assertion guarding the new unsafe block is correct." +[[audits.indexmap]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "1.9.2 -> 1.9.3" + [[audits.inout]] who = "Daira Hopwood " criteria = "safe-to-deploy" @@ -465,6 +517,11 @@ who = "Jack Grigg " criteria = "safe-to-deploy" delta = "2.5.0 -> 2.7.1" +[[audits.ipnet]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.7.2" + [[audits.itoa]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -486,6 +543,12 @@ notes = """ MDN documentation. """ +[[audits.jubjub]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.9.0 -> 0.10.0" +notes = "I previously reviewed the crypto-sensitive portions of these changes as well." + [[audits.libm]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -518,6 +581,11 @@ criteria = "safe-to-deploy" delta = "0.4.16 -> 0.4.17" notes = "I confirmed that the unsafe transmutes are fine; NonZeroU128 and NonZeroI128 are `#[repr(transparent)]` wrappers around u128 and i128 respectively." +[[audits.maybe-rayon]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +version = "0.1.1" + [[audits.memuse]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -633,6 +701,11 @@ who = "Kris Nuttycombe " criteria = "safe-to-deploy" delta = "0.2.0 -> 0.3.0" +[[audits.pairing]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.22.0 -> 0.23.0" + [[audits.parity-scale-codec]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -674,6 +747,11 @@ who = "Jack Grigg " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.4.1" +[[audits.pasta_curves]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.4.1 -> 0.5.1" + [[audits.phf]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -762,11 +840,31 @@ Appears to be a move-only change in display code to expose an internal API. I did not verify that the change was move-only, but there is no unsafe code affected. """ +[[audits.reddsa]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.3.0 -> 0.5.0" + [[audits.regex]] who = "Jack Grigg " criteria = "safe-to-deploy" delta = "1.7.0 -> 1.7.1" +[[audits.regex]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "1.7.1 -> 1.7.3" + +[[audits.regex-syntax]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.6.28 -> 0.6.29" + +[[audits.rustc-demangle]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.1.21 -> 0.1.22" + [[audits.ryu]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -815,6 +913,11 @@ who = "Daira Hopwood " criteria = "safe-to-deploy" delta = "1.0.91 -> 1.0.98" +[[audits.syn]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "1.0.102 -> 1.0.104" + [[audits.syn]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -899,6 +1002,11 @@ criteria = "safe-to-deploy" delta = "0.5.1 -> 0.6.1" notes = "Fixes a bug in parsing negative minutes in datetime string offsets." +[[audits.toml_edit]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "0.19.7 -> 0.19.8" + [[audits.try-lock]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -1235,8 +1343,18 @@ criteria = "safe-to-deploy" delta = "1.4.3 -> 1.5.7" notes = "The zeroize_c_string unit test has UB, but that's very unlikely to cause a problem in practice." +[[audits.zeroize]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "1.5.7 -> 1.6.0" + [[audits.zeroize_derive]] who = "Jack Grigg " criteria = "safe-to-deploy" delta = "1.3.2 -> 1.3.3" notes = "Removes `T: Drop` bound from `impl Drop for SomeType`. I agree it was unnecessary." + +[[audits.zeroize_derive]] +who = "Sean Bowe " +criteria = "safe-to-deploy" +delta = "1.3.3 -> 1.4.1" diff --git a/qa/supply-chain/config.toml b/qa/supply-chain/config.toml index 569f404b9..c5e34a0da 100644 --- a/qa/supply-chain/config.toml +++ b/qa/supply-chain/config.toml @@ -2,7 +2,7 @@ # cargo-vet config file [cargo-vet] -version = "0.5" +version = "0.6" [imports.bytecode-alliance] url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml" diff --git a/qa/supply-chain/imports.lock b/qa/supply-chain/imports.lock index 57b0bdb1a..82e3e6daf 100644 --- a/qa/supply-chain/imports.lock +++ b/qa/supply-chain/imports.lock @@ -186,6 +186,11 @@ who = "David Cook " criteria = "safe-to-deploy" version = "0.3.0" +[[audits.isrg.audits.proc-macro2]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.52 -> 1.0.54" + [[audits.isrg.audits.rayon]] who = "Brandon Pitman " criteria = "safe-to-deploy" @@ -211,6 +216,11 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.0.154 -> 1.0.155" +[[audits.isrg.audits.serde]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.156 -> 1.0.159" + [[audits.isrg.audits.serde_derive]] who = "David Cook " criteria = "safe-to-deploy" @@ -226,20 +236,45 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.0.154 -> 1.0.155" +[[audits.isrg.audits.serde_derive]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.156 -> 1.0.159" + [[audits.isrg.audits.serde_json]] who = "Brandon Pitman " criteria = "safe-to-deploy" delta = "1.0.93 -> 1.0.94" +[[audits.isrg.audits.serde_json]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.94 -> 1.0.95" + +[[audits.isrg.audits.syn]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.104 -> 2.0.11" + [[audits.isrg.audits.thiserror]] who = "Brandon Pitman " criteria = "safe-to-deploy" delta = "1.0.38 -> 1.0.39" +[[audits.isrg.audits.thiserror]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.39 -> 1.0.40" + +[[audits.isrg.audits.thiserror-impl]] +who = "Brandon Pitman " +criteria = "safe-to-deploy" +delta = "1.0.38 -> 1.0.39" + [[audits.isrg.audits.thiserror-impl]] who = "Brandon Pitman " criteria = "safe-to-deploy" -delta = "1.0.38 -> 1.0.39" +delta = "1.0.39 -> 1.0.40" [[audits.isrg.audits.unicode-ident]] who = "David Cook "